Mastercard Chargeback Monitoring Programs: ECM, HECM & EFM Explained

Most merchants find out they are in a Mastercard monitoring program when their processor forwards the first fine. By then the clock has already been running, and getting out takes at least three clean months. Here is the quick answer up front: as of September 2026, Mastercard's Excessive Chargeback Merchant thresholds are 100 or more chargebacks in a month together with a chargeback ratio of 1.5% or higher, both in the same month.

That is one of three separate programs Mastercard runs over merchants, and they measure different things. The Excessive Chargeback Program (ECP) counts chargebacks. The Excessive Fraud Merchant program (EFM) counts fraud. The Scam Merchant Monitoring Program, which reached full enforcement in July 2026, does not use a ratio at all. Each is scored independently at the merchant ID level, so a clean number in one program does not protect you in another.

For high-risk merchants this matters more than it does for mainstream retail. You are already carrying higher dispute rates, your acquirer is already watching your account closely, and a network fine is usually what turns an uncomfortable conversation into a closed account. Knowing exactly where the lines sit — and how the ratio is calculated — is the difference between managing a bad quarter and losing your processing.

The Excessive Chargeback Program: ECM and HECM

Mastercard's chargeback program has two tiers, and both require a merchant to breach a count threshold and a ratio threshold together:

• Excessive Chargeback Merchant (ECM): 100 to 299 chargebacks in a month and a chargeback ratio between 1.50% and 2.99%.
• High Excessive Chargeback Merchant (HECM): 300 or more chargebacks in a month and a chargeback ratio of 3.00% or higher.

The word "and" is doing real work there. A small merchant with a frightening 4% ratio but only 40 chargebacks a month does not meet the standard, because the count threshold is not met. A large merchant with 500 chargebacks against enormous volume and a 0.9% ratio does not either. It takes both. That is why low-volume high-risk merchants often trip the program earlier than they expect once they start scaling: the ratio was always high, and volume growth quietly supplies the missing chargeback count.

One breach month is not automatically an enrollment. Published acquirer guidance describes Mastercard identifying a merchant under the program after the thresholds are breached in two months, and the first month in the program carries no assessment. Guidance differs on whether those two months must be consecutive, so the safe reading is the conservative one: treat a single breach month as the warning it is, and assume the second one costs money.

How Mastercard calculates your chargeback ratio

This is the part that catches merchants out, because it is not the calculation most people run internally. Mastercard divides the chargebacks received in the current month by the count of sales transactions processed in the previous month. June's chargebacks are measured against May's sales.

Work an example. You process 6,000 sales in May and 9,000 in June, and 120 chargebacks land in June. Measured the intuitive way — June chargebacks against June sales — you are at 1.33%, comfortably clear. Measured Mastercard's way, it is 120 divided by 6,000, or 2.00%, and with more than 100 chargebacks you are an ECM.

The lag cuts hardest in the direction merchants least expect. A month of falling volume shrinks the denominator while disputes from the busier previous month are still arriving, so the ratio can spike precisely when sales are slowing. Seasonal businesses, merchants winding down a campaign, and anyone who has just had volume throttled by their acquirer should watch this closely. It is also a count-based ratio, not a dollar-based one — a room full of small disputes does the same damage as a handful of large ones.

What the fines cost

Assessments escalate for every month you remain in the program, and the two tiers escalate at different rates. Per published acquirer program guidance, the schedule runs:

• Month 1: no assessment for either tier — this is the warning month.
• Month 2: $1,000 for ECM, $1,000 for HECM.
• Month 3: $1,000 for ECM, $2,000 for HECM.
• Months 4 to 6: $5,000 per month for ECM, $10,000 for HECM.
• Months 7 to 11: $25,000 per month for ECM, $50,000 for HECM.
• Months 12 to 18: $50,000 per month for ECM, $100,000 for HECM.
• Month 19 and beyond: $100,000 per month for ECM, $200,000 for HECM.

HECM merchants also face an issuer recovery assessment, reported in acquirer program documentation as USD 5 for each chargeback above 300. As with network registration fees, these assessments are billed to your acquiring bank, not to you directly — and they are passed through to you in practice. An acquirer absorbing five-figure monthly assessments on your account will not absorb them for long.

How to get out

Exit requires staying below the ECM thresholds for three consecutive months. Not three months on average, and not three months out of four — three in a row, and one bad month resets the count. In practical terms the fastest possible exit is about 90 days from the month you are enrolled, and every month of delay moves you further up the fine schedule while you work.

The Excessive Fraud Merchant program measures fraud, not disputes

EFM is a separate program with separate math, and it applies to e-commerce transactions. A merchant is enrolled only when all of the following are true in the same month:

• At least 1,000 e-commerce transactions cleared in the previous month.
• At least $50,000 in fraud-related chargebacks.
• A fraud ratio of at least 50 basis points — 0.50%.
• 3-D Secure authentication on less than 50% of transactions in markets with a regulatory authentication mandate, or less than 10% in markets without one, which includes the United States.

