VAMP compliance is forcing ecommerce merchants to rethink fraud controls

At a glance

What this is: Visa’s updated VAMP framework is pushing ecommerce merchants and acquirers to treat chargebacks and fraud as a single compliance problem, not separate operational queues.

Why it matters: For IAM and fraud practitioners, the lesson is that control design, evidence collection, and response ownership now need to work across merchant operations, payment risk, and governance boundaries.

By the numbers:

• Merchant excessive 2.2% ratio or higher, with at least 1,500 fraud and dispute transactions per month.
• Acquirer excessive 0.7% portfolio ratio or higher.

Context

VAMP changes the problem from isolated fraud handling into threshold management across the full payment chain. When fraud and disputes are aggregated against the same compliance line, merchants can no longer rely on narrow chargeback teams or reactive case handling to stay safe.

The governance gap is visibility. Teams need to know not only how many disputes they see, but how those disputes, fraud signals, fulfilment patterns, and acquirer-level obligations interact. That makes the issue relevant to identity and fraud practitioners because transaction trust, account behaviour, and dispute evidence now sit inside the same control environment.

Key questions

Q: What breaks when fraud and disputes are counted under one payment threshold?

A: Separate fraud and chargeback processes break down because the organisation can no longer treat them as independent problems. The same activity now influences compliance status, account risk, and acquirer enforcement at once, so merchants need one control model for monitoring, escalation, and evidence rather than two disconnected queues.

Q: Why can a merchant be penalised even if its own fraud team is performing reasonably well?

A: Because VAMP also creates portfolio accountability. A merchant may stay close to its own limits and still raise risk for the acquirer if the broader merchant portfolio crosses the threshold. That is why governance, reporting, and escalation need to work across the merchant, PSP, and acquirer boundary.

Q: How should ecommerce teams automate chargeback management without losing control over complex disputes?

A: The best approach is a tiered workflow. Automate high-volume or lower-complexity cases first, then route sensitive or high-value disputes to trained specialists. This reduces manual effort, speeds evidence gathering, and lets analysts focus on stronger rebuttals. Automation works best when it is paired with clear case classification, centralized data, and consistent review rules.

Q: Should subscription and digital-goods merchants use different fraud controls?

A: Yes, because those models produce more concentrated dispute and fraud exposure than many standard storefronts. Merchants should use tighter monitoring, clearer evidence retention, and faster exception handling for these flows, since the business model itself can make VAMP compliance harder to sustain.

Technical breakdown

How VAMP collapses fraud and dispute monitoring into one control boundary

Visa’s Acquirer Monitoring Program treats fraud and dispute events as part of the same monitoring picture. That matters because a merchant can be exposed even when no single queue looks critical on its own. Under this model, the threshold is not just a fraud metric or a chargeback metric. It is a combined compliance signal that reflects how payment risk propagates through authorisation, fulfilment, dispute handling, and acquirer portfolio oversight. For ecommerce merchants, especially in card-not-present and recurring billing models, the control challenge is no longer detection alone. It is governance over how signals are counted, attributed, and escalated across the payment stack.

Practical implication: Build one operational view of fraud and dispute exposure instead of treating them as separate workstreams.

Why merchant controls fail when dispute response is too late

Many merchants still treat disputes as a post-incident finance task. VAMP makes that approach brittle because delay reduces the time available to refund, pause fulfilment, or gather evidence before a dispute converts into a chargeback event. This is especially hard for businesses with digital goods, complex shipping, or international fulfilment, where the operational trail can be thin and response windows are short. The underlying failure is not just weak fraud detection. It is the absence of a fast decision path that connects order risk, fulfilment status, and dispute handling.

Practical implication: Create a rapid response path that lets fraud, payments, and fulfilment teams act before a dispute becomes a chargeback.

Why acquirer compliance turns merchant fraud into portfolio governance

VAMP introduces a portfolio effect. A merchant may be compliant at its own level and still create exposure for the acquirer, which changes the power dynamic between platforms, PSPs, and merchants. That is why payment risk now behaves like an identity governance problem in miniature: thresholds, ownership, evidence, and enforcement all need clear boundaries. Merchants do not just need better fraud scores. They need policy, routing, and dispute evidence that can survive portfolio-level scrutiny. The control question is who owns the risk signal when the account relationship is downstream of a platform or acquirer.

Practical implication: Align merchant, PSP, and acquirer ownership for threshold monitoring and escalation before enforcement actions begin.

Threat narrative

Attacker objective: The objective is to generate enough fraudulent or disputed activity to disrupt merchant operations and force compliance consequences.

