Mastercard's Chargeback Rules Tighten From April 2027

Earlier this month I wrote about Visa’s VAMP ratio from the merchant side. The Mastercard half of that story is less discussed and, from 1 April 2027, a bigger change. Mastercard is replacing its Acquirer Chargeback Monitoring Program with a new framework, the Global Merchant Audit Program (GMAP), and lowering its main merchant chargeback line in steps until it reaches 0.9% in 2031.

A caveat on sourcing first. The rules come from a Mastercard bulletin, GLB 14127.1, dated 28 July 2026 according to the write-ups by Slyce360 and Chargebackhelp, and distributed through Mastercard Connect, which isn’t public. I haven’t read it. What follows comes from acquirers’ own notices, Checkout.com and payabl., and from several dispute-management firms whose summaries agree on the numbers I use. Where they disagree, I say so or leave the detail out. Your acquirer has the bulletin, and it’s the source to check against.

What exists today

Mastercard’s current Acquirer Chargeback Monitoring Program has two parts, as Checkout.com’s documentation describes it: the Excessive Chargeback Program, with two levels, and the Excessive Fraud Merchant program.

An Excessive Chargeback Merchant (ECM) has at least 100 chargebacks in a month and a chargeback ratio of 1.5% or more. A High Excessive Chargeback Merchant (HECM) has at least 300 chargebacks and a ratio of 3% or more. The ratio divides this month’s chargebacks by the number of sales transactions in the previous month. J.P. Morgan’s merchant guide to the program spells all of this out, and the 2026 write-ups give the same thresholds. Visa’s VAMP, per Stripe’s documentation, uses the same month for both.

The Excessive Fraud Merchant (EFM) program has four conditions that must all hold in a month, per Checkout.com: at least 1,000 Mastercard sales, at least USD or EUR 50,000 in fraud chargebacks, a fraud-to-sales ratio of 0.5% or more, and 3DS usage below 10% of clearing volume in countries without a strong-authentication requirement, or below 50% in countries with one. Chargebackstop’s write-up gives the same four conditions.

Two things about this structure matter for what follows. The ECM and HECM floors are counts of chargebacks. And everything is measured at the merchant ID.

What GMAP adds on 1 April 2027

GMAP retires the current program in its present form. ECM, HECM and EFM keep running inside the new framework, and Solidgate says open audits carry over with their counts intact. Checkout.com describes GMAP as modelled on VAMP. It adds two merchant categories and two acquirer categories, and the numerator is new. It combines transactions reported as fraud to Mastercard’s Fraud and Loss Database, whether or not a chargeback followed, with non-fraud chargebacks. Like VAMP’s TC40s, a fraud report with no dispute attached now counts. The denominator stays the previous month’s sales.

The High Dispute Merchant (HDM) category needs three things in a month: at least 5 cleared transactions, at least USD 5,000 in combined fraud and non-fraud chargebacks, and a ratio of 5% or more. The Excessive Dispute Merchant (EDM) category uses the same transaction floor, USD 10,000, and a ratio of 50%. Those figures appear in the Chargeback Gurus, payabl., Chargebacks911, Slyce360 and Chargebackhelp write-ups.

The 50% looks like a typo, but every write-up I read has it, and I read EDM as aimed at merchants that are mostly fraud rather than at legitimate businesses running hot. HDM is the category I’d spend time on, because its floor works differently from anything in the current program.

Let’s imagine a small merchant with 400 Mastercard sales last month. This month it gets 25 fraud reports and chargebacks combined, averaging USD 250 each. That’s a ratio of 6.25% and USD 6,250 in disputed value. Mastercard’s current programs don’t see it, because ECM needs 100 chargebacks before the ratio matters and EFM needs 1,000 sales. Under GMAP it meets all three HDM conditions. The count floor used to shelter small merchants with bad ratios. A USD 5,000 floor shelters far fewer, and high-ticket verticals reach it fast: a merchant selling at USD 500 gets there with ten disputes.

What happens inside HDM is gentler than the entry criteria. Chargeback Gurus and Chargebackhelp describe escalating monthly assessments that only start in the seventh month, and Solidgate says that after two months Mastercard may alert issuers, which can push approval rates down. EDM is harsher. A merchant that stays in EDM past two months (Checkout.com’s notice says more than two; other write-ups say two) becomes liable for fraud chargebacks on its transactions from the three months before identification and the six months after, and Chargeback Gurus and Chargebackhelp say issuers can use reason code 4849 to recover the full amount. Chargeback Gurus and Solidgate say an audit closes only after three consecutive compliant months.

I’m not giving fee amounts. The vendor tables mostly agree, but at least one differs from the others on an acquirer tier, and I’d rather you read the numbers off your acquirer’s schedule than off mine.

On the acquirer side, High Dispute Acquirer is 0.5% and Excessive Dispute Acquirer is 0.7%, each with floors of 1,500 cleared transactions and 1,500 fraud reports and chargebacks in the month. Those are the same two lines Visa set for acquirer portfolios under VAMP. In the VAMP piece I argued that the acquirer’s 0.5% line is where a high-risk merchant’s conversation with its acquirer starts, well before the network’s merchant line. From April 2027 that line exists on both networks, and in my reading acquirers will manage their whole portfolio to it.

The ECM line moves down every January

The second change is to ECM itself. The 100-chargeback floor and the 2.99% upper end of the band stay. The lower edge stays at 1.5% through 2027 and 2028, then drops to 1.3% in January 2029, 1.1% in 2030 and 0.9% in 2031. Chargeback Gurus, payabl., Slyce360 and Chargebackhelp all give the same schedule. HECM at 3% and 300 chargebacks isn’t revised, per Chargebackhelp and Slyce360.

As an illustration, take a merchant with 9,000 sales last month and 110 chargebacks this month. That’s about 1.22%. It sits outside ECM today, stays outside in 2029, and is inside from 2030 without changing anything about how it operates. Five years sounds like a long runway. A processing agreement signed in 2027 with a three-year term ends in a different regime from the one it started in.

Sub-merchant monitoring

From 1 April 2027, payabl., Chargebacks911, Slyce360 and Chargebackhelp say ECM, HECM and EFM will be measured at the sub-merchant ID wherever one is populated in the clearing data, not only at the merchant ID. Checkout.com’s notice says the same about GMAP generally.

For a merchant selling through a payment facilitator or marketplace, this means Mastercard sees its own record rather than the facilitator’s blended one. For the facilitator, it means one bad seller can no longer sit inside a healthy aggregate. I think this is the right rule, and it points the same way as the FTC’s orders against Nuvei and Humboldt, which prohibit those two companies from using tactics to avoid card-network monitoring programs, load balancing included. I wrote about that in what “should have known” means for a processor. In both cases the merchant’s own numbers are the ones that count.

What I’d watch

I’d start calculating the GMAP numerator now, before April: fraud reports and non-fraud chargebacks together, against the previous month’s sales count, plus the combined dollar amount, per merchant ID and per sub-merchant ID. I’d expect most merchant dashboards to track chargebacks only, and fraud reports that never became disputes don’t show up there.

I’d also pay attention to the previous-month denominator, because it punishes shrinking volume. Chargebacks arrive weeks after the sales they belong to. If a merchant’s volume halves, say because a processing line closes or a season ends, the chargebacks from the busier months land against the smaller month, and the ratio jumps without anything changing in the product. That’s my arithmetic rather than anything Mastercard states, but it describes the months when a high-risk merchant tends to have the least room.

None of this should push anyone toward chasing approvals by loosening fraud controls, which is the trap I described in why approval rate is a dangerous KPI. Under GMAP the fraud that gets through counts in the ratio whether or not anyone disputes it.

Where this stops: a merchant with a low dispute rate and steady volume doesn’t need to do much beyond confirming its acquirer’s reporting covers the new numerator. The changes bite hardest for small high-ticket merchants, sellers under a facilitator, and anyone whose 2029 to 2031 ratio would sit between 0.9% and 1.5%. For them, the work starts in the next few months.