News
Visa Fraud Monitoring Program
Fraud is costly to merchants. According to LexisNexis, overall U.S. retail fraud attacks have decreased slightly since 2021, but ecommerce fraud attacks have increased 50% in 2022, with successful attacks increasing 63%. Additionally, every dollar of fraud costs U.S. merchants $3.75 due to all the additional costs, fees, and losses associated with fraud. Numerous factors contribute to those increased fraud costs beyond the amount of lost payments. One such factor is the costs assessed by card brands to merchants that routinely have fraud ratios above what the brands determine to be acceptable. Card brands will place these merchants in monitoring programs such as the Visa Fraud Monitoring Program (VFMP).
Visa Fraud Monitoring Program
The VFMP is a program that Visa uses to discourage merchants from allowing their fraud ratios and the total fraud volume to regularly exceed predetermined thresholds. Merchants who have been placed in the VFMP may be subject to additional fees related to their transactions. Some merchants in the VFMP may be subject to fines. They also may be automatically assigned liability in payment disputes related to fraud. Merchants who find themselves in the VFMP for an extended period of time may be barred from processing Visa transactions entirely.
Visa also has a specific fraud monitoring program for merchants who use 3D-Secure identity verification technology. This VFMP-3DS variant has its own thresholds. Fraud ratio and fraud volume are only counted from fraudulent transactions that used 3D-Secure.
Fraud Ratio and Fraud Volume
Fraud ratio is one of the key metrics in decisions relating to the VFMP. Visa calculates a merchant’s fraud ratio by dividing the amount of TC40 fraud alerts received in a given month by the amount of sales from that same month. It is similar in both construction and use to the chargeback ratio metric, albeit with different inputs.
Fraud volume is the other important metric. It is the total dollar amount of all fraudulent Visa payments within a given month.
Fraud Thresholds
There are three different levels within the VFMP: early warning, standard, and excessive. VFMP-3DS only has the early warning and standard levels. The thresholds for being entered into those levels are as follows:
|
Level |
Fraud Ratio |
Fraud Volume |
|
VFMP Early Warning |
0.65% |
$50,000 |
|
VFMP Standard |
0.9% |
$75,000 |
|
VFMP Excessive |
1.8% |
$250,000 |
|
VFMP-3DS Early Warning |
0.5% |
$5,000 |
|
VFMP-3DS Standard |
0.65% |
$7,500 |
VFMP Fines and Penalties
There are no fines for the early warning level. For the standard and excessive there are escalating non-compliance fines. These fines take effect immediately at the excessive level and after four months in the VFMP at the standard level. The fines and penalties are also different depending on the VFMP level. Fines follow this schedule:
|
Months in VFMP |
Standard Fine |
Excessive Fine |
|
1 |
$0 |
$10,000 |
|
2 |
$0 |
$10,000 |
|
3 |
$0 |
$10,000 |
|
4 |
$0 |
$25,000 |
|
5 |
$25,000 |
$25,000 |
|
6 |
$25,000 |
$25,000 |
|
7 |
$50,000 |
$50,000 |
|
8 |
$50,000 |
$50,000 |
|
9 |
$50,000 |
$50,000 |
|
10+ |
$75,000 |
$75,000 |
There are no fines at either level of the VFMP-3DS but merchants in the standard level of that program lose the liability shift on domestic 3DS transactions.
Merchants in the standard and excessive levels of the VFMP may also receive chargebacks with a fraud reason code 10.5, which has limited opportunities for representment. 10.5 chargebacks are also the result of a dispute initiated by the issuer rather than the cardholder. This penalty takes effect after four months at the standard level and immediately at the excessive level.
After 12 months in either the standard or excessive levels of the VFMP, merchants may have their right to process Visa payments revoked entirely.
Exiting the Fraud Monitoring Program
Once in the VFMP, merchants can get out of it if they manage to stay below a 0.9% fraud ratio for three consecutive months. Visa may also require merchants to explain what fraud prevention tools they use and submit a fraud remediation plan. This plan should include a description of the merchant’s business, an explanation of how their fraud rate increased, and an explanation of all efforts being taken to reduce fraud.
Conclusion
As with most responsible merchant business practices, the most effective way to handle the Visa Fraud Monitoring Program is to avoid being placed in it in the first place. This likely involves employing anti-fraud tools—such as 3D-Secure, machine learning tools, real-time fraud scoring, velocity monitoring tools, device ID, and IP geolocation—and implementing policies to catch fraud before it occurs.
Of course, it can be difficult for merchants to prevent fraud if they are not aware of what their fraud ratio is. TC40 fraud reports are not always forwarded to the merchant in such a way as to allow them to track their fraud ratio. Tools such as chargeback dashboards can assist with tracking this metric and serve as a starting point for fraud-prevention efforts.
Frequently Asked Questions
The Visa Fraud Monitoring Program is a program of penalties and restrictions that Visa uses to discourage merchants from allowing their fraud rates and volumes to exceed certain thresholds.
Merchants get put in the Visa Fraud Monitoring Program if their fraud ratio exceeds 0.9% and their fraud volume exceeds $75,000. There is an even more punitive excessive level for merchants with a fraud ratio in excess of 1.8% and fraud volume in excess of $250,000.
Merchants are removed from the Visa Fraud Monitoring Program if they keep their fraud ratio below 0.9% for three consecutive months.
They are different programs designed to address different problems. The Visa Fraud Monitoring Program discourages merchants from allowing too much fraud while the Visa Chargeback Monitoring Program discourages merchants from allowing too many chargebacks, regardless of their source. The basic structure of the programs are superficially similar but the details are tailored to each specific concern.
Fraud ratio is a metric that Visa calculates in order to determine if merchants have exceeded acceptable fraud rates.
Visa calculates a merchant’s fraud ratio by dividing the amount of TC40 fraud alerts received in a given month by the amount of sales from that same month.
