Originally published May 22, 2026. Last updated September 18, 2026 to reflect that the rules are now live, with post-effective reporting, a trigger reference table, and new FAQs on enforcement and acquirer flags.
TL;DR. Mastercard scam merchant monitoring is a set of revised franchise standards, in effect since July 24, 2026, that require acquirers and payment facilitators to open an investigation within 72 hours when a merchant trips defined scam risk signals. If scam activity is confirmed, the merchant must be stopped from accepting Mastercard transactions. The standards apply to card-not-present merchants across Mastercard’s network, with additional triggers for merchants that have six months or less of Mastercard acceptance history. For a high-growth mid-market ecommerce business, the operational risk is not being accused of running a scam. It is matching a signal pattern that resembles one.
The rules are no longer something to prepare for. They are the environment your acquirer operates in today. This guide covers what the Mastercard scam merchant rules require, which signals trigger a review, what is publicly known about enforcement so far, and the operating disciplines that keep a legitimate merchant from spending its acquirer relationship on cleared investigations.
The fast moving merchant is not the target of this rule. It is the one most likely to be measured against it.
What is Mastercard’s scam merchant monitoring program?
The program revises the franchise standards that govern how acquirers and payment service providers monitor merchant risk. It sits inside a broader strategy Mastercard calls Merchant Trust Services, which the company announced on May 19, 2026 as a way to harness “network-wide intelligence, advanced cyber and identity capabilities and real-time analytics” to separate legitimate merchants from risky ones.
Two mechanisms matter for merchants:
- A 72-hour investigation requirement. In Mastercard’s words, the company is “compressing the window between suspicious signals and enforcement by requiring acquirers and payment facilitators to actively monitor merchant behavior and to initiate an investigation within 72 hours when potential scam activity hits a certain risk threshold.” If the activity is confirmed, “the merchant must be stopped from accepting Mastercard transactions.”
- The Merchant Scam & Risk Indicator (MSRI). MSRI gives issuers merchant risk signals during authorization. In a pilot with a large issuer, Mastercard reports MSRI detected roughly 80% of the issuer-identified risky merchants, many as early as 90 days before the issuer’s own escalation. It launched first in Europe and the United States, with global expansion planned within the year.
The investigation requirement is what merchants experience directly. MSRI is what issuers see, and it shapes the upstream declines and fraud reports that can feed a downstream investigation. Issuers decline or report earlier; acquirers are obligated to act on those signals faster.
The revised standard lives in Mastercard’s Security Rules and Procedures, where section 7.2.1 is now titled “Potential Scam Merchant Investigation Requirement” in the August 4, 2026 merchant edition. The operative detail reaches merchants through their acquirer, not from Mastercard directly.
When did the Mastercard scam merchant rules take effect?
July 24, 2026. Payments Dive reported on July 27 that the new rules under Mastercard’s Scam Merchant Monitoring Program “went into effect Friday,” and that acquirers “must give additional scrutiny to merchants that have a processing track record of less than six months under the revised rules.”
As of mid September 2026, the standards have been live for roughly eight weeks: long enough for acquirers to have built monitoring queues and documentation procedures, not yet long enough for Mastercard or the trade press to have published enforcement statistics. The FAQ below covers what is verifiable so far.
Who does the scam merchant monitoring program apply to?
The program is broad. What varies is the intensity of monitoring.
| Dimension | Scope |
|---|---|
| Geographic scope | Mastercard’s global network. Mastercard has indicated limited regional exceptions; confirm your region with your acquirer. |
| Merchant types | All card-not-present (CNP) merchants and sponsored merchants |
| Who investigates | Acquirers and payment facilitators carry the investigation duty; merchants are the subjects of monitoring |
| New vs. established | Merchants with six months or less of Mastercard acceptance history face additional, stricter triggers |
That six month line matters more than it sounds. Opening a new acquiring relationship, switching payment service providers, or launching a new legal entity starts a new clock against that acquirer’s Mastercard portfolio. Growth motions and new merchant status tend to arrive together.
What triggers a 72-hour investigation?
