Mastercard has rewritten the rules for how scam merchants get identified and removed from its network, and the changes carry real consequences for card-not-present businesses — not just the bad actors the program is designed to catch. The revised standards move acquirers and payment facilitators from a reactive, after-the-fact review process to a proactive one with a hard deadline attached. If you accept Mastercard or Maestro, it's worth understanding exactly what's changing and whether your current processing setup could put you in the path of an investigation you didn't see coming.

When Do the New Rules Take Effect?

The revised standards, published under Mastercard's Security Rules and Procedures as part of its Merchant Monitoring Program, take effect July 24, 2026, and apply globally with limited exceptions. The change updates existing Fraud Loss Control and Merchant Monitoring guidance rather than replacing the program outright, but it introduces specific, enforceable criteria that didn't exist in the same form before.

What's Actually Changing

The core update is a defined 72-hour window. Once a merchant meets one of Mastercard's "potential scam merchant" triggers, the acquirer or payment facilitator responsible for that merchant account must open a formal investigation within three days. If the investigation confirms scam activity, Mastercard and Maestro transaction processing for that merchant must be blocked immediately.

This is a meaningful shift from how merchant risk has traditionally worked. Rather than relying purely on periodic chargeback ratio reviews, the program is built to catch scam signals in near real time — before a fake storefront or deceptive operation can run for months while a review works its way through the system.

What Triggers an Investigation

Mastercard's revised standards define several specific signals that can trigger a mandatory review. Any one of these on its own is enough to start the clock:

  • A sharp drop in authorization approval rates — a decline of 50 percentage points or more, or a rate that falls below 30%, measured over a minimum of 25 transactions within a 72-hour period (excluding known system or connectivity issues).
  • A Mastercard GRIP letter — receipt of a Global Rules Investigation Program letter tied to a suspected scam merchant.
  • Elevated fraud and refund signals — this includes fraud reports filed by issuers under reason code 56, scam-referenced chargebacks arriving from multiple issuers, or a combined refund-and-chargeback rate above 5% of purchase transactions over a rolling 30-day period, calculated on a minimum of 500 transactions.
  • Alerts from a Merchant Monitoring Service Provider — third-party monitoring partners that acquirers use to flag suspicious activity.

New Merchants Face Extra Scrutiny

Merchants with less than six months of Mastercard acceptance history are subject to an additional, stricter threshold during that early window. If more than 5% of a new merchant's purchase transactions result in refunds or chargebacks combined during any 30-day rolling period, once a minimum of 500 transactions has been reached, the acquirer is required to investigate. Businesses that are newly onboarded, scaling quickly, or running promotional campaigns that generate early refund activity should be especially mindful of this threshold in their first six months of processing.

How This Differs From Existing Chargeback Programs

Merchants already familiar with Mastercard's Excessive Chargeback Program or Excessive Fraud Merchant program might assume this is simply another version of the same monitoring. It isn't. Those programs are built around chargeback and fraud ratios in isolation. The scam merchant monitoring standards look at a broader set of signals — including authorization rate collapses and multiple-MID requests — aimed specifically at identifying fake storefronts, deceptive online businesses, and mule-like or laundering-adjacent payment activity, rather than ordinary dispute volume from a legitimate but imperfect merchant.

That said, the operational habits that keep a merchant in good standing under one program tend to help under the other. A business with clean authorization rates, a stable refund pattern, and transparent documentation is unlikely to trip either.

What Merchants Should Do to Prepare

Monitor Your Authorization Approval Rate

A sudden drop is one of the clearest scam signals in Mastercard's framework. If your approval rate falls unexpectedly, investigate immediately — a processing outage, a gateway misconfiguration, or a batch of declined cards can look identical to fraud from the outside, and getting ahead of the explanation matters.

Keep Combined Refund and Chargeback Rates Under 5%

This threshold applies across a rolling 30-day window, so it's worth tracking on an ongoing basis rather than reviewing it only after a statement cycle closes. New merchants in particular should watch this closely during their first six months of Mastercard acceptance.

Avoid Requesting Unnecessary Additional MIDs

Multiple acceptor IDs for a single card-not-present merchant is one of the patterns Mastercard associates with scam activity, since it can be used to spread transaction volume and evade detection. Mastercard's guidance to acquirers is to assign additional MIDs only when there's a legitimate business reason, and merchants requesting them without a clear justification may draw extra scrutiny.

Keep Documentation Ready

Given the 72-hour investigation window, merchants who can quickly produce order records, delivery confirmation, refund policies, and customer communication are far better positioned to resolve a review before it escalates. Waiting until an investigation starts to gather this information costs time you won't have.

Work With an Acquirer That Understands Your Risk Profile

Because the investigation duty sits with the acquirer or payment facilitator, the processor you work with matters more than ever. An acquirer experienced with your industry and transaction pattern is better equipped to distinguish a legitimate business hitting a rough patch from an actual scam signal — and less likely to over-trigger reviews based on normal fluctuations in your business.

The Bottom Line

Mastercard's revised scam merchant monitoring standards raise the bar for how quickly risk gets investigated and acted on, and while the program targets scam operations, the thresholds are specific enough that any card-not-present merchant with elevated refunds, chargebacks, or authorization issues could get pulled into a review. The practical response is straightforward: track the trigger metrics on a rolling basis, keep documentation current, and make sure your merchant account is with a processor that understands your business well enough to tell the difference between a bad week and a real red flag.