MastercardMasterCard mastercard A global payments network enabling electronic transactions between banks, merchants, and cardholders. has long maintained strict monitoring programs for chargebacks and fraudFraud fraud Criminal deception involving unauthorized payments or use of financial credentials., designed to protect the ecosystem from abuse, friendly fraudFriendly Fraud friendly-fraud Occurs when a cardholder disputes a legitimate transaction, claiming it was unauthorized., and merchantMerchant merchant An individual or business that accepts payments in exchange for goods or services. negligence. If you’re a merchant, PSP, or acquirerAcquirer acquirer A financial institution or payment processor that manages the merchant account, enabling businesses to accept card payments. Acquirers receive all transactions from the merchant and route them to the appropriate issuing bank., understanding these programs is crucial to avoid penalties—and to keep your MID from getting flagged or shut down.
This post gives you the latest 2025 update on Mastercard’s Excessive ChargebackChargeback chargeback A dispute raised by the cardholder that results in reversal of a transaction. Can lead to penalties for merchants. (ECM) and Excessive Fraud Merchant (EFM) programs, with thresholds, consequences, and links to key Mastercard rules.
🚨 Why It Matters
Chargebacks and fraud not only affect your bottom line—they affect your ability to process payments. Mastercard automatically places merchants into monitoring programs when thresholds are breached, and fines can quickly escalate into tens of thousands of dollars.
📊 Mastercard Monitoring Programs: Overview
| Program | What It Tracks | Applies To |
|---|---|---|
| ECM – Excessive Chargeback Merchant | Chargeback count and ratio | All merchants |
| EFM – Excessive Fraud Merchant | Fraud volume and ratio (TC40s) | Card-not-present (CNP) merchants |
| HSMP – High-Risk SecuritySecurity security Measures used to protect transaction data from fraud and cyber threats. Monitoring Program | PCI-DSS non-compliance | Acquirers & processors |
🧾 Mastercard ECM – Chargeback Monitoring Program
| Threshold | Value |
|---|---|
| Monthly Chargeback Count | 100+ chargebacks |
| Chargeback-to-Sale Ratio | ≥ 1.5% |
| Identification Time | 2 consecutive months |
| Program Duration | 6 months (minimum) |
| Fines | Starting from $1,000/month, scaling up to $25,000+ |
💡 Tip: Mastercard counts first chargebacks only, not second presentments.
📘 Mastercard Rules on Chargebacks
🛡️ Mastercard EFM – Fraud Monitoring Program
This applies to merchants processing card-not-present transactionsTransactions transactions Interactions where value is exchanged for goods or services. (e.g., eCommerceeCommerce ecommerce Commercial transactions conducted electronically on the internet. Includes digital payments, shopping carts, and fraud prevention., mobile).
| Threshold | Value |
|---|---|
| Fraud Volume | $5,000+ in fraud TC40 reports |
| Fraud-to-Sale Ratio | ≥ 0.5% |
| Identification | 1 month breach to be listed |
| Duration | Minimum 6 months |
| Fines | Starting at $500 → can exceed $50,000/month |
⚠️ TC40s are fraud alerts sent by issuers—even if no chargeback is raised yet.
📉 Escalation Tiers (2025)
| Program Phase | Description | Typical Duration | Consequences |
|---|---|---|---|
| Early Warning | First month breach | 1 month | Alert only |
| Standard | 2+ consecutive breaches | 3–6 months | Monthly reporting + fines |
| Excessive | High chargeback/fraud + longer duration | 6+ months | Heavier fines + network restrictions |
| Termination | No remediation or repeated breach | Final | MID blacklisting (MATCH file) |
🧯 What You Can Do to Avoid These Programs
| Strategy | Action Items |
|---|---|
| Reduce Fraud | Use 3DS2, AVS, CVV, device fingerprinting, velocity checks |
| Monitor TC40s | Use PSP/acquirer dashboard or subscribe to alert feeds |
| Refund Before Disputes | Proactively refund risky transactions before chargebacks are filed |
| Train Customer Support | Timely response to billing issues reduces friendly fraud |
| Post-Sale Messaging | Keep customers informed of shipping/returns to reduce buyer’s remorse |
🔄 MATCH List – The Final Strike
Merchants terminated under Mastercard programs are added to the MATCH (Member Alert To Control High-Risk Merchants) list, making it difficult to get another MID globally.
✅ Best Practices for PSPs & Acquirers
- Provide real-time fraud & dispute dashboards
- Build alerting workflows for chargeback thresholds
- Educate high-risk merchant verticals (e.g., subscriptions, crypto, gaming)
- Offer mitigation tools like:
🔗 Key URLs & Resources
| Resource | URL |
|---|---|
| Mastercard Rules & Monitoring | mastercard.us/rules.html |
| TC40 & Fraud Programs | mastercard.com – TC40 |
| MATCH List Info | mastercard.us – MATCH |
| Verifi (VisaVisa visa A leading global payment technology company connecting consumers, businesses, and banks. + MC alerts) | verifi.com |
| Ethoca Alerts | ethoca.com |
🏁 Final Thoughts
If you’re a merchant, acquirer, or PSP, Mastercard’s fraud and chargeback thresholds should be on your radar every month. Prevention is far cheaper than fines—or termination.
In 2025, Mastercard is expected to introduce even tighter fraud analytics powered by AI, including merchant-specific fraud baselines and behavioral anomaly detection.
Stay clean. Stay smart. Or risk being MATCHed.
Vibhu Arya is a fintechFintech fintech
Short for financial technology, refers to tech-enabled innovation in financial services. and payments expert with 15+ years of experience simplifying how money moves across digital and retail ecosystems. He’s led strategy and partnerships at Citibank, Adyen, and IKEA, and helped scale fintech startups (Snapdeal, iPaylinks) to $1B+ valuations. Vibhu’s expertise spans cards, crypto, cross-border, and real-time payments. He is the founder of PaymentsPedia.com, where he writes about the future of payments.
📧 vibhu@paymentspedia.com | LinkedIn