Four trigger categories sit in the revised standards. Mastercard’s public materials describe the 72-hour requirement but not the underlying thresholds, which reach merchants through their acquirer. The specific criteria below follow a payments law firm’s reading of the revised rules; confirm the numbers that apply to your account with your acquirer. Each trigger is based on signals rather than intent, which means a legitimate business can meet the criteria.
| Trigger signal | Applies to | Who investigates | Timeline | Consequence if confirmed |
|---|---|---|---|---|
| Authorization approval rate drops 50+ percentage points or falls below 30% (72-hour window, 25+ transactions) | All CNP merchants | Acquirer or payment facilitator | Investigation opened within 72 hours | Mastercard authorization (and clearing, where applicable) blocked |
| Mastercard GRIP letter linking the merchant to suspected scam activity | All CNP merchants | Acquirer or payment facilitator | Investigation opened within 72 hours | Mastercard authorization blocked |
| Two or more issuers report fraud type 56 (Manipulation of Cardholder) | Merchants with six months or less of history | Acquirer or payment facilitator | Investigation opened within 72 hours | Mastercard authorization blocked |
| Two or more issuers file chargebacks whose documentation references scams or manipulation | Merchants with six months or less of history | Acquirer or payment facilitator | Investigation opened within 72 hours | Mastercard authorization blocked |
| Combined refunds plus chargebacks exceed 5% of purchase transactions (rolling 30 days, 500+ transactions) | Merchants with six months or less of history | Acquirer or payment facilitator | Investigation opened within 72 hours | Mastercard authorization blocked |
| Merchant Monitoring Service Provider (MMSP) alert for potential scam or illegal activity | All CNP merchants | Acquirer or payment facilitator | Investigation opened within 72 hours | Mastercard authorization blocked |
In every row, an investigation that clears the merchant means processing continues under ongoing monitoring. Approval rate drops attributable to BIN attacks or system issues at the acquirer are excluded. Fraud type 56, Manipulation of Cardholder, is the code issuers use when a cardholder was deceived into authorizing a payment. A GRIP letter means Mastercard’s own Global Risk Investigation Program flagged the concern; the acquirer’s job is to run it down.
Two triggers deserve extra attention from mid-market operators.
The 5% combined refund and chargeback rate. For subscription and ecommerce businesses with naturally higher refund volume, 5% is not hard to reach, particularly during a launch window when return policies, billing descriptors, and cancellation flows have not settled. It only applies in the first six months, which is exactly when those flows are least stable.
The MMSP alert. A Merchant Monitoring Service Provider watches signals outside the transaction ledger: website changes, marketing claims, public complaints, and fraud network patterns. Clean approval rates and a stable refund profile do not prevent a merchant from surfacing in an MMSP feed, which makes this the trigger most likely to surprise.
Why are high-growth mid-market ecommerce merchants particularly exposed?
Three structural reasons.
Growth motions reset the new merchant clock. A new entity, a new acquiring contract, a new region: each creates new merchant status against the relevant Mastercard portfolio. The same brand can face different scrutiny levels in different markets at the same time.
Subscription and ecommerce models generate more disputes than physical retail. Recurring charges, failed cancellation attempts, and delivery issues can push combined refund and chargeback rates toward 5% without anything being wrong. The threshold was built to catch operators who run for 90 days and disappear, not a healthy subscription business in month two.
The signals correlate with growth, not just with fraud. An issuer recalibrates its model and approvals dip. A new product line generates support volume. An expansion lands in a market with higher dispute rates. These are the textures of building a real business, and they look statistically similar to the textures of building a fake one.
None of this argues against the rule. The problem it targets is real and large. GASA’s Global State of Scams 2025 report found that 57% of adults worldwide encountered a scam in the prior year and 23% lost money, and Mastercard’s announcement cites GASA’s estimate of $442 billion in global losses. In the United States, the FTC’s 2025 Consumer Sentinel data put reported fraud losses at about $16 billion, the highest on record and roughly 25% above 2024. Legitimate operators should plan for the rule’s measurement system, not just its purpose.
What happens if you are flagged by Mastercard scam merchant monitoring?
