News

a blue visa card on a dark colored surface

Visa Fraud Monitoring Program

By Chris Alarie on Sep 08, 2022

Fraud is costly to merchants. According to LexisNexis, overall U.S. retail fraud attacks have decreased slightly since 2021, but ecommerce fraud attacks have increased 50% in 2022, with successful attacks increasing 63%. Additionally, every dollar of fraud costs U.S. merchants $3.75 due to all the additional costs, fees, and losses associated with fraud. Numerous factors contribute to those increased fraud costs beyond the amount of lost payments. One such factor is the costs assessed by card brands to merchants that routinely have fraud ratios above what the brands determine to be acceptable. Card brands will place these merchants in monitoring programs such as the Visa Fraud Monitoring Program (VFMP).

Visa Fraud Monitoring Program

The VFMP is a program that Visa uses to discourage merchants from allowing their fraud ratios and the total fraud volume to regularly exceed predetermined thresholds. Merchants who have been placed in the VFMP may be subject to additional fees related to their transactions. Some merchants in the VFMP may be subject to fines. They also may be automatically assigned liability in payment disputes related to fraud. Merchants who find themselves in the VFMP for an extended period of time may be barred from processing Visa transactions entirely.

Visa also has a specific fraud monitoring program for merchants who use 3D-Secure identity verification technology. This VFMP-3DS variant has its own thresholds. Fraud ratio and fraud volume are only counted from fraudulent transactions that used 3D-Secure.

Fraud Ratio and Fraud Volume

Fraud ratio is one of the key metrics in decisions relating to the VFMP. Visa calculates a merchant’s fraud ratio by dividing the amount of TC40 fraud alerts received in a given month by the amount of sales from that same month. It is similar in both construction and use to the chargeback ratio metric, albeit with different inputs.

Fraud volume is the other important metric. It is the total dollar amount of all fraudulent Visa payments within a given month.

Fraud Thresholds

There are three different levels within the VFMP: early warning, standard, and excessive. VFMP-3DS only has the early warning and standard levels. The thresholds for being entered into those levels are as follows:

Level

Fraud Ratio

Fraud Volume

VFMP Early Warning

0.65%

$50,000

VFMP Standard

0.9%

$75,000

VFMP Excessive

1.8%

$250,000

VFMP-3DS Early Warning

0.5%

$5,000

VFMP-3DS Standard

0.65%

$7,500

 

VFMP Fines and Penalties

There are no fines for the early warning level. For the standard and excessive there are escalating non-compliance fines. These fines take effect immediately at the excessive level and after four months in the VFMP at the standard level. The fines and penalties are also different depending on the VFMP level. Fines follow this schedule:

Months in VFMP

Standard Fine

Excessive Fine

1

$0

$10,000

2

$0

$10,000

3

$0

$10,000

4

$0

$25,000

5

$25,000

$25,000

6

$25,000

$25,000

7

$50,000

$50,000

8

$50,000

$50,000

9

$50,000

$50,000

10+

$75,000

$75,000

There are no fines at either level of the VFMP-3DS but merchants in the standard level of that program lose the liability shift on domestic 3DS transactions.

Merchants in the standard and excessive levels of the VFMP may also receive chargebacks with a fraud reason code 10.5, which has limited opportunities for representment. 10.5 chargebacks are also the result of a dispute initiated by the issuer rather than the cardholder. This penalty takes effect after four months at the standard level and immediately at the excessive level.

After 12 months in either the standard or excessive levels of the VFMP, merchants may have their right to process Visa payments revoked entirely.

Exiting the Fraud Monitoring Program

Once in the VFMP, merchants can get out of it if they manage to stay below a 0.9% fraud ratio for three consecutive months. Visa may also require merchants to explain what fraud prevention tools they use and submit a fraud remediation plan. This plan should include a description of the merchant’s business, an explanation of how their fraud rate increased, and an explanation of all efforts being taken to reduce fraud.

Conclusion

As with most responsible merchant business practices, the most effective way to handle the Visa Fraud Monitoring Program is to avoid being placed in it in the first place. This likely involves employing anti-fraud tools—such as 3D-Secure, machine learning tools, real-time fraud scoring, velocity monitoring tools, device ID, and IP geolocation—and implementing policies to catch fraud before it occurs.

Frequently Asked Questions

The Visa Fraud Monitoring Program is a program of penalties and restrictions that Visa uses to discourage merchants from allowing their fraud rates and volumes to exceed certain thresholds.

Merchants get put in the Visa Fraud Monitoring Program if their fraud ratio exceeds 0.9% and their fraud volume exceeds $75,000. There is an even more punitive excessive level for merchants with a fraud ratio in excess of 1.8% and fraud volume in excess of $250,000.

Merchants are removed from the Visa Fraud Monitoring Program if they keep their fraud ratio below 0.9% for three consecutive months.

They are different programs designed to address different problems. The Visa Fraud Monitoring Program discourages merchants from allowing too much fraud while the Visa Chargeback Monitoring Program discourages merchants from allowing too many chargebacks, regardless of their source. The basic structure of the programs are superficially similar but the details are tailored to each specific concern.

Fraud ratio is a metric that Visa calculates in order to determine if merchants have exceeded acceptable fraud rates.

Visa calculates a merchant’s fraud ratio by dividing the amount of TC40 fraud alerts received in a given month by the amount of sales from that same month.