Call (844) NO-DISPUTES
What is the Visa Fraud Monitoring Program (VFMP)?
The Visa Fraud Monitoring Program is Visa’s way of tracking merchants whose fraud rates are far higher than what they usually see across the network. What they’re actually doing is trying to find these fraud patterns before they turn into a problem for your business. It’s their early warning system that starts once your fraud numbers are higher than acceptable. The program is designed to give you a chance to see what’s going wrong and fix it before they take bigger steps like charging you penalties or eventually closing down your merchant account.
Most merchants first learn about VFMP through a notification in their inbox that lets them know they’re either approaching the program thresholds or have already been enrolled. Nobody wants to get that email and it can seem sudden if you weren’t already watching your fraud metrics closely. The program tracks your fraud ratio each month and compares those numbers against Visa’s set thresholds to see if your account needs any action.
Fraud rates that rise too high don’t prompt Visa to shut off your payment processing right away. That’s the entire point of placing you in VFMP first. It gives you some time to find what’s driving the problem and to put some fixes in place – it lets you work with the problems ahead instead of losing your payment processing access.
The way the program actually works is pretty simple – it figures out your fraud ratio by taking the number of fraudulent transactions and dividing that by your total transaction count. There’s always a 1-month delay in how Visa reviews this data and that means your October performance will set where you stand in November. Once you cross those fraud thresholds you’ll start moving through different tiers of the program and each level comes with stricter requirements and some possible fines that can quickly get expensive.
How It Works
The Visa Fraud Watching Program is like a monthly report card for your business and each month Visa checks your fraud ratio to see if your account needs extra attention. The math stays easy – they add up all the fraudulent transactions on your account and divide that total by your sales volume for the month. The result is a percentage that shows how much fraud you might have compared to legitimate sales.
The thresholds are where it gets interesting. If your fraud ratio hits 0.65% you enter what they call the Early Warning level – a signal that issues could be on the way.
Once you reach 0.9%, you’re now in the Standard program. And if your ratio climbs to 1.8%, you’ve reached the Excessive level, a place no merchant wants to be.
There’s more to it than just percentages though. Visa also looks at dollar amounts when deciding. You need to have at least $75,000 in fraud to enter the Standard program – even if your ratio is high enough to qualify. For the Excessive level, that minimum jumps to $250,000 and gives smaller businesses some protection from getting flagged just because they had a few bad transactions.
One factor that works in your favor is that Visa uses a rolling calculation so you won’t get penalized for one terrible month. You actually have to go over the thresholds for 2 straight months before enrollment kicks in – this gives businesses the chance to fix issues before they snowball. Your acquirer will let you know if you’re close to these limits or if you’ve already crossed them.
The whole system runs on autopilot and has its pros and cons. There’s no committee sitting around choosing who gets flagged based on personal judgment calls – it’s all based on numbers and makes the process fairly predictable once you understand it.
How it Affects Chargeback Prevention
VFMP watches fraud chargebacks that fall underreason codes 10.4 and 10.5. These cover situations where cardholders claim they never authorized the transaction or say that the charge is completely fraudulent. Normal disputes about product quality or shipping delays don’t count toward your VFMP thresholds.
Once you’re in the program, costs can escalate pretty fast. Every fraud chargeback costs you quite a bit more than it would normally. Visa can pile on fines on top of your standard chargeback fees. Your payment processor might raise their rates or add their own penalties because you’re now seen as a much riskier merchant for them to accept.
The big headache starts when other card networks see that you’re in Visa’s program. Mastercard has its own fraud tracking system and they’ll probably put you in theirs as well. American Express and Discover might do the same. Before long you have multiple tracking programs and requirements coming at you from every direction.
Payment processors don’t love merchants who are in VFMP either. They may want you to hold more money in reserve or make you use fraud-prevention tools. Some processors won’t even take you on as a client. The best move is to stop fraud before it happens so you never have to worry about VFMP in the first place.
Example Scenarios
Or maybe you’re operating a subscription service for meal kits or software. They claim they never authorized the charges – even though they’ve been happily enjoying your service for the past 6 months. These friendly fraud cases add up very fast and suddenly you have to find VFMP enrollment.
The upside is that plenty of merchants actually do manage to get out of this program successfully. A medium-sized electronics retailer found themselves completely stuck in the Standard status even though they were processing around 50,000 transactions a month. They went ahead and added full address-verification systems across their whole setup and started requiring CVV codes for each order that came through. Within just 4 months their fraud rate had dropped well below the threshold and they managed to exit the program.
Speed matters with fraud prevention and businesses that act fast usually manage to stay out of big issues. There’s this clothing company that dodged the VFMP penalties because they caught some warning signs before the situation spiraled out of control. What tipped them off were all these expensive orders that were being shipped to the same handful of locations but each order was paid for with a different credit card. Even during their busiest sales season of the year they kept their fraud rate hovering around 0.6% – it’s actually pretty impressive given how busy they were.
Requirements and Timeframes
Your acquirer wants a remediation plan from you and they want it as soon as possible – their patience is pretty limited. The document has to list your full strategy for cutting down the fraud across your whole operation. Vague or general explanations won’t cut it here – they need specifics about how you plan to work with the problem from every angle.
Once everything is mapped out you’ll work with your payment processor to file all the paperwork through the right channels. The most important priority is beating their deadline because missing it means that you’ll have more problems that nobody wants.
