On July 24, 2026, Mastercard’s Scam Merchant Monitoring Program (SMMP) becomes enforceable. Unlike the Excessive Chargeback Program (ECP) or Excessive Fraud Merchant (EFM) program, SMMP does not hand you a fine or put you on a ladder. It hands your acquirer a 72-hour clock. If the investigation concludes you are a scam operation, Mastercard and Maestro processing stops. Immediately. No grace period, no fines, no second chance.
The most blunt enforcement mechanism Mastercard has introduced in years.
TPE analysis
SMMP trigger threshold
A combined refund and chargeback rate above 5% over any rolling 30-day window, with at least 500 transactions, triggers a mandatory investigation by your acquirer. Refunds and chargebacks are counted together. Winning a representment does not remove the chargeback from the calculation.
What triggers an SMMP investigation
Four signal categories can put your account under a mandatory review:
- A combined refund and chargeback rate above 5% over any rolling 30-day window, with a minimum of 500 transactions. Note the word “combined.” Refunds and chargebacks are added together, which is a harder number to manage than a chargeback ratio alone.
- An authorization approval rate that drops 50 percentage points in 72 hours, or falls below 30%. This catches sudden volume drops that signal issuers have started blocking your transactions in bulk.
- A Mastercard GRIP letter, the network’s intelligence-sharing channel to acquirers. If Mastercard has independent intelligence on your business, your acquirer may not know before the clock starts.
- An alert from a Merchant Monitoring Service Provider (MMSP), the third-party vendors Mastercard now approves to feed signals directly into the program.
All four apply to card-not-present merchants globally.
What the numbers look like in practice
The 5% combined threshold is less forgiving than it sounds. Two ordinary dispute loads for these categories both cross it:
| Scenario | Txns | Chargebacks | Refunds | Combined |
|---|---|---|---|---|
| Subscription adult, 800 monthly billings | 800 | 14 (1.8%) | 28 (3.5%) | 5.25% |
| New iGaming merchant, 600 deposits | 600 | 18 (3.0%) | 17 (2.8%) | 5.8% |
Illustrative dispute loads typical of each vertical. Neither chargeback rate alone is alarming; combined with refunds, both trigger.
In the subscription case, a 1.8% chargeback rate looks clean on its own. Add a 3.5% refund rate from customers who cancel and escalate, and the combined figure crosses 5%. The iGaming merchant, under six months of history, hits the 500-transaction new-merchant threshold and trips the trigger in month one, before there has been time to optimize anything. These are not edge cases. They are ordinary dispute loads for these categories.
What happens when a trigger fires
Your acquirer has 72 hours to open a formal investigation and document the findings. That is not a courtesy warning. That is the investigation window.
If the review confirms scam activity, Mastercard processing is terminated. Your MATCH record follows. Re-entering the Mastercard ecosystem after an SMMP termination is not a conversation you want to be having.
If the review clears you, processing continues. But the account is now flagged, and a second trigger moves faster.
Who is most at risk
Mastercard describes SMMP as general infrastructure for all card-not-present merchants. In practice, the risk profile is concentrated.
Subscription billing, iGaming, adult content, AI companion platforms, nutraceuticals, and digital goods all share the same structural problem: their business models produce above-average refund and dispute volumes by design. Subscription platforms take “I forgot I signed up” disputes. iGaming takes chargebacks from losing players. Adult platforms deal with cardholder regret and third-party declines from embarrassed customers.
A 5% combined rate sounds high until you look at actual dispute data for these categories. Some merchants are already near it.
New merchants, those under six months of Mastercard processing history, face the steepest scrutiny. New-merchant fraud signals include issuer fraud reports under reason code 56 and scam-referenced chargebacks from multiple issuers. Both can fire SMMP before you have had time to stabilize your dispute rate.
What to do before July 24
Pull your combined refund and chargeback count for the last 30 days and divide by total transactions. If the number is above 3%, you are in uncomfortable territory. At 4%, you need a plan. At 5%, you are at the trigger.
Check your card descriptor. A confusing or mismatched descriptor is one of the fastest paths from a confused customer to a dispute. Make it recognizable and consistent with what the cardholder sees at checkout.
Get your evidence capture in order. SMMP investigations run on documentation: clean transaction records, consistent descriptors, and session-level evidence collected before a cardholder calls their bank. If your dispute process is reactive and manual, that changes now.
Talk to your acquirer. Some have already received MMSP alerts on accounts they have not flagged to the merchant directly. Ask explicitly whether any SMMP signals have been noted against your MID.
SMMP is not a problem to address next quarter. July 24 is the enforcement date. You have days, not weeks.
- Chargeflow, “Mastercard SMMP 2026: What eCommerce & SaaS Merchants Must Know,” chargeflow.io.
- c/side, “Mastercard Scam Merchant Monitoring 2026: What Merchants Must Know Before July,” cside.com.
- Justt, “Mastercard SMMP 2026: Triggers, Thresholds & Compliance Guide,” justt.ai.