1. Entry occurs through payment abuse patterns such as fraudulent orders, card-not-present activity, recurring billing misuse, or fulfilment models that naturally generate disputes.
2. Credential-style access is not the issue here; instead, the attacker objective is to push transactions into dispute or fraud categories that count against merchant and acquirer thresholds.
3. The impact is account termination, frozen payouts, or broader portfolio enforcement when combined fraud and dispute ratios breach VAMP limits.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VAMP is a governance problem disguised as a fraud metric. Once fraud and dispute events are counted together, the control question shifts from catching bad orders to proving that the merchant can manage risk as a monitored programme. That is a material change for ecommerce operations because ownership now spans fraud teams, payments teams, fulfilment, and the acquirer relationship. Practitioners should treat threshold management as a board-visible control, not a back-office exception queue.

Combined monitoring creates a threshold memory problem for merchants. Separate reporting lines can hide how quickly a business approaches enforcement when TC40-style fraud signals and dispute outcomes are aggregated. The merchant no longer has the luxury of assuming that one team can solve the problem in isolation. For practitioners, the implication is clear: the control surface must unify fraud prevention, dispute handling, and payment governance before the thresholds are crossed.

High-dispute ecommerce models need compensating controls, not just better detection. Card-not-present, subscription, digital goods, and complex fulfilment businesses face structurally higher exposure, so the issue is often model risk rather than one-off fraud failure. That makes policy design, fulfilment discipline, and evidence retention as important as scoring. Teams should assume that the business model itself is part of the control environment.

Merchant visibility into acquirer-level consequences is now part of fraud governance. A merchant can be affected even when the immediate problem appears to sit with the PSP or platform. That is why the governing concept here is portfolio accountability: one party’s threshold breach can cascade into another party’s enforcement action. Practitioners should map who owns the evidence, who owns the escalation, and who owns the decision to pause exposure.

Fraud controls now sit on the boundary between trust and payment assurance. That boundary matters because the merchant’s job is not only to reject bad transactions but to preserve continuity of revenue under monitored conditions. In practice, that means faster dispute intervention, clearer ownership, and more disciplined transaction policy. Teams should respond as though threshold breach is an operational incident, not just a loss-metric failure.

What this signals

VAMP threshold management now belongs in the fraud governance layer. Merchants cannot rely on isolated chargeback review once fraud and disputes are aggregated against the same compliance line. The programme needs a shared operating model that joins risk scoring, fulfilment decisions, and escalation ownership before enforcement becomes a business event.

High-risk ecommerce models need policy discipline more than more alerts. Subscription, card-not-present, digital goods, and cross-border businesses accumulate risk in ways that make late intervention ineffective. For practitioners, the signal is to measure whether their controls can change the transaction outcome before dispute conversion, not just count losses after the fact.

For practitioners

• Map VAMP exposure to a single control owner Assign one accountable function to track merchant-level fraud, dispute ratios, and acquirer portfolio obligations so thresholds do not sit in separate teams.
• Shorten the dispute-to-decision path Set a workflow that lets fraud, fulfilment, and payments teams refund, hold shipment, or escalate evidence before a dispute becomes a chargeback.
• Segment high-risk business models Review card-not-present, subscription, digital goods, and cross-border flows separately because those models can accumulate VAMP exposure faster than standard ecommerce.
• Strengthen evidence retention for representment Preserve order, delivery, customer interaction, and policy evidence so Compelling Evidence 3.0 can be used consistently when disputes are challenged.
• Measure thresholds before enforcement hits Track merchant and portfolio ratios continuously so teams see when they are approaching 2.2% merchant or 0.7% acquirer risk levels rather than reacting after termination notices.

Key takeaways

• VAMP turns fraud and dispute handling into one compliance problem, which means merchants need governance across payments, fulfilment, and evidence management.
• The article’s cited thresholds are 2.2% for merchants and 0.7% for acquirer portfolios, showing that enforcement can happen at both merchant and platform level.
• Teams that want to reduce account termination risk should focus on faster dispute response, stronger representment evidence, and clearer ownership of payment risk decisions.

Key terms

• Acquirer Monitoring Program: A payments oversight framework used by card networks to track merchant or portfolio risk against defined thresholds. It links fraud, disputes, and operational controls to enforcement outcomes, making the acquirer responsible for portfolio performance and merchants responsible for the behaviours that drive it.
• Chargeback Recovery Rate: The percentage of disputed transactions that a merchant successfully overturns or recovers. It is a practical measure of how well evidence, workflow design, and review prioritisation are working together, rather than a simple count of disputes processed.
• Compelling Evidence: Compelling evidence is the documentation a merchant submits to support a dispute response and show that a transaction or claim was legitimate. It typically includes order details, customer activity, delivery records, and policy context. Strong evidence is accurate, timely, and matched to the dispute reason.
• Portfolio-Level Compliance: A control model where one merchant’s risk can affect the acquirer or platform that supports many merchants. This shifts responsibility from single-account monitoring to shared governance, because threshold breaches can trigger action across the broader portfolio.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, helps practitioners connect identity governance, machine identity security, and secrets management to wider security operations. It is useful for teams that need a stronger control mindset across access, trust, and lifecycle governance.