The acquirer or payment facilitator must initiate an investigation within 72 hours of the trigger. As one acquiring consultant told Payments Dive, “that’s a pretty big deal that you have to have evidence of a response.” The investigation asks whether the merchant’s behavior matches its stated business model: whether complaints suggest deception, whether transaction data reflects genuine demand, and whether the merchant can substantiate fulfillment, refund handling, and customer communication.
Two outcomes:
- Confirmed scam activity. The acquirer blocks Mastercard authorization, and clearing where applicable. Mastercard’s public statement is direct: the merchant “must be stopped from accepting Mastercard transactions.”
- Investigation clears the merchant. Processing continues under ongoing monitoring, and the merchant can be flagged again if criteria are met again.
A cleared investigation is not free. It consumes time, documentation, and acquirer attention, and repeated flags, even repeatedly cleared ones, change the relationship. Acquirers now have to show evidence of their own response, so they have every incentive to document merchants who generate work.
What should mid-market merchants do now that the rules are live?
Six operating disciplines, ordered by leverage. Several are the same fundamentals covered in our guide to how to prevent chargebacks in ecommerce in 2026, which is not a coincidence: the signals acquirers now watch are the signals good chargeback programs already track.
1. See what your acquirer sees. Track approval rate, refund rate, chargeback rate, and the combined refund plus chargeback rate on a rolling 30 day window. The rule rewards merchants who notice a shift before their acquirer does. Our guide on how to reduce your chargeback rate covers the measurement mechanics.
2. Treat the six month window deliberately. A new acquiring relationship, market, or entity means heightened scrutiny: tighter controls on refunds and disputes early, clearer communication about what customers are buying and how to cancel, and proactive outreach to the acquirer about expected patterns.
3. Audit the subscription mechanics. The 5% threshold is most often breached by avoidable friction: unclear renewal language, confusing billing descriptors, cancellation flows that are hard to find, slow response on legitimate refunds. Each is a margin leak on its own. The rule just makes the cost legible.
4. Get ahead of disputes with prevention alerts. Network alert programs such as Ethoca and Verifi surface disputes before they become formal chargebacks. Every prevented chargeback is one that does not count toward a trigger. For new merchants near the 5% line, alerts are the fastest lever available.
5. Keep your legitimacy story documented. Current fulfillment records, refund and cancellation policy history, marketing claims, customer communications, and dispute outcomes by reason code are the difference between clearance the same day and a processing freeze that lasts days.
6. Brief the acquirer ahead of growth moves. Seasonal spikes, product launches, geographic expansion: tell the acquirer first. The paper trail contextualizes the metric shifts that follow, and it matters more now that acquirers must document their own monitoring.
Where Commerce Risk Is Heading After Mastercard’s Franchise Standards Update
The Mastercard scam merchant monitoring change is specific. The pattern it belongs to is bigger.
Commerce risk decisions are moving earlier. The 2026 franchise standards make explicit that suspected scam activity warrants action before chargebacks accumulate, and Visa has been tightening from the other direction: the Merchant Risk Council’s guidance on the stricter VAMP thresholds notes the “excessive” merchant threshold fell to 1.5% in April 2026 for most regions. Acquirers absorb that posture from both networks, so merchants encounter more questions and tighter onboarding even when nothing is wrong. Our 2026 ecommerce fraud trends guide tracks the broader shift.
At the same time, the signals that trigger reviews are getting noisier and further from the merchant’s control. MMSP alerts, issuer fraud reports, and MSRI scores are inputs a merchant cannot directly manage, and defending against them case by case is exhausting. The more durable posture is operational context that makes legitimate activity self-evident: knowing, at any moment, what your shoppers are actually doing and why, and being able to show it when an acquirer asks.
Good shoppers should not face friction designed for bad actors. Trusted businesses should not absorb scrutiny designed for scam operators. The path through both is the same: better context, applied earlier, in the workflows where decisions get made.
How Wyllo Helps
The signals acquirers now watch under the Mastercard scam merchant rules are dispute patterns, complaint volume, refund behavior, and clusters of accounts behaving the same way. Those signals rarely live in one system, which is how a merchant ends up learning about a pattern from their acquirer rather than from their own reporting. Wyllo, the risk intelligence platform for commerce, reads them together and applies the merchant’s own context, so the judgment arrives inside the tools your team already uses and a pattern gets addressed while it is still yours to explain.
