Mastercard SAFE Reports: Fraud Data Visibility for 2026

Mastercard SAFE Reports: Everyone in the Payments Chain Can See Your Fraud Data Except You

Here is a scenario that plays out constantly.

Your acquirer calls. They want to talk about your fraud exposure. Maybe they’re proposing a rolling reserve, maybe they’re asking for a remediation plan. Or maybe they’re just “checking in” in a way that doesn’t feel casual at all.

You pull up your dashboard. Your chargeback ratio is fine. Your dispute volume is flat. Nothing in your own reporting suggests a problem worth a phone call.

Both of you are looking at real data. You’re just not looking at the same data. Your acquirer is seeing something you don’t have access to, and it’s called SAFE.

What is a Mastercard SAFE Report?

Mastercard SAFE: SAFE, short for “System to Avoid Fraud Effectively,” is Mastercard’s system of record for cardholder fraud claims. Issuing banks are required to submit every Mastercard transaction they consider fraudulent, regardless whether or not the account was closed and whether or not the transaction was ever formally disputed.

That last part is the piece merchants tend to miss. A SAFE report is not a chargeback; no money moves when a SAFE record is filed. There’s no notification, no response window, and no representment process. It’s a database entry, not a transaction.

A SAFE record gets created when an issuer decides fraud occurred. Nothing else necessarily has to happen. This matters more than it sounds like it should, because believe it or not, plenty of fraud gets reported without ever becoming a chargeback.

When a cardholder disputes a $14 charge, the issuer often just refunds them and eats the loss, because running the full chargeback process costs more than the transaction is worth. You never hear about it, but the SAFE record still gets filed, meaning there’s a record that the fraud incident occurred.

That’s the gap between your chargeback data and your acquirer’s fraud data. You’re counting disputes. They’re counting claims. Those are different numbers, and the second one is always bigger.

Common QuestionIs Mastercard SAFE the same thing as the Fraud & Loss Database?Yes. If you’ve gone looking for SAFE documentation recently and come up short, it’s because SAFE is now the Fraud and Loss Database, or FLD. They are the same system, so if you see a reference to either, you’re reading about the same database.

The name change can be confusing in practice. Mastercard’s own developer documentation says FLD. Your processor’s support articles might say either one. Stripe’s documentation still uses SAFE. Plenty of people in the industry use the old name because it’s the one they learned.

What SAFE Reports Actually Do to Your Business

A single SAFE record is pretty much harmless. Accumulation is where the damage happens, and it arrives through four different channels.

Acquirer Risk Assessment

Acquirers carry financial liability for the merchants they sponsor, so they watch fraud profiles closely. Reserves, rolling holds, repricing, and outright termination all get decided using data you were never sent. By the time you hear about it, the decision usually has momentum behind it and is final.

MATCH Listing

The Member Alert to Control High-Risk Merchants (MATCH) file is maintained by Mastercard, and is basically the industry’s shared blacklist. Landing on it makes finding a new processor extremely difficult for up to five years. A documented fraud problem is a contributing factor in that decision.

Scam Merchant Monitoring

Mastercard’s Scam Merchant Monitoring Program became enforceable in July 2026, and it changed the stakes considerably. If two or more issuers report your transactions as scams through the FLD, your acquirer is required to open an investigation within 72 hours. Acquirers now have to check the database daily for new listings. Merchants under six months old face a lower trigger threshold. Unlike the ratio-based programs, this one doesn’t give you months to correct course.

Issuer Authorization Decisions

Issuers use their own view of your fraud history when deciding whether to approve transactions. This shows up as a quiet drop in approval rates, often concentrated in specific BIN ranges, and it’s easy to misread as a technical problem. Some of what you’re logging as false declines may be issuers acting on information about you.

A Real-World Look at Chargeback Management

Based on a survey of over 400 merchants, the report presents a comprehensive, cross-vertical look at the current state of chargebacks and chargeback management.

Access the FREE Report

What’s Included in a Mastercard SAFE Report?

The record is built for banks, not for merchants, which is part of why it’s rarely shared. A typical entry includes:

The issuing bank that filed the report and the acquiring bank that processed the transaction
Your merchant ID, business name, and location
Your merchant category code
Transaction date and dollar amount
Partial card number
Whether the transaction was card-present or card-not-present
Authorization and address verification responses
Whether a dispute was filed
The date the issuer submitted the record
A fraud type code

All that data is pretty self-explanatory. The last field might need a little bit of context to understand properly, though.

How Fraud Gets Classified on a SAFE Report

The issuer classifies what they believe happened, and that classification travels with the record in the form of a fraud type code.

Fraud type codes and chargeback reason codes sometimes get mixed up, but they’re separate systems doing separate jobs. A reason code tells you why money is being pulled from your account and what evidence might win it back. You can respond to it.

A fraud type code, however, tells Mastercard’s database what category of fraud an issuer believes occurred. You cannot respond to it at all, because you’re not a party to the conversation. Here are the fraud type codes that matter most for card-not-present merchants:

Code	Classification	What it tells you
04	Counterfeit Card Fraud	A cloned or reproduced card was used. Rare online, common in card-present environments.
05	Account Takeover Fraud	Someone got into a legitimate customer’s account. Points at your login security, not your checkout.
06	Card Not Present Fraud	Stolen card details used online. The default classification for most eCommerce fraud, and a signal about your screening controls.
56	Manipulation of Cardholder	The cardholder was scammed into paying you. Sub-types cover purchase, romance, impersonation, investment, and advance fee scams.
57	First-Party Fraud	The cardholder made the purchase and disputed it anyway.

Codes 56 and 57 were both added in late 2024, along with the scam sub-types. Mastercard maintains additional classifications covering lost cards, stolen cards, never-received cards, fraudulent applications, and bust-out schemes.

Did You Know?

Until late 2024, friendly fraud had no formal home in Mastercard’s fraud reporting. A cardholder who bought something, received it, and disputed it anyway got logged the same way as a stolen card. Mastercard now has a way to distinguish between the two.

Is your bank hiding your fraud data from you?

Request a Demo

The Original End-to-End Chargeback Management Platform

Does SAFE Data Count Against Your Mastercard Fraud Ratio?

This is where merchants get tangled up, and the honest answer is that the relationship is indirect.

Mastercard’s Excessive Fraud Merchant program has published thresholds and real fines for merchants with too many fraud disputes. Inclusion in the program is not based on SAFE report data, though. Instead, inclusion is calculated based on fraud chargebacks, specifically those filed with reason code 4837 (No Cardholder Authorization). These get divided by the prior month’s eCommerce transaction count. You can learn about the details of the Mastercard EFM program here.

It’s worth noting that Visa handles this differently. Their Acquirer Monitoring Program counts TC40 fraud reports directly in the ratio, so TC40 data carries weight on the Visa side that SAFE data doesn’t carry in quite the same way on the Mastercard side. If you’re tracking both networks, don’t assume the mechanics match.

How to Get Your Mastercard SAFE Data

There is no merchant portal, and there is no login. In other words: your options are narrower than you’d like.

SAFE data might be helpful if you’re trying to pinpoint common dispute sources or other patterns, but can’t discern anything based on chargeback data alone. If you feel that you need access to your SAFE data, you can try the following:

Check if Your Platform Already Gives You Access

You may already have partial access under a name you didn’t recognize. Stripe provides this as Early Fraud Warnings, which it sources from Visa TC40 and Mastercard SAFE reports. Adyen calls them Notifications of Fraud. Other processors use their own labels.

If you’ve been dismissing these as platform noise, you’ve been dismissing network fraud data.

Ask Your Acquirer

Acquirers receive this data and are not obligated to pass it along. Many will do so voluntarily if you ask right, though.

What I mean is not asking for “our SAFE data.” Request fraud notification records for your merchant IDs, with fraud type codes included, delivered on a recurring schedule. It might also help if you explain that you want the data to try and pinpoint patterns and reduce fraud incidents, which your acquirer should appreciate. The specificity matters, though, because the raw files are enormous and full of internal bank fields, and a vague request often gets a vague answer.

Important!

Issuers report on batch cycles, not in real time. Even if you get access to SAFE data, records can surface weeks or months after the event, sometimes even after the related chargeback has already hit. Build your process around that reality, rather than fighting it.

Everything You Need To Know A Beginner’s Guide to Chargebacks

Chargebacks can wreak havoc on your cash flow and profitability. This FREE paperback book is your guide for preventing chargebacks and, when they happen, fighting them more effectively.

Send Me My Free Paperback Book!

What to Do — & What NOT to Do — With SAFE Data

Like I mentioned before, SAFE data may be able to help you pick up on patterns that can help you optimize fraud prevention when raw chargeback data alone isn’t doing the trick. But, before you dive into the data, there are a couple of points I want to clarify:

Refunding a Flagged Transaction Does Not Remove the Report

This is an expensive — and common — mistake. A full refund can prevent the chargeback, because a fully refunded payment can’t be disputed. It does not retract the fraud record. The claim stays in the database.

So merchants who blanket-refund every flagged transaction end up in the worst of both worlds. They give back revenue on orders that were legitimate, including friendly fraud claims they would have won at representment. Their fraud profile doesn’t improve at all, though.

Refund selectively, on low-value transactions where the economics genuinely favor it. Don’t treat it as a fraud strategy.

Use it for Pattern Detection, not for Individual Cases

The real value here is diagnostic. Map the records back to your order logs and look for concentration.

Is a narrow set of BINs producing most of your reported fraud? Add authentication for those specific ranges instead of adding friction everywhere. Are certain products overrepresented? Tighten controls on those SKUs. Seeing clusters of small approved transactions from a single IP address? That’s card testing, and you probably wouldn’t have caught it otherwise, because issuers usually write those off rather than charging back.

The data is old by the time you get it. That makes it useless for intervention… but it is still very useful for finding holes in your defenses.

SAFE data is a record of what already happened. Prevention alerts through Ethoca and Verifi operate inside the dispute window, which is where actual intervention happens. Two different tools, two different jobs.

Our team can walk you through which combination fits your volume. Click here to learn more about the industry’s most comprehensive alerts coverage.

FAQs

What does SAFE stand for in payments?

SAFE stand for “System to Avoid Fraud Effectively.” It’s Mastercard’s fraud claim reporting system, now formally called the Fraud and Loss Database, or FLD. Both names refer to the same thing.

Is a Stripe Early Fraud Warning the same as a Mastercard SAFE report?

Effectively, yes, for Mastercard transactions. Stripe builds Early Fraud Warnings from issuer fraud reports on the Visa, Mastercard, and JCB networks, which means Mastercard EFWs come from SAFE data.

Can a merchant dispute or remove a SAFE report?

No. Fraud notification records aren’t disputable. You’re not a party to the exchange between the issuer and Mastercard, and there’s no mechanism for challenging an entry. Reducing future volume is the only lever available.

Does a SAFE report always become a chargeback?

No. Issuers frequently write off small-dollar claims rather than pay to process a dispute, and the SAFE record gets filed either way. The reverse happens too: a chargeback can arrive before the corresponding SAFE record is submitted.

How long does it take for a SAFE report to appear?

Anywhere from a few days to roughly two months, depending on the issuer’s reporting cycle. There’s no guaranteed timeline, which is a large part of why the data can’t be used for real-time prevention.

What’s the difference between SAFE and TC40?

They serve the same function on different networks. SAFE is Mastercard’s, TC40 is Visa’s. The meaningful difference is how each feeds its network’s monitoring program: Visa counts TC40 reports directly in the VAMP ratio, while Mastercard’s EFM program is built on fraud chargebacks.