Many merchants forget an important detail about the program timeline. Visa caps your participation at 12 months and after that they can pull your card-acceptance privileges altogether. Because of this time constraint the monthly fraud reports are important.
To exit the program successfully you need 3 straight months below the fraud thresholds – no exceptions. One strong month followed by a weak one resets your progress in full – this consistency requirement makes the process challenging.
Status notifications usually arrive by the 15th of each month and they cover the previous month’s fraud activity – this reporting delay creates a difference between your actual performance and the official word on where you stand with Visa.
Frequently Asked Questions
How long do merchants typically stay in the VFMP?
Most merchants want to know just how long they'll be stuck in the program once they get flagged. The nice part is that you can exit after just 3 straight months below the thresholds. So fixing your fraud problems pretty fast and in a way that actually works could get you out in as little as 3 months.
Let's be honest though - most merchants take anywhere from 4 to 8 months to exit the program completely. Your timeline can swing quite a bit - it's mostly about how fast you can put your action plan in place and whether your new fraud controls actually work like they're supposed to. Some merchants move faster than others obviously. But that's usually because they handle the problem more quickly from day one.
Sitting at the Standard level technically gives you as long as 12 months before Visa decides to end your payment processing abilities altogether. That sounds like quite a bit on paper. But most merchants manage to exit well before that deadline hits.
One issue that doesn't get talked about nearly enough - some merchants land right back in the program after they exit. They manage to fix the immediate problem that got them flagged. But they never completely address the actual problems that caused the fraud spike in the first place. Then a few months later the fraud numbers jump again and they're right back where they started.
Your timeline can also change quite a bit based on what type of business you run. Seasonal fraud patterns make it take quite a bit longer to prove that your controls actually work throughout the entire year. Holiday shopping seasons can be especially tough to manage as you're trying to show steady fraud management.
What are the fines associated with VFMP non-compliance?
These fines can start piling up when you can't get your fraud situation under control fast enough. With the Standard classification, Visa actually gives merchants a bit of breathing room and waits until month 5 before they start hitting you with penalties - then you'll see $25,000 per month. If you still haven't fixed your fraud problem by month 7, the amount jumps to $50,000 per month.
The Excessive classification is a lot worse because the fines start from day 1 - there's no grace period at all. You could wind up paying $10,000 per month right from day 1 and an extra $1.50 for each fraudulent transaction that comes through your system. Also these penalties are completely separate from whatever chargeback fees you're already paying to your processor.
Sadly, there's just no way to negotiate these fines once they start. Visa automatically pulls the money directly through your acquirer - that's it. Some merchants have ended up paying more than $500,000 in total fines just because they couldn't get their fraud rates under control fast enough. The money just flows out month after month until you either solve the problem completely or you shut down your business.
How is the VFMP fraud ratio calculated?
The fraud rate calculation can seem a bit too much for most merchants. Visa takes your fraud chargebacks from this month, divides that number by your total sales transactions from the previous month and then multiplies the result by 100 to show a percentage.
Not every dispute actually counts toward the calculation. That fact confuses merchants. Visa only looks at fraud reason codes from their TC40 data when they run the numbers. If a customer disputes a charge just because they don't find it on their statement, that dispute might not affect your fraud rate at all. That said, if their card was stolen and used without their permission, that dispute will be included in the calculation.
Visa uses last month's sales figures instead of this month's transactions for a reason. Chargebacks take time to work through the system - sometimes a few weeks. A customer reporting fraud could be disputing a purchase that happened quite a while ago. By comparing the most recent fraud reports to previous sales data, Visa can account for this natural processing delay.
Your domestic and international transactions count toward the calculation and it doesn't matter if the shopper bought something in New York or Tokyo - the numbers go into the same formula. Visa does exclude credits and reversals from the math and this helps keep the calculation fair and accurate.
The whole calculation resets at the start of each month, so there's no averaging or rollover effect from what happened earlier. Each month merchants get a completely fresh start.
Can small businesses be enrolled in VFMP?
Fraud monitoring requirements can turn into a business nightmare that keeps you wide awake at night as you worry about what you could be missing. The best part is that once you actually understand how the whole system works everything is much easier to manage. Most businesses put this off until that compliance letter lands in their mail.
Visa's fraud monitoring program makes sense - it protects everyone in the payment chain as it still gives merchants a fair chance to fix their fraud problems. The tiered system works because each level sets targets that are basic and merchants get enough time to make the changes they need. What works pretty well in this setup is that Visa knows most business owners have no interest in cheating anyone - they usually just need a bit of direction and some time to build defenses that actually work.
Fraud monitoring can hit businesses of almost any size though the effect can depend on the resources and systems that they already have in place. The program does set minimum dollar thresholds to give the very smallest shops a pass from automatic enrollment. Still any merchant that works with Visa payments can fall under scrutiny if they meet the fraud rate and dollar volume triggers. A company that reaches just $75,000 in monthly fraud losses with a 0.9% fraud ratio will be placed in Standard monitoring no matter how much total volume it runs. Small merchants face the hardest climb because they usually don't have dedicated fraud teams or advanced detection tools which makes it much harder to put fixes in place fast enough to bring their ratios down.
The bottom line is that the right support and expertise can make or break your work to get through these tough requirements and to build a strong fraud prevention plan.