De nieuwe regels van Mastercard inzake frauduleuze handelaren: wat elke e-commerce- en SaaS vóór juli 2026 moet weten

Mastercard's Scam Merchant Monitoring Program (SMMP) is the standard requiring acquirers in every Mastercard market except Jordan to investigate any merchant flagged for scam activity within 72 hours. SMMP has been live since July 24, 2026: a confirmed investigation means immediate termination of Mastercard and Maestro processing, with no fine and no grace period.

Mastercard has spent years relying on chargeback ratio programs like ECM and EFM to manage merchant risk. Those programs fine you when your numbers go above a threshold, give you time to fix things, and escalate if you don't. They're uncomfortable, but survivable. Beyond these ratio-based programs, Mastercard also runs the Mastercard GMAP audit program, which reviews a merchant's risk controls directly.

The Scam Merchant Monitoring Program (SMMP) works differently. It isn't about thresholds you gradually breach. It's about signals that look like scam activity, and when those signals appear, the consequences are immediate. Acquirers have 72 hours to investigate, and if they confirm scam activity, Mastercard and Maestro processing stops right away. No warnings, no remediation window. Your ability to accept cards is just gone.

SMMP has now been in active enforcement for over a month, and the onboarding requirements for new merchants have applied since January 2026. According to Equifax's 2026 analysis of Mastercard's revised standards, the rules apply in every market Mastercard operates in except Jordan. If you sell eCommerce, SaaS, or subscriptions, this affects you more than you might think. If you need a primer first, start with what is a chargeback before working through the SMMP specifics below.

Sinds januari 2026 zijn acquirers bovendien verplicht om de website van elke nieuwe handelaar te scannen voordat ze diens eerste transactie verwerken. Als een monitoringdienst tijdens die scan iets signaleert, heeft de acquirer 15 dagen de tijd om dit te onderzoeken en te verhelpen. Dit is een afzonderlijke verplichting, los van de SMMP-termijn van 72 uur, en het betekent dat nieuwe handelaren onder de loep worden genomen nog voordat ze ook maar één betaling hebben verwerkt.

This Is Not ECM. The Consequences Are Different.

De meeste handelaren zijn bekend met de bestaande controleprogramma’s van Mastercard. ECM (Excessive Chargeback Merchant) en EFM (Excessive Fraud Merchant) werken op basis van ratio’s. Als je wordt gesignaleerd, krijg je een boete en krijg je de tijd om verbeteringen door te voeren. SMMP werkt volgens een geheel andere logica.

Dit is hoe ze zich tot elkaar verhouden:

Met ECM en EFM heb je de tijd om dingen op te lossen. Bij SMMP is dat niet het geval.

The key difference is that SMMP gives acquirers a compressed decision window. A merchant can be perfectly clean under ECM rules, dispute ratios within acceptable limits, and still get flagged under SMMP if the pattern of activity looks like a scam operation. These programs run in parallel, not in sequence. For a detailed comparison of how SMMP differs from ECM and EFM, see cside's breakdown.

This isn't just a Mastercard story. Visa moved first with VAMP (Visa Acquirer Monitoring Program), which shifted accountability to acquirers for fraud and dispute performance across their merchant portfolios. Mastercard's SMMP completes the picture on their network. Together, they represent a coordinated shift across both card networks: one evidence standard, one expectation, two deadlines. For the fee and timeline side of Visa's own rules, see our Visa chargeback dispute rules guide. If you're positioning your dispute management around VAMP and ECM, SMMP belongs in that same conversation.

Wat is nu eigenlijk de aanleiding voor een onderzoek?

Er zijn vier categorieën van triggergebeurtenissen waarop acquirers moeten reageren:

Een plotselinge daling van het goedkeuringspercentage. Als uw goedkeuringspercentage binnen een periode van 72 uur met 50 of meer procentpunten daalt, of onder de 30% zakt terwijl u ten minste 25 transacties verwerkt, leidt dat tot een onderzoek. Een slechte campagne, een probleem met de routering of een agressieve strategie voor herhalingspogingen kunnen allemaal tot dit patroon leiden. Het hoeft niet per se op fraude te duiden, maar vanuit het perspectief van Mastercard lijkt het wel op fraude.

A GRIP letter from Mastercard. A Global Rules Investigation Program notification means Mastercard has already flagged your account for suspected fraudulent activity at the network level. By the time your acquirer receives one of these, the clock is already running.

New merchant scam signals. This is the one that hits legitimate businesses hardest. If you have less than six months of Mastercard processing history, you're in a heightened monitoring window. Two different issuers filing fraud type 56 reports against you, chargebacks from multiple issuers with documentation mentioning scams or manipulation, or a combined refund and chargeback rate above 5% in any rolling 30-day period can all trigger an investigation. Fraud type 56 is one of several Mastercard chargeback reason codes, and it classifies first-party misuse, more commonly known as friendly fraud, where the cardholder made the purchase but disputes it anyway. Two issuers filing this against the same merchant is a strong signal of a pattern, not a one-off. 

Een melding van een Merchant Monitoring Service Provider (MMSP). Mastercard werkt samen met erkende externe dienstverleners die het gedragspatroon van handelaren analyseren. Een melding van een van deze dienstverleners kan ertoe leiden dat er een onderzoek naar u wordt ingesteld. In het overzicht van Austreme over de MMP-updates van juni 2025 wordt beschreven hoe de MMSP-vereisten zich hebben ontwikkeld.

Mastercard's Newest Layer: Merchant Trust Services and MSRI

Mastercard has added a second track on top of SMMP. Under a strategy it calls Merchant Trust Services, Mastercard combines onboarding screening with ongoing monitoring for acquirers and payment facilitators, and it introduced the Merchant Scam & Risk Indicator (MSRI), a new authorization-point signal that flags risky merchants directly to issuers rather than waiting for an acquirer-side investigation. According to Mastercard's own 2026 announcement, pilot data shows MSRI catching roughly 80% of risky merchants, in many cases up to 90 days before an issuer would otherwise escalate a pattern. MSRI is rolling out first in Europe and the US before expanding globally.

This does not replace the 72-hour SMMP investigation window described above. SMMP still governs how acquirers respond once scam activity is suspected. MSRI adds an earlier tripwire on the issuer side, which means merchants can now be flagged before an acquirer-led SMMP investigation ever starts. For subscription and SaaS merchants already tracking their combined refund and chargeback rate, this is another reason to keep that number clean well before it approaches 5%.

Waarom SaaS abonnementen en SaaS extra kwetsbaar zijn

The 5% combined threshold is brand new. It doesn't matter if your chargeback ratio is fine under ECM rules. What matters is whether your refunds plus chargebacks, combined, exceed 5% in any 30-day window with 500+ transactions. For subscription merchants, SaaS companies, and new CNP businesses, refund rates are naturally higher. Trial cancellations, forgotten renewals, billing descriptor confusion, and customer service escalations all push this number up before a single dispute is filed.

Als terugbetalingen en geschillen bij elkaar worden opgeteld, wordt vroegtijdige preventie nog belangrijker dan het terugvorderen van bedragen. Dat is een belangrijke verschuiving in de manier waarop handelaren hun geschillenstrategie in het kader van het SMMP moeten benaderen.

New merchants are in the highest-risk category. Scam operations often onboard, process quickly, accumulate disputes, and disappear. Mastercard knows this pattern, which is why the rules are strictest for merchants under six months of processing history. A legitimate new subscription or SaaS business goes through the same scrutiny.

The 72-hour investigation window means acquirers need clean evidence fast. If an investigation opens, your acquirer will be pulling transaction records, refund behavior, chargeback documentation, website content, and billing descriptors. The merchants who get cleared quickly are the ones who have organized, complete evidence ready before the question is ever asked. A broader ecommerce fraud prevention strategy, not just an SMMP checklist, is what keeps you out of this position in the first place.

What Merchants Should Do Now That SMMP Is Live

Track refunds and chargebacks together, not separately. Most dispute monitoring treats these as separate metrics. Under SMMP, they're combined. Start calculating your 30-day rolling combined rate now and set an internal alert well below 5% to give yourself reaction time.

Prioritize prevention over recovery for high-refund categories. Chargeflow Alerts deflects disputes before they file, which keeps the combined rate down. See how chargeback prevention alerts work if you haven't set these up yet. Chargeflow Prevent goes further by stopping friendly fraud at the source. For new merchants or anyone approaching the 5% threshold, prevention is more valuable than recovery right now.

Review your billing descriptors. Descriptor confusion is one of the most common reasons customers call their issuer instead of your support team. When they call their issuer, their language about the charge often becomes part of the dispute record, and under SMMP, that language matters. "Unexpected charge" and "don't recognize this" are very different from "scam" and "manipulation," but both can end up in a chargeback.

Brief your acquirer on your business model. If you're new to Mastercard processing, or if you're in a vertical with naturally elevated refund rates, proactively giving your acquirer or payment service provider context before a trigger fires puts you in a much better position than having to explain yourself during a 72-hour window. They cannot defend what they don't understand.

Get your documentation in order. Chargeflow builds detailed evidence packets for disputes. That same documentation is what your acquirer needs during an SMMP investigation. Our Mastercard chargeback survival guide walks through the records worth keeping: cancellation logs, delivery confirmations, ToS acceptance, and support interactions. They aren't just for winning disputes anymore, they're your defense against processing termination.

Why Platform and PayFac Merchants Can't Sit This One Out

Mastercard is shifting accountability upstream. Acquirers and payment facilitators now carry formal obligations to act fast on scam signals, which means they have every incentive to offboard merchants who look risky before an investigation lands on their desk. For PayFac and platform merchants, this is particularly important: the SMMP obligations flow down to sub-merchants. If a sub-merchant on your platform triggers an investigation, your acquirer is on the hook, which means you are too. Platform operators running Stripe Connect, marketplace models, or any embedded payment structure now have a direct reason to monitor dispute and refund health across their entire portfolio, not just at the platform level. That includes checkout flows run by AI agents on a merchant's behalf: our agentic commerce chargebacks playbook covers the evidence gaps those flows create. Cartis Payments has a sharp analysis of what this shift in acquirer liability actually means.

The merchants who stay off the investigation list share four traits: low combined refund and chargeback rates, clear billing descriptors, organized evidence, and a business model their acquirer already understands. Everyone else has been treating dispute management as an afterthought, assuming a clean chargeback ratio told the full story. Under SMMP, it doesn't, and acquirers are not waiting for an investigation to offboard a merchant who looks risky.

See how Chargeflow keeps you under the 5% threshold, automatically.

Veelgestelde vragen

What is Mastercard's Scam Merchant Monitoring Program (SMMP)? SMMP is a Mastercard enforcement standard that requires acquirers to investigate any merchant flagged for scam activity within 72 hours. If the investigation confirms scam activity, the merchant's Mastercard and Maestro processing is terminated immediately. It has been in effect since July 24, 2026 in every Mastercard market except Jordan.

How is SMMP different from Mastercard's ECM program? ECM and EFM are ratio-based programs that result in fines and give merchants time to remediate. SMMP is an investigation-based program triggered by scam signals. The consequence of a confirmed investigation is immediate processing termination, not a fine.

What is the 5% threshold under SMMP? For merchants with less than six months of Mastercard processing history and at least 500 transactions in a 30-day period, a combined refund and chargeback rate above 5% can trigger an SMMP investigation. This is separate from ECM thresholds and counts refunds and disputes together.

Is SMMP still in effect? Yes. SMMP took effect July 24, 2026 and acquirers have been actively running 72-hour investigations under it since launch. According to Equifax's 2026 review of the revised standards, the rules now apply in every Mastercard market except Jordan.

What is Mastercard Merchant Trust Services? Merchant Trust Services is Mastercard's 2026 strategy that pairs new-merchant onboarding screening with ongoing monitoring for acquirers and payment facilitators. It includes the Merchant Scam & Risk Indicator (MSRI), an issuer-side signal that flags risky merchants at authorization, separate from and earlier than the acquirer-led SMMP investigation process.

Welke handelaren lopen het grootste risico? Nieuwe handelaren die betalingen zonder fysieke kaart verwerken en nog geen zes maanden bij Mastercard zijn aangesloten, worden het strengst gecontroleerd. Ook handelaren op het gebied van abonnementen, SaaS, iGaming, reizen en digitale goederen lopen een verhoogd risico, omdat hun bedrijfsmodellen van nature leiden tot hogere percentages terugbetalingen en geschillen.

Hoe Chargeflow het naleven van de SMMP-voorschriften? Chargeflow voorkomt geschillen nog voordat ze worden ingediend, waardoor het gecombineerde percentage van terugbetalingen en chargebacks laag blijft. Chargeflow pakt vriendelijke fraude bij de bron aan. De geautomatiseerde bewijsdocumentatie Chargeflow biedt handelaren en hun acquirers bovendien de overzichtelijke, goed geordende gegevens die nodig zijn om snel te kunnen reageren als er een onderzoek wordt gestart.

Aanvullende literatuur

G2 Risk Solutions: Mastercard MMP-vereisten 2026, operationele richtlijnen over wat acquirers en handelaren moeten hebben geregeld.

LegitScript: De komende zes maanden zullen het risicobeheer voor handelaren een nieuwe invulling krijgen, bredere context over hoe SMMP past in de bredere verschuiving in risiconormen voor handelaren in de aanloop naar eind 2026.