Mastercard Scam Merchant Monitoring ProgramWhat the New Rules Actually Mean & Why the “5% Rule” Panic is Mostly Misplaced

The Mastercard Scam Merchant Monitoring Program (SMMP) is in Effect. Have Reactions to the New Rules Been Overblown?

Mastercard's Scam Merchant Monitoring Program went into effect on July 24, 2026. If you process card-not-present transactions, this change could affect you. Not hypothetically. Not eventually. I mean right now. Today.

A lot of the discussion I've seen has framed the program as an existential threat to card-not-present merchants broadly, with the “5% rule” for combined refunds and chargebacks being particularly alarming. The concern is understandable. I have had multiple merchants reach out directly, looking for clarity on what these new rules actually mean and whether their businesses are at risk.

Most of what is currently circulating online about SMMP either buries or misunderstands a critical detail. The 5% combined threshold does not apply to all merchants. In fact, most merchants will not be impacted at all.

That is not a small distinction. That is the whole thing, really. So before the panic spreads any further, here is a rundown of the new program rules, who is actually subject to the SMMP, and what the program is designed to accomplish.

What Is the Mastercard Scam Merchant Monitoring Program?

Scam Merchant Monitoring Program

[noun]/skam • mər • CHənt • män • ə • dər • iNG • prō • ɡram/

The Scam Merchant Monitoring Program (SMMP) is Mastercard’s enforcement framework for identifying and terminating merchants engaged in scam activity. When a merchant is flagged under SMMP, their acquirer has 72 hours to investigate. If scam activity is confirmed, then the seller’s processing agreement is terminated immediately with no warnings or remediation period.

The program took full effect on July 24, 2026, though onboarding screening requirements for new merchants have been active since January 2026.

When a merchant is flagged under SMMP, their acquirer has 72 hours to investigate and report findings to Mastercard. If scam activity is confirmed, the outcome is immediate: MID termination and placement on the MATCH list. No fines. No warnings. No remediation window.

This is fundamentally different from Mastercard’s Excessive Chargeback Merchant and Excessive Fraud Merchant programs. Those programs impose fines when you exceed predetermined thresholds and give you time to bring your numbers back into compliance. The process is unpleasant, but you can survive it. SMMP operates on different logic entirely: it is designed for speed, with the explicit goal of catching bad actors before they can disappear.

And I'll be honest — a lot of the anxiety circulating in the market right now conflates SMMP with the monitoring programs merchants already know. They are not the same thing. Preparing for them requires a different way of thinking.

Who is Subject to “The 5% Rule”?

Mastercard SMMP rules apply to new merchants: specifically, those with MIDs that have less than six months of Mastercard processing history.

Here is what the 5% rule actually says. For merchants with less than six months of processing history and at least 500 transactions in a rolling 30-day period, a combined refund and chargeback rate exceeding 5% can trigger an SMMP investigation. Chargebacks plus refunds, measured as a percentage of total transactions, evaluated on a rolling monthly basis.

Mastercard SMMP will only flag merchants with:

If your MID has been processing for more than six months, this threshold does not apply to you. You are still subject to other SMMP triggers, which I’ll cover below. But the 5% rule generating the most fear simply is not relevant to your situation.

That matters enormously for how merchants should interpret the program. A seasonal business with predictable return volume is not facing termination because post-holiday refunds spiked. A subscription merchant with normal churn patterns is not staring down an existential threat. The rule is narrower than the panic suggests.

Why Did Mastercard Implement SMMP Rules?

To understand why Mastercard designed the program this way, you have to understand the problem they're trying to solve.

Scam merchants do not behave like legitimate businesses. They spin up a MID, process as much volume as they can, accumulate disputes, and disappear. By the time chargeback ratios spike high enough to trigger traditional monitoring programs, the scammer is already gone. The money is gone, too.

SMMP addresses this by looking at earlier signals. The six-month window exists because scam operations rarely stick around that long. A merchant who has been processing legitimately for six months is statistically much less likely to be running a scam. That is the logic: use the behavior patterns of bad actors to identify them before the damage compounds.

