Fraud attacks can cause various levels of harm to a business, depending on factors such as the attack's size, duration, and the protective measures the merchant has in place. The most obvious negative effect of a fraudulent order is the loss of the sale and product, as well as potential damage to the business's reputation. In cases where fraud attacks are frequent and successful, there may be additional consequences, such as fraud monitoring programs implemented by card networks like Visa and Mastercard to protect themselves. These programs encourage merchants to take steps to prevent fraudulent orders. Below is a list of frequently asked questions about Visa's fraud monitoring and dispute programs.
Q: What is the Visa Dispute Monitoring Program?
A: While merchants are never happy about being notified of chargebacks, a merchant who has a high number of chargebacks may find themselves in Visa’s Dispute Monitoring Program (VDMP). A merchant’s inclusion in this program can become very costly and may eventually lead to the termination of the merchant’s ability to accept Visa payments.
Q: How does Visa decide a merchant’s chargebacks are too high?
A: Visa sets a threshold based on the ratio of chargebacks to total transactions. While the VDMP program officially has two levels, Standard and High Risk/Excessive, Visa also has an early warning system to alert merchants that they are in danger of reaching the chargeback automation threshold may be placed in the monitoring program. One note: A merchant might not receive an early warning notification if their dispute rate immediately puts them at the Standard or Excessive levels of the program. Visa calculates dispute rates at the end of each month to determine if a merchant falls into one of the following three categories:
Early Warning Threshold: At least 75 total disputes and a dispute ratio of .65%
Standard Threshold: At least 100 total disputes and a dispute ratio of .9%
High Risk/Excessive: At least 1,000 total disputes and a dispute ratio of 1.8%
Q: What consequences does a merchant face if they’ve been put in the VDMP?
A: It depends on what level of the program a merchant has been placed.
Early Warning Notification: No fines are levied. The early warning level is meant to allow merchants to correct issues that might be causing a high rate of chargebacks to help them avoid being officially placed in the VDMP.
Standard Level: Merchants are given four months to correct the issue before any fines are levied. After the fourth month, merchants will be charged $50 per dispute. After the ninth month, the merchant will still be charged $50 per dispute, but they might also be charged a $25,000 review fee (does not apply in EU) and they might be required to undergo an audit. After 12-plus months, all previously mentioned fees still apply and Visa might revoke a merchant’s ability to accept Visa payments.
High Risk/Excessive Level: The same fees for the same amounts as the standard level are levied, however, a merchant considered to have an excessive number of chargebacks does not get the same four-month period to correct the issue. The fees will start immediately at month one for merchants unfortunate enough to have found themselves at this level of the program.
Q: How does a merchant get out of the program?
A: In order to get out of the VDMP, a merchant will need to stay below the standard level threshold of .9% for three consecutive months. The key word here is consecutive: If a merchant goes two months below the threshold and in the third month goes above the threshold the three months start over again.
Q: If the VDMP already deals with merchant chargebacks, then what is the Visa Fraud Monitoring Program?
A: Visa Fraud Monitoring Program (VFMP), while similar to the VDMP, is a separate Visa program that specifically looks at handling chargebacks related to fraud.
Q: So how does Visa determine what is fraud related?
A: They do this by analyzing something called TC40 data. TC40 is the name of the report that issuers send to Visa when they believe charges are fraudulent.
Q: How does Visa determine the thresholds for fraud-related chargebacks under the VFMP?
A: It’s actually very similar to the VDMP. However, rather than calculating the chargeback to total transaction count ratio, the calculation is based on the total dollar amount of fraud-related chargebacks to the total dollar amount of legitimate transactions. There is also a minimum threshold of fraud related chargebacks, but it is also based on dollar amount and not a simple count of chargebacks. Visa also calculates fraud rates at the end of each month to determine if a merchant falls into one of the following three categories:
Early Warning Threshold: Fraud rate of .65% and at least $50,000 in fraud related chargebacks.
Standard Threshold: Fraud rate of .9% with at least $75,000 in fraud related chargebacks.
High Risk/Excessive: Fraud rate of 1.8% with at least $250,000 in total fraud related chargebacks.
Q: What consequences does a merchant face if they are placed in the VFMP?
A: Much like the VDMP, the potential consequences will be based on the level of the program the merchant falls under.
Early Warning Level: No fines are levied. Like with VDMP, this level is only to warn merchants and give them a chance to bring their fraud rates down to prevent them from having to be officially placed in the program.
Standard Level: Same as VDMP, there are no fines levied for the first four months. Then in months five and six, Visa can assess fines of $25,000. In months seven through nine, the fine amount is increased to $50,000 and at ten-plus months the fine is increased again to $75,000.
High Risk/Excessive: There is no four-month grace period granted, and fines start at the first month. In months one through three, Visa can assess a fine of $10,000. That amount increases to $25,000 for months four through six, then $50,000 for months seven through nine and finally $75,000 for months 10 and beyond.
Q: How does a merchant get themselves out of the VFMP?
A: Like the VDMP the merchant must stay below the standard threshold rate of .9% for three consecutive months. For VFMP Visa may also require the merchant to submit documentation outlining steps taken to remediate their fraud issues.
Q: What is the Visa Fraud Monitoring Program – 3DS?
A: The VFMP-3DS program only applies to merchants in the U.S. who use 3-D Secure. Visa bases their inclusion of a merchant in this program on two factors: the total dollar amount of domestic 3DS payments that are found to be fraudulent (fraud volume) and the ratio of fraudulent payments to the total 3-D Secure domestic payments (fraud rate). If a merchant has a fraud volume over $5,000 and a fraud rate of over .5%, they receive an early warning notification. As with the other programs previously mentioned, there is no penalty for the early warning. It’s meant to help the merchant avoid being officially placed in the program.
If the merchant exceeds a fraud volume of $7,500 at a fraud rate of .75% or above, then they are placed in the standard VFMP-3DS program. While there are no fines levied as part of this program, merchants will lose the liability shift for payments using 3ds payment as long as they remain in the program.
Obviously, this alphabet soup of Visa programs — VDMP, VFMP and VFMP-3DS — is unpleasant and potentially costly. But it is also unnecessary. Online fraud will always be with us, but with robust fraud merchant protection from chargeback, it doesn’t have to be detrimental to your business.
Comments