- Wyllo Payment Fraud Protection screens every transaction with AI plus human fraud analysts, keeping approval rates stable and stopping the third-party fraud that turns into fraud reports and chargebacks against a new merchant account.
- Wyllo Bot and Reseller Detection identifies fake accounts, card testing bursts, and linked accounts before they distort your approval rate or your dispute profile.
- Wyllo Chargeback Management handles alerts, dispute workflows, and representment end to end, so refund and chargeback rates stay visible and below the lines that matter.
- Wyllo CX Support puts risk scores and next-best actions in front of support agents, so a frustrated customer gets resolved before they become a scam-referenced chargeback.
Clarity over chaos.
Frequently Asked Questions
What is Mastercard scam merchant monitoring?
Mastercard scam merchant monitoring refers to revised franchise standards, in effect since July 24, 2026, that require acquirers and payment facilitators to monitor merchants against defined scam risk indicators and initiate an investigation within 72 hours when a threshold is met. Confirmed scam activity results in the merchant being blocked from accepting Mastercard transactions. It is part of Mastercard’s broader Merchant Trust Services strategy, which also gives issuers a Merchant Scam & Risk Indicator at authorization.
Has Mastercard started enforcing the scam merchant rules?
The standards became effective July 24, 2026, and Payments Dive confirmed they were in force as of late July. Acquirers are now obligated to monitor and to document their response within 72 hours of a trigger. As of September 2026, neither Mastercard nor the trade press has published enforcement statistics such as investigation counts or terminations. Treat the rules as active, and assume your acquirer is running the monitoring even if you have not heard from them.
How do I know if my acquirer has flagged me?
Mastercard’s standards place the investigation duty on the acquirer or payment facilitator, so the first sign is typically a documentation request from your processor or payment platform: transaction evidence, fulfillment records, refund policies, or an explanation of a metric change. There is no public flag list. Ask your acquirer directly what indicators they monitor and how they will notify you, and track your own approval, refund, and chargeback rates so you can anticipate the question.
What triggers a Mastercard scam merchant investigation?
Four categories: a sharp authorization approval rate drop (50 or more percentage points, or below 30%, over 72 hours with at least 25 transactions); a Mastercard GRIP letter tied to suspected scam activity; new merchant signals (two or more issuers reporting fraud type 56, two or more scam-referenced chargebacks, or refunds plus chargebacks above 5% of transactions over a rolling 30 days with at least 500 transactions); and an alert from a Merchant Monitoring Service Provider.
Can a legitimate merchant be flagged under Mastercard scam merchant monitoring?
Yes. The triggers are based on signals, not intent, and several correlate with ordinary growth events such as changing acquirers, launching in a new market, or a launch window spike in refunds. A cleared investigation still costs time and acquirer goodwill. The defense is keeping metrics visible and documentation current so a flagged merchant can substantiate legitimacy within the acquirer’s 72-hour window.
Does the Mastercard rule replace Visa’s VAMP?
No. The Visa Acquirer Monitoring Program is a separate Visa program with its own ratio thresholds, which the Merchant Risk Council summarizes at a 1.5% excessive line for most regions since April 2026. Mastercard’s scam merchant monitoring uses different triggers and a 72-hour investigation model. The disciplines that prepare a merchant for one tend to prepare it for the other.
Bringing It Together
Mastercard’s scam merchant monitoring rules have been in effect since July 24, 2026. The practical change for a mid-market ecommerce merchant is not a new fee or a new form. It is that your acquirer is now required to notice specific patterns in your data, act within 72 hours, and document that it did. The patterns are the ones that already predict chargeback trouble: approval rate swings, refund and dispute spikes, and complaints that use the language of deception.
Both networks are moving toward earlier intervention on signals further from the merchant’s control. That favors merchants who can explain their own numbers before anyone asks, and it costs merchants who discover a monitoring program from the inside.
Curious how an intent-aware risk intelligence approach would change what your acquirer sees when it looks at your account? Start with Wyllo Payment Fraud Protection for stable approvals and fewer disputes driven by fraud, or explore the broader Wyllo platform for connected intelligence across the full customer journey.