This is also why the threshold is set at 5%, which sounds alarmingly low until you understand the context. For a brand-new MID with no processing history, a 5% combined refund and chargeback rate is a meaningful signal. For an established business with years of history, documented seasonal patterns, and real customer relationships, the same number tells a completely different story. Which is precisely why the threshold does not apply to them.

SMMP Trigger Events Explained

The program can be triggered in four distinct ways. Each one is worth understanding on its own terms.

Scenario #1  |  Authorization Rate Collapse

If your approval rate drops by 50 or more percentage points within a 72-hour window, or falls below 30% while processing at least 25 transactions, that qualifies as a trigger. The pattern can indicate a compromised account, a processing problem, or fraudulent activity. It does not have to mean fraud — a bad campaign, a routing issue, or an aggressive retry strategy can all produce the same signal. But from Mastercard’s vantage point, it looks like fraud. That is enough to initiate an investigation.

Scenario #2  |  GRIP Letter

“GRIP” stands for “Global Rules Investigation Program.” Receiving one of these notifications means Mastercard has already flagged your account for suspected fraudulent activity at the network level. By the time your acquirer receives a GRIP letter, the investigation clock is already running. These do not appear without reason.

Scenario #3  |  New Merchant Scam Signals

This is where the 5% threshold lives, alongside several other signals specific to new MIDs. For merchants with less than six months of processing history, triggers include: a combined refund and chargeback rate exceeding 5%, two or more issuers filing Fraud Type 56 reports against your MID, or chargeback documentation that explicitly references "scam" or "manipulation."

Fraud Type 56 is Mastercard's classification for first-party misuse (what people in the industry usually call friendly fraud). When two different issuers file this type of report against the same new merchant, it suggests a pattern. Patterns are what SMMP is designed to catch.

Scenario #4  |  Merchant Monitoring Alert

The fourth trigger is an alert from a Mastercard-approved Merchant Monitoring Service Provider. These are third-party providers that scan merchant behavior patterns on an ongoing basis. An alert from one of them can initiate the investigation process directly.

What Happens During the 72-Hour Window

When a trigger fires, your acquirer has 72 hours to investigate and report findings to Mastercard. If they confirm scam activity, termination is immediate. If they clear you, no action is taken.

Prepping for one of these investigations is not about tools or products. It is about communication.

Your acquirer has to be able to explain why you exceeded a threshold or triggered a flag. If they cannot reach you, they cannot defend you. If they do not understand your business model, they cannot contextualize your metrics. A seasonal merchant with predictable post-holiday returns looks very different from a scam operation. But only if your acquirer knows you are a seasonal merchant before the investigation begins.

Here is what that looks like in practice. Transaction records, refund policies, customer communication logs, evidence of legitimate business operations — your acquirer needs access to all of it before a flag is ever raised. When they do, an investigation becomes a conversation grounded in documentation and mutual understanding.

Contrast that with an acquirer who has nothing to offer Mastercard except raw numbers. Without context, those numbers look suspicious. That is not a position you want to be in with a 72-hour clock running.

The flag is not the problem. Being unprepared for the investigation is.

Ensuring You Remain Compliant

I'll be honest — this is not a problem you solve by buying more tools. I recognize the irony of saying that, given that I am a guy that sells chargeback management solutions for a living. But it is true. SMMP preparation is about understanding, measurement, and communication. Those three things will serve you better than any product purchase.

I recommend two distinct courses for new and established MIDs:

Here is the single most important mindset shift this program demands: SMMP treats refunds and chargebacks as a combined metric. Most merchants track these separately. Most chargeback monitoring focuses on disputes alone. Start looking at the combined picture now, even if the 5% threshold does not apply to you. It is a better representation of how card networks are actually thinking about merchant risk.

The role of a chargeback management partner in all of this is to help you understand and prepare. A reliable partner explains regulatory changes, helps you interpret how they apply to your specific situation, and guides your communication strategy with your acquirer. If your current provider is not doing that, they are functioning as a vendor. Not a partner.

The distinction matters more than ever with programs like SMMP. Because the solution here is not a product. It is a relationship.

Next Chapter

How to Avoid Mastercard Monitoring Programs

Read More