That last criterion is the one worth reading twice, because it is effectively an escape hatch. All four conditions must be met, so a merchant authenticating more than 10% of US e-commerce traffic through 3-D Secure cannot be enrolled in EFM no matter what the other three numbers say. Mastercard built the program that way deliberately: the point is to push authentication adoption, not simply to fine fraud.

For high-risk merchants that has a real trade-off attached. Many card-not-present operators keep 3-D Secure switched off, or limit it to a narrow slice of traffic, because authentication friction costs conversions. That is a defensible commercial decision — but under EFM it is now a decision with a compliance price attached, and the honest way to make it is to model both sides rather than leave authentication off by default. Like ECP, exiting EFM requires three consecutive months below the thresholds.

Scam Merchant Monitoring: no ratio, 72 hours to respond

Mastercard's newest program reached full enforcement on July 24, 2026, and it works nothing like the other two. There is no ratio to stay under and no monthly fine schedule. It is an investigation program: certain signals oblige your acquirer to open an investigation within 72 hours, and if scam activity is confirmed, Mastercard and Maestro authorization and clearing are blocked immediately. There is no remediation period.

Reported triggers include:

• An authorization approval rate that falls by at least 50 percentage points, or drops below 30%, across a minimum of 25 transactions in 72 hours.
• For merchants with less than six months of Mastercard acceptance history: two issuers reporting a transaction under fraud reason code 56, two issuers filing chargebacks whose documentation references scams or manipulation, or a combined refund and chargeback rate above 5% of purchase transactions over any rolling 30-day period on at least 500 purchase transactions.
• Receipt of a Global Rules Investigation Program letter, or an alert from an approved Merchant Monitoring Service Provider.

Two things follow for legitimate high-risk merchants. First, the heightened scrutiny on accounts under six months old lands squarely on anyone who has just opened a new MID — including merchants who moved after a termination elsewhere, which describes a large share of the high-risk market. Second, a collapsing authorization rate is now a compliance signal, not just an operations problem. A gateway misconfiguration or a BIN-blocking issuer that tanks approvals for a day can put you in front of an investigator who is working to a 72-hour deadline.

How Mastercard's thresholds compare to Visa's

Visa tightened its own program in 2026: the excessive merchant threshold under the Visa Acquirer Monitoring Program dropped from 2.2% to 1.5% on April 1, 2026 across the US, Canada, the EU, Asia-Pacific and Latin America, with enrollment also requiring at least 1,500 combined fraud reports and disputes in a month and a fee of $8 per fraud or dispute event.

Visa's 1.5% and Mastercard's 1.5% are not the same measurement, and treating them as one number is a good way to get blindsided. Visa's ratio adds issuer-reported fraud (TC40) to disputes (TC15) and divides by settled transactions in the same period. Mastercard's counts chargebacks only, and divides by the previous month's sales. A merchant with heavy TC40 fraud reporting but few chargebacks can sit safely inside Mastercard's program while approaching Visa's threshold, and a merchant with falling volume can trip Mastercard's prior-month denominator while Visa's ratio still looks healthy. Track the two separately, every month, as two different numbers.

What high-risk merchants should actually do

• Calculate both ratios monthly, using each network's own formula — including Mastercard's prior-month denominator. Do not let your processor's single blended "chargeback rate" stand in for either.
• Watch the denominator, not just the disputes. If volume is falling, your Mastercard ratio is rising even when your dispute count is flat.
• Stop disputes before they become chargebacks. Pre-dispute resolution and alert programs keep cases out of the numerator entirely, which is the only lever that moves a ratio quickly.
• Fix the boring causes first. Unclear billing descriptors, unclear cancellation paths and slow refunds generate a surprising share of the disputes that push merchants over a threshold.
• Model 3-D Secure honestly against EFM rather than leaving it off by default, especially on your highest-risk traffic segments.
• Treat a sudden authorization-rate drop as an alarm to investigate the same day, not a metric to review at month end.
• Ask your acquirer, in writing, to notify you the moment you are flagged in any network program. The warning month is the cheapest month to act in, and it is the one merchants most often waste.

The bottom line

Mastercard's three programs punish different things on different timetables: chargeback volume and ratio under ECP, e-commerce fraud and low authentication under EFM, and scam signals under Scam Merchant Monitoring, where the response window is 72 hours rather than a month. All of them are scored per MID, none of them cares that your business is legitimate, and each one takes at least three clean months to escape once you are in.

Network thresholds and fee schedules change — Visa moved its merchant threshold in April 2026 and Mastercard added an entire program in July — so confirm current figures with your processor before you make decisions off any published table, including this one. If you are approaching a threshold, or you have already had a fine passed through, PayKings can help you structure processing that survives it. Contact us for a high-risk merchant account review and a straight answer about where your numbers actually stand.