Compliance Assessment Tool
Home › VAMP ratio calculator

Visa VAMP ratio calculator

Work out a merchant's Visa Acquirer Monitoring Program (VAMP) ratio, see whether it crosses Visa's threshold for that month and region, and find out how many fewer fraud reports and disputes would bring it under. ISOs and PayFacs can paste a whole book of merchants and see who is driving the portfolio's number.

Short answer

The Visa Acquirer Monitoring Program (VAMP) is Visa's single program for card-not-present fraud and disputes. A merchant's VAMP ratio is its fraud reports (TC40) plus disputes (TC15), divided by its settled card-not-present transactions, all counted for the same month. Since April 1, 2026, merchants in the US, Canada, Europe and Asia Pacific are identified as Excessive at a VAMP ratio of 1.5% or more with at least 1,500 fraud reports and disputes in the month (Latin America and Caribbean: 1.5%; CEMEA: 2.2%). Acquirers are measured on their whole portfolio, at 0.5% (Above Standard) and 0.7% (Excessive).

Jump to: One merchant · A book of merchants (CSV) · Card testing · Thresholds · Lowering a ratio · Sources

Private by design. The calculator runs entirely in your browser: nothing you type or paste is sent to us or stored, and it sets no cookies. Thresholds checked against Visa and acquirer publications on October 18, 2026.

1. One merchant's VAMP ratio

The month the fraud reports, disputes and sales were counted. Thresholds changed on April 1, 2026.
A count of settled online, phone and mail-order sales (TC05), not dollars.
Issuer fraud reports received in the month.
All disputes received in the month, fraud and non-fraud.

2. A book of merchants (ISOs, PayFacs and acquirers)

Visa measures an acquirer on its whole portfolio, at levels far below the merchant line: Above Standard at 0.50% and Excessive at 0.70%. Every merchant an ISO or PayFac boards counts toward its acquirer's number, so a single bad merchant can move a sponsor bank's ratio. Paste one row per merchant to see each merchant's ratio, worst first, and your book's ratio against the acquirer levels.

Columns: merchant_id, cnp_settled, tc40, tc15, then optional region (US, CA, EU, AP, LAC, CEMEA) and amount_usd. The header row is optional, and you can paste straight from a spreadsheet (tabs work). Ctrl+Enter analyzes.

3. Card testing: the enumeration ratio

VAMP also flags enumeration (card testing): criminals running many card numbers through a checkout to find ones that work. Visa spots enumerated attempts with its own model, so the count comes from your acquirer.[1][4]

Approved and declined.
Approved and declined, as reported by your acquirer.

How the VAMP ratio is calculated

VAMP ratio = (TC40 fraud reports + TC15 disputes) ÷ settled card-not-present transactions (TC05)

  • Counts, not dollars. Each fraud report and each dispute counts as one, and so does each settled sale.[1]
  • Card-not-present only: online, phone and mail-order transactions, domestic and cross-border. In-store transactions are not part of the ratio.[1]
  • Every dispute counts, fraud and non-fraud, whatever the outcome. A transaction with both a fraud report and a dispute counts twice.[4]
  • Left out: disputes resolved through Visa pre-dispute tools such as Rapid Dispute Resolution (RDR), and fraud reports that qualify for Compelling Evidence 3.0. A fraud report on a transaction whose dispute was resolved early still counts.[1]
  • One calendar month. Fraud reports and disputes count in the month Visa receives them, against that month's settled transactions, whenever the original sale took place. Visa reports the result after the month closes.[4]

VAMP thresholds by region and date

Merchants: "Excessive"

Visa identifies a merchant as Excessive when it meets the ratio and the minimum monthly count (and, in CEMEA, the minimum amount).

Visa regionAppliesVAMP ratioMinimum fraud reports + disputes per monthSource
United States, Canada, Europe and Asia PacificJune 1, 2025 to March 31, 20262.20%1,500[1]
United States, Canada, Europe and Asia PacificFrom April 1, 20261.50%1,500[1][4][6]
Latin America and CaribbeanFrom June 1, 20251.50%1,500[1][4]
Central Europe, Middle East and AfricaFrom June 1, 20252.20%150 and at least USD 75,000[1][4]

If a merchant's acquirer is itself Above Standard or Excessive, merchants at 0.50% or more with at least 5 fraud reports and disputes can be assessed fees too.[4][5] Visa's fact sheet says the merchant thresholds above apply when the acquirer is not Above Standard or Excessive.[1]

Acquirers: measured on the whole portfolio

LevelPortfolio VAMP ratioEnforcementSource
Excessive0.70%Fees from October 1, 2025[1][5]
Above Standard0.50%Fees from January 1, 2026[1][5]
Early warning0.40%Notice only, no fees[3][5]

Both identification levels use the same minimum monthly count as merchants: 1,500 fraud reports and disputes (150 and USD 75,000 in CEMEA).[1] The 0.40% early-warning notice comes from acquirer publications; Visa confirms it warns acquirers nearing a level but does not publish the number. Because an acquirer's levels are a fraction of the merchant line, acquirers and sponsor banks commonly set their own merchant triggers well below 1.50% and pass monitoring, and fees, down to the ISOs and PayFacs that boarded the merchants.

Enumeration (card testing)

Excessive when both apply in the month: an enumeration ratio of 20.00% or more (enumerated authorization attempts ÷ all authorization attempts, approved and declined) and at least 300,000 enumerated attempts.[1][4]

Key dates

  • April 1, 2025: VAMP replaces Visa's separate fraud and dispute monitoring programs.[2]
  • June 1, 2025: the current ratio method and thresholds take effect.[1]
  • September 30, 2025: the advisory period ends; Excessive-level fees apply from October 1, 2025.[1][5]
  • January 1, 2026: fees at the acquirer Above Standard level begin.[5]
  • April 1, 2026: the merchant Excessive threshold drops from 2.20% to 1.50% in the US, Canada, Europe and Asia Pacific.[1][6]

Fees

Fees apply; ask your acquirer. Visa does not publish VAMP fee amounts in its public fact sheet, and acquirers pass fees on under their own agreements. As one published example, PayPal's Fall 2025 release guide lists US$8 per fraud report or dispute for Excessive merchants and acquirers and US$4 at the acquirer Above Standard level, and both PayPal and Stripe say Visa does not currently charge fees for enumeration.[4][5] Identified merchants and acquirers must also put risk controls in place.[1]

How to lower a VAMP ratio

The only durable fix is fewer fraud reports and disputes. Start by splitting the count: fraud reports (TC40) point to stolen cards and card testing; non-fraud disputes point to billing, delivery and cancellation problems. The fixes are different.

  1. Stop fraud before it settles. Use address and security-code checks, velocity limits and a fraud-screening tool, and send risky orders through 3-D Secure, which moves liability for fraud disputes to the issuer (issuers can still file a fraud report). Reviewing risky orders between authorization and capture helps too: issuers report fraud on captured payments, so an authorization you reverse before capture is not reported.[4]
  2. Act on fraud reports the same day. When a fraud report or early fraud warning arrives, refund and stop fulfillment. The fraud report still counts, but a refund usually prevents a dispute on the same transaction, which would count again.
  3. Resolve disputes before they are raised. Disputes resolved through Visa pre-dispute tools such as RDR are left out of the ratio, and so are fraud reports that qualify for Compelling Evidence 3.0 (evidence that the same customer made earlier, undisputed purchases). Ask your acquirer or gateway which you can use.[1]
  4. Remove the reasons for non-fraud disputes. A statement descriptor customers recognize, clear prices and terms, easy cancellation, reminders before subscription renewals, prompt shipping updates and a simple refund path.
  5. Shut down card testing. Rate-limit checkout and card-update pages, add bot protection, cap attempts per card, device and IP address, and watch for bursts of small or declined authorizations. Attempts blocked before authorization never reach the enumeration ratio, and the cards they would have validated never turn into fraud reports.
  6. Watch it during the month, not after. Visa's figure arrives after the month closes. Track fraud reports, disputes and settled sales weekly from your own or your processor's data so you can act while the month is still open.
  7. For ISOs and PayFacs: manage the few that drive the many. A small number of merchants often account for most of a book's fraud and disputes. Agree an internal trigger with your sponsor bank well below Visa's merchant line, and what happens when a merchant crosses it.

Don't try to dilute the ratio. Splitting sales or adding transactions to raise the settled count breaks card-network rules and acquirer agreements, and acquirers look for it.

How VAMP relates to PCI DSS

PCI DSS and VAMP are separate obligations that reach merchants through the same acquirer. PCI DSS, set by the PCI Security Standards Council and enforced by the card brands, is about protecting card data. VAMP measures the fraud and disputes that follow when card data is stolen or a checkout is abused. They meet at the card-not-present checkout: card numbers stolen in a breach, including by skimming code injected into a payment page, turn up later as card-not-present fraud, and card testing goes after weakly protected checkouts. PCI DSS v4.0.1 includes requirements aimed at those payment-page attacks. A sponsor bank reviewing an ISO or PayFac will usually ask about both: how you monitor fraud and disputes, and how every merchant you board validates PCI DSS compliance. If you are building that program, see what a merchant PCI program needs from merchant #1.

Fraud monitoring is half of a sponsor bank's merchant review. PCI is the other half.

Compliance Assessment Tool gets every merchant in your book through PCI DSS validation under your brand: the right SAQ for each payment method, plain-English questions, and the official signed SAQ and AoC. Free sandbox credentials as soon as you verify your email.

Get a free sandbox →

Common questions

What is the Visa VAMP ratio?

The VAMP ratio is the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled card-not-present transactions (TC05) in the same month. It counts transactions, not dollars. Every dispute counts, fraud and non-fraud, whatever the outcome, and a transaction with both a fraud report and a dispute counts twice. Disputes resolved through Visa pre-dispute tools such as Rapid Dispute Resolution, and fraud reports that qualify for Compelling Evidence 3.0, are left out.

What is the VAMP threshold for merchants in 2026?

From April 1, 2026, a merchant in the US, Canada, Europe or Asia Pacific is identified as Excessive when its VAMP ratio is 1.5% or more and it has at least 1,500 fraud reports and disputes in the month. Before that date the ratio threshold in those regions was 2.2%. Latin America and the Caribbean uses 1.5% with the same 1,500 minimum. CEMEA uses 2.2% with at least 150 fraud reports and disputes and USD 75,000. A merchant under the minimums is not identified by Visa, but its acquirer still sees the ratio.

What are the VAMP thresholds for acquirers?

Visa measures each acquirer on its whole portfolio. A portfolio is Above Standard at a VAMP ratio of 0.5% and Excessive at 0.7%, with the same minimum monthly counts as merchants. Acquirers also report an early-warning notice at 0.4%. When an acquirer is Above Standard or Excessive, its merchants at 0.5% or more with at least 5 fraud reports and disputes can be assessed fees too, which is why acquirers and sponsor banks watch merchants well below the merchant Excessive line.

Do refunds or winning a dispute lower the VAMP ratio?

No. A dispute counts when it is raised, whatever the outcome, and an issuer files a fraud report even if the payment has been refunded. What helps is stopping the dispute before it is raised: disputes resolved through a Visa pre-dispute tool such as Rapid Dispute Resolution are left out of the count, and refunding as soon as a fraud report arrives usually prevents a dispute on the same transaction, which would otherwise count a second time.

Does in-store (card-present) fraud count toward VAMP?

No. The VAMP ratio counts fraud reports, disputes and settled transactions on card-not-present transactions only: online, phone and mail orders, domestic and cross-border. A merchant that only takes cards in person has no VAMP ratio, although its acquirer still monitors its fraud and disputes.

What is the VAMP enumeration ratio?

Enumeration is card testing: criminals running many card numbers through a checkout to find ones that work. Visa's enumeration ratio is enumerated authorization attempts divided by all authorization attempts, approved and declined. A merchant or acquirer is Excessive at 20% or more with at least 300,000 enumerated attempts in the month. Visa flags enumerated attempts with its own model, so the count comes from your acquirer. Stripe and PayPal say Visa does not currently charge fees for enumeration, but an identified entity still has to put controls in place.

Are there fees for exceeding VAMP thresholds?

Yes, but Visa does not publish the amounts in its public fact sheet, and acquirers pass fees on under their own agreements, so ask your acquirer. As one published example, PayPal's Fall 2025 release guide lists US$8 per fraud report or dispute for Excessive merchants and acquirers, and US$4 at the acquirer Above Standard level.

Sources

Every threshold on this page and in the calculator was checked against these sources on October 18, 2026. The calculation code is open source: vamp-ratio on GitHub (MIT).

  1. Visa, Visa Acquirer Monitoring Program Overview (fact sheet, 2025 v2), May 14, 2025. Checked October 18, 2026. Formula, exclusions, merchant and acquirer thresholds, minimum counts, the 1 April 2026 reduction, enumeration criteria, advisory period.
  2. Visa, Introducing the Visa Acquirer Monitoring Program, August 30, 2024. Checked October 18, 2026. Program consolidation and the advisory period (1 April to 30 September 2025).
  3. Visa, Evolving the Visa Acquirer Monitoring Program, October 9, 2025. Checked October 18, 2026. Early-warning notices before identification; only the Excessive level enforced first.
  4. Stripe, Dispute and fraud card monitoring programs. Checked October 18, 2026. Current thresholds by region (LAC at 1.5%), TC40 + TC15 double counting, the 0.5% / 5 level, enumeration needing both criteria, no enumeration fines.
  5. PayPal, Fall 2025 Release Guide (VAMP section). Checked October 18, 2026. Acquirer early warning at 0.40%, enforcement dates, per-count fee amounts, the merchant 0.50% / 5 level when the acquirer is identified.
  6. Merchant Risk Council (member news by Chargeback Gurus), Stricter VAMP Ratio Thresholds Are Now in Effect, April 1, 2026. Checked October 18, 2026. Confirms the 1.5% merchant threshold took effect on 1 April 2026.

Where sources disagree, this page follows Visa's fact sheet. Some processors describe the VAMP denominator as all captured payments, and PayPal describes the enumeration denominator as settled transactions; Visa's fact sheet uses settled card-not-present transactions and all authorization attempts. Guides written before May 2025 quote figures Visa later revised: a 1,000 minimum count, 2026 levels of 0.9% for merchants and 0.3% / 0.5% for acquirers, and US$5 / US$10 fees.

Thresholds change. This calculator and page are general information drawn from the public sources listed, not legal advice, and are not a Visa product. Your acquirer's figures, not this estimate, are what count: confirm current VAMP rules, thresholds and fees with your acquirer. Compliance Assessment Tool is not affiliated with Visa. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment; it is not a Qualified Security Assessor and does not certify compliance. Third-party names are trademarks of their owners.