Every year the advice is the same: before Black Friday, tighten your fraud filters and switch on 3D Secure. It is reasonable advice, and incomplete in a way that is going to cost some stores real money this winter.
On 1 April 2026, Visa lowered the threshold at which a merchant is flagged as “Excessive” under its Acquirer Monitoring Program (VAMP) from 2.2% to 1.5% — a 32% tightening of the margin for error, seven months before the biggest transaction spike of the year. The part most stores miss is that the fraud generated by your November peak is not measured against November. It is measured against January and February, when your sales volume has collapsed back to normal and the same number of disputes produces a much uglier ratio.
Here is how the ratio is actually calculated, why 3D Secure does less for it than almost everyone assumes, and what to change in the eight weeks before Black Friday on 27 November 2026.
Quick answer
Visa’s VAMP “Excessive” merchant threshold dropped to 1.5% on 1 April 2026 (from 2.2%). The ratio counts fraud reports plus disputes, divided by settled card-not-present transactions, measured monthly. Because disputes arrive 30–120 days after the sale, your Black Friday fraud lands in January–March and is divided by January–March volume — a small denominator. 3D Secure can shift liability for a fraud chargeback to the issuer, but the issuer’s fraud report still counts in your numerator. The fix is to stop fraudulent orders shipping, not just to move who pays for them.
Mastercard’s equivalent programme (ECP) triggers at 100+ chargebacks in a month and a 1.5% ratio.
Table of Contents
ToggleWhat VAMP actually measures
VAMP replaced Visa’s two older programmes — the Visa Dispute Monitoring Program and the Visa Fraud Monitoring Program — in 2025, and merged them into a single number. That merge is the detail that catches stores out, because the old programmes let you be fine on fraud while being poor on disputes, or the reverse. VAMP adds both together.
How the VAMP ratio is built
Card-not-present transactions only, calculated monthly.
Numerator — counts against you
Fraud reports from issuers (TC40) + disputes (TC15) under reason codes 10 (except 10.5), 11, 12 and 13
Denominator
Count of settled card-not-present transactions (TC05) — a count of orders, not revenue
Excluded — good news
Disputes resolved through pre-dispute tools before the data extract, and fraud reports that qualify for Compelling Evidence 3.0
Warning — double counting
One fraudulent order can appear in both the fraud report and the dispute file. When it does, it is counted twice.
Takeaway: the thing that gets you flagged is a count of events, not the money lost. A string of small fraudulent orders damages your ratio exactly as much as a string of large ones.
The thresholds, side by side
| Programme | Trigger | Measured as |
|---|---|---|
| Visa VAMP Merchant, Excessive |
1.5% from 1 April 2026 previously 2.2% |
(Fraud reports + disputes) ÷ settled CNP transactions, monthly |
| Visa VAMP Acquirer |
0.7% | Portfolio-wide — why your payment provider may act before Visa does |
| Mastercard ECP Excessive Chargeback Merchant |
100+ chargebacks in a month and 1.5% | Current-month chargebacks ÷ previous-month transaction count |
| Mastercard ECP High Excessive |
300+ chargebacks and 3% | Same calculation, steeper penalties |
Note the safety net for small merchants: Mastercard requires a floor of 100 chargebacks in a month before the percentage matters at all, and Visa’s merchant identification has a count floor alongside the ratio. These programmes bite at scale — which, for a seasonal store, means they bite in exactly the months after Black Friday.
Why the bill arrives in February
This is the part that surprises people, and it is pure arithmetic rather than anything hidden in the rules.
Cardholders can dispute a charge up to 120 days after payment, and in practice disputes trickle in over roughly 30 to 120 days. An order placed on 27 November is therefore most likely to be disputed between late December and late March. Both networks calculate monthly, and Mastercard explicitly divides this month’s chargebacks by last month’s transaction count. So:
The peak-season ratio trap
NOVEMBER — healthy
Huge order count. Few disputes have landed yet. Your ratio looks its best all year.
DECEMBER–JANUARY — warning
First wave of peak disputes. Denominator still partly inflated by December trading.
FEBRUARY–MARCH — bad
Peak disputes still arriving. Order volume back to baseline. Big numerator over a small denominator.
Takeaway: if November is five times a normal month and even a modest share of those orders go bad, the resulting disputes get divided by a February denominator. A store comfortably under 1.5% all year can cross it in a single quarter without its underlying fraud rate changing at all.
If you only ever look at the dispute figure your processor shows by charge date, you will not see this coming. Stripe, for example, distinguishes dispute rate (disputes attributed back to the date of the original payment) from dispute activity (disputes counted in the month they arrive). The dispute rate is the more honest picture of which sales went wrong — but the card networks use the activity calculation. Check that one.
The 3D Secure misunderstanding
Here is the claim you will read in most peak-season checklists: turn on 3D Secure and fraud chargebacks become the issuer’s problem. That is roughly true about liability, and almost irrelevant to the ratio that gets you fined.
Two things are going on.
First, liability shift is not a guarantee. Stripe’s documentation is unusually direct about this: successful 3DS authentication does not guarantee liability shift. It can generally be expected on eligible fraud disputes, but no authentication result and no electronic commerce indicator makes it certain. Some industries are excluded by Visa outright, and shift can be downgraded after authorisation.
Second, and more important here: liability shift does not remove the event from your count. Issuers file fraud reports when they believe a transaction was fraudulent, independent of who ends up paying, and Stripe notes that Visa counts those early fraud warnings toward VAMP identification. The documented VAMP exclusions are pre-dispute resolutions and Compelling Evidence 3.0 qualified fraud. Successful 3DS authentication is not on that list.
Common mistake
Treating 3D Secure as fraud prevention. It is an authentication step and a liability instrument. If a fraudster has the card and the one-time code — which is exactly what a successful phishing or SIM-swap attack buys them — 3DS waves the order straight through, you ship the goods, the issuer files a fraud report, and your ratio absorbs it whether or not you are refunded. Authentication tells you the person passed a check. It does not tell you the order is good.
None of this is an argument against 3D Secure — the data genuinely favours it where it is mandated. Stripe’s analysis of transactions from January 2022 to March 2026 found that in Strong Customer Authentication regions, businesses using its 3DS optimisations saw a 1.20% uplift in conversion alongside a 7.67% reduction in fraud across all transactions. At country level, Malaysia’s strict multifactor mandate coincided with a 74% fall in fraud rates between 2022 and 2025, and Japan’s dispute rates ran more than 30% lower in 2025 than the same period a year earlier after its April 2025 mandate. Europe fell 21% overall, France 40%, Great Britain 27%.
The instructive exception is Iberia, the one European region where fraud rates kept rising year on year — attributed to heavy reliance on SMS one-time codes, which smishing attacks defeat. Same regulation, different implementation, opposite outcome. That is the real lesson: the authentication method does the work, not the checkbox.
What to actually do before 27 November
- Find your dispute activity figure, not your dispute rate. In Stripe it is under Analytics; most gateways have an equivalent. The industry treats activity above 0.75% as excessive, well below Visa’s 1.5% fine threshold, and a sharp upward trend can attract attention before you reach either number. Write down today’s figure so you can see the January move.
- Turn on pre-dispute resolution if your provider offers it. Visa’s Rapid Dispute Resolution and order-insight tools resolve a dispute before it becomes a chargeback, and resolutions that land before the data extract are excluded from VAMP. This is one of the few levers that removes events from the numerator rather than just paying for them.
- Answer every dispute inquiry on a 3DS-authenticated charge. An inquiry is a request for information, not yet a chargeback — but ignoring one lets the issuer raise a “no-reply” chargeback that can invalidate the liability shift you were counting on. Make sure someone is on the inbox over the holidays.
- Tighten screening on the signals that actually predict fraud. If you are on WooPayments, switch fraud protection from Basic to Advanced and review the individual rules: AVS mismatch, international IP address, IP-to-billing-country mismatch, billing-and-shipping-country mismatch, purchase price thresholds and order item thresholds. CVC failures are always blocked and cannot be turned off.
- Use risk-based 3DS rather than blanket 3DS. On the WooCommerce Stripe extension you do not toggle 3DS in the plugin; authentication runs through Payment Intents and is driven by Radar rules in the Stripe Dashboard. Mandated SCA requests run automatically regardless. Request challenge flows for the risky slice — new customer, high value, mismatched geography, expedited shipping to a freight forwarder — and leave the rest frictionless.
- Hold high-risk orders for manual review instead of auto-fulfilling. This is the only step that stops a fraudulent order becoming both a fraud report and a loss of stock. During peak, fulfilment automation is exactly what fraudsters are counting on.
- Make your billing descriptor and order confirmations unmistakable. A meaningful share of “fraud” disputes are customers who did not recognise a line on their statement. This is the cheapest numerator reduction available, and most stores never touch it.
Advanced notes and trade-offs
Refunding on a fraud warning is not free. Refunding an order flagged by an early fraud warning can stop it becoming a dispute, but the fraud report itself has already been filed and still counts toward VAMP identification. Refund to protect the goods and the dispute count, not in the belief that it erases the event.
Compelling Evidence 3.0 is worth the setup. Fraud qualifying for CE 3.0 is explicitly excluded from the VAMP ratio, but qualifying means producing prior undisputed transaction history for the same cardholder with matching identifiers — which means storing device ID, IP and shipping address against orders. Most WooCommerce stores hold this data and never surface it.
Watch the acquirer threshold, not just yours. The acquirer-level VAMP threshold is 0.7%, far tighter than the merchant one. Your payment provider is managing its own portfolio ratio, which is why a store can be fine against Visa’s 1.5% and still get an uncomfortable email, higher reserves or an account review from its processor first.
False declines are the other half of the bill. Screening that is too aggressive turns away good customers, and in November a false decline is a lost order you paid to acquire. Blanket 3DS on every transaction is the classic over-correction. Review approval rate and dispute activity together, never one alone.
FAQ
Does a won dispute still count against my ratio?
Yes. All disputes count toward your dispute activity whether you win or lose them, which is why prevention beats representment as a strategy. Winning protects the revenue; it does not protect the ratio.
My store is small. Do these programmes apply to me?
Not in practice while your volume stays below the count floors — Mastercard needs 100+ chargebacks in a single month before the percentage matters. But the 0.75% industry benchmark and your own processor’s risk team apply at any size, and a seasonal spike can push a small store into range for a month or two.
Will turning on 3D Secure hurt my conversion rate?
Not necessarily, and the evidence in SCA regions points the other way when it is implemented well — Stripe measured a 1.20% conversion uplift alongside a 7.67% fraud reduction with its 3DS optimisations. Frictionless authentication, where the issuer approves in the background without a challenge screen, is the norm for low-risk transactions. Forcing a challenge flow on every order is what hurts.
What is the difference between a fraud report and a chargeback?
A fraud report (an early fraud warning, in Stripe’s terms) is the issuer telling you it believes a transaction was fraudulent. A chargeback is the cardholder formally reversing the payment. One can happen without the other — and under VAMP, both count.
How soon should I start?
Now. Rule changes and filter tuning need a few weeks of real traffic to show whether they are declining good orders, and 27 November is not the day to find out.
Where to go from here
The most useful thing you can do this week takes ten minutes: open your payment provider’s analytics, find the dispute activity figure, and note it down alongside your current monthly transaction count. That is the number the card networks will read in February, and the only baseline that tells you whether anything you change before Black Friday actually worked.
Then work through the rest of your peak preparation. Our Black Friday and Cyber Monday checklist covers the operational side, the complete BFCM revenue guide handles campaign planning, and the WooCommerce holiday season prep guide walks through the store-level tasks. If your payment stack is the weak link, our roundup of WooCommerce payment integration plugins compares the gateways on fraud tooling as well as fees. And since fraud is not the only peak cost that has moved this year, it is worth reading what UPS, FedEx and USPS will charge in surcharges this season too.
Thresholds, programme rules and carrier terms change. Figures here reflect published Visa, Mastercard and Stripe documentation as of October 2026 — verify current thresholds with your acquirer before making decisions based on them.
