Merchant Fraud Monitoring: Four Rules You May Miss

Merchant fraud monitoring is the set of Visa rules that sit behind the programs everyone talks about. VAMP gets the attention, but section 10.4 of the Visa Core Rules and Visa Product and Service Rules (18 April 2026) contains four obligations that apply to ordinary card-absent merchants and that almost nobody has implemented.

One of them is a hard numeric cap. Start there.

You Need a Daily Transaction Limit, and It Cannot Exceed 25#

Section 10.4.4.2 (ID# 0030641) says:

"An Acquirer must ensure that its Card-Absent Environment Merchant sets daily limits after which the Merchant must perform additional verification to confirm that the Cardholder approves continued spend. These limits must be appropriate for the Merchant business but must not exceed 25 Transactions in one day."

Two things follow. You're required to have a daily limit at all, and whatever you set, the ceiling is 25 transactions in a day. Past that point you must do additional verification that the cardholder actually approves continued spend.

Most card-absent merchants have velocity rules of some kind, but they're usually tuned for fraud scoring rather than set as a hard verification gate. That isn't the same thing. The rule requires a threshold beyond which you stop and confirm, not a score that nudges a risk decision.

If you sell anything where a single customer legitimately transacts many times a day, this is worth designing deliberately rather than discovering during a portfolio review.

After a Fraud Dispute, You Must Try to Take the Goods Back#

Section 10.4.4.3 requires acquirers to ensure their merchants attempt to revoke provision of goods or services from the cardholder after a category 10 fraud dispute, and to have a process in place to prevent the same cardholder doing it again.

For a digital business this is straightforward and rarely done: cancel the account, revoke the licence, disable the download. For a physical one it may not be possible, but the obligation is to attempt it.

The second half matters more. "A process in place to prevent reoccurrence" means a fraud dispute should change how you treat that customer going forward. If a disputing cardholder can immediately sign up again and repeat the pattern, you don't have that process.

Where the fraud came from an account takeover rather than the cardholder, the rules point at re-securing the account instead.

Falsifying Dispute Evidence Costs You the Remedy#

The Visa Fraud Dispute Monitoring Program watches something specific: merchant data submitted to qualify for dispute protection under Dispute Condition 10.4.

If Visa determines a merchant is falsifying that data to gain protection, two things happen (ID# 0031010). Visa notifies the acquirer, merchant, or service provider of the violation. And the merchant loses the ability to use the 10.4 pre-arbitration remedy for the same payment credential, until the acquirer, merchant, or service provider confirms in writing to Visa that the underlying activities have been corrected.

That's a real consequence attached to the compelling evidence process. The remedy that lets you defeat a friendly fraud dispute is conditional on the data behind it being genuine, and the suspension runs until you fix it and say so in writing.

Force Post Is Watched Closely#

Force post functionality lets a merchant submit a clearing record with a manually entered authorization code. It has legitimate uses and an obvious abuse case.

Where an acquirer enables it, section 10.4.4.1 requires enhanced due diligence on the merchant, validated and documented evidence of a legitimate business case, and risk controls restricting the ability to submit fraudulent transactions into interchange.

The rules define force post fraud plainly: clearing records processed with a fictitious authorization code, or none at all. Acquirers that fail here face non-compliance assessments under the Significant Violations Schedule and may be liable for all costs of reversing the positions created.

If you've asked for force post capability, expect the diligence. If you have it and never use it, it's worth asking whether you still need it enabled.

VAMP Is the Acquirer Program, Not the Merchant One#

Worth clearing up, because the naming misleads.

Section 10.4.3.1 is titled Visa Acquirer Monitoring Program, and it identifies acquirers against criteria in the VAMP Guide. Visa may then require the acquirer or its merchant to deploy remediation tools, and may evaluate at an aggregated merchant level or a sponsored merchant level.

So the program that merchants track their ratio against is formally a program about their acquirer's portfolio, applied downward. That's why a ratio that looks survivable to you can still trigger pressure: your acquirer is managing a portfolio number, not just yours. Our VAMP calculator covers where the merchant-level thresholds sit.

What To Actually Do#

Four checks, in rough order of how likely you are to fail them:

Set an explicit daily transaction limit per cardholder, at or below 25, with a defined verification step beyond it. Write down what the verification is.

Add a revocation step to your fraud dispute handling, and a rule that stops a disputing cardholder simply starting over.

Make sure whoever assembles your dispute evidence understands that fabricating it suspends the remedy rather than just losing that case.

Check whether force post is enabled on your MID, and turn it off if you don't have a live reason for it.

None of these are expensive. They're just invisible until an acquirer asks.