SMMP enforcement begins 24 Jul 2026, and it is now days away. On that date, Mastercard’s Scam Merchant Monitoring Program (SMMP) becomes enforceable in every market except Jordan. Unlike the Excessive Chargeback Program (ECP) or the Excessive Fraud Merchant (EFM) program, SMMP does not hand you a fine or put you on a ladder. It hands your acquirer or payfac a 72 hour clock. If the investigation concludes you are a scam operation, Mastercard and Maestro processing stops. Immediately. No grace period, no fines, no second chance.
The most blunt enforcement mechanism Mastercard has introduced in years.
TPE analysis
SMMP triggers at a glance
Three signals put any merchant under review: an authorization approval collapse, a GRIP letter from Mastercard, or an alert from an approved Merchant Monitoring Service Provider. Merchants in their first six months carry three more, including a combined refund and chargeback rate above 5% over a rolling 30 day window with at least 500 transactions. Refunds and chargebacks are counted together, and winning a representment does not remove the chargeback from the calculation.
Update, 7 Jul 2026: with the enforcement date under three weeks out, acquirer side analysis is converging on the same reading. Writing for The Paypers, Chargeback Nerd founder Amber McGirr describes the program as a shift from monitoring fraud to monitoring trust: instead of asking whether a merchant has already caused harm, acquirers are expected to judge whether it can be trusted before harm occurs, across the whole merchant lifecycle. In practice that means tighter onboarding questions and more data requests from your PSP, not just threshold maths.
Update, 28 Jul 2026: the rules are now in force. The revised standards took effect on 24 Jul 2026, and the operative change is the deadline rather than the thresholds below: an acquirer must open an investigation within 72 hours and be able to show evidence it did. We covered what landed on the day in the SMMP 72 hour rule going live.
What triggers an SMMP investigation
The triggers fall into two sets. Three apply to every merchant. Three more apply only to merchants with six months or less of Mastercard acceptance history.
All merchants
- An authorization approval collapse: at least 25 transactions in 72 hours with the approval rate dropping 50 percentage points or more, or falling below 30%. BIN attacks and known system issues are excluded. This catches issuers blocking your transactions in bulk.
- A Mastercard GRIP letter linking your account to suspected scam activity, the network’s intelligence sharing channel to acquirers. If Mastercard has independent intelligence on your business, your acquirer may learn of it only once the clock has started.
- An alert from an approved Merchant Monitoring Service Provider (MMSP), the third party vendors Mastercard now approves to feed signals directly into the program.
New merchants only, six months or less of Mastercard history
- Fraud reason code 56 reports from two or more issuers.
- Chargebacks from two or more issuers with documentation referencing scams or manipulation.
- A combined refund and chargeback rate above 5% of purchase transactions over any rolling 30 day window, with a minimum of 500 transactions. Note the word combined: refunds and chargebacks are added together, a harder number to manage than a chargeback ratio alone.
The all merchant signals apply to card not present merchants worldwide. The 5% combined rate is widely misreported as the universal SMMP trigger. It is not. It applies only during a merchant’s first six months of Mastercard acceptance.
What the numbers look like in practice
For a new merchant, the 5% combined threshold is less forