Mastercard’s scam-merchant rules take effect today — and they remove the option of paying a fine

Mastercard’s Scam Merchant Monitoring Program becomes enforceable today for card-not-present merchants worldwide. Where a merchant is flagged, the acquirer must investigate within 72 hours; where scam activity is confirmed, Mastercard and Maestro acceptance stops immediately. Unlike the network’s existing chargeback and fraud programmes, the rules carry no fine schedule, no remediation tier and no graduated escalation.

The programme is signal-driven rather than ratio-driven. Investigations can be triggered by an issuer’s fraud report, by chargeback documentation referencing scam or manipulation, by Mastercard’s own intelligence, or by an alert from an approved merchant-monitoring provider. Merchants with less than six months of processing history sit under tighter thresholds: a combined refund and chargeback rate above five percent across a rolling 30-day window, on a minimum of 500 transactions, is enough to oblige the acquirer to open a file.

For the payment structures this desk follows, the absence of a fine tier is the material change. Ratio programmes effectively priced non-compliance: penalties were predictable, budgetable and, for high-risk portfolios, treated as an operating cost. Termination cannot be budgeted for.

Two consequences look likely, though neither is yet observable. Counting refunds alongside chargebacks removes a familiar tactic — refunding aggressively to hold chargeback ratios below monitoring thresholds now feeds the trigger it was meant to avoid. And the six-month window falls hardest on newly incorporated merchant entities, which is precisely how rotation-based processing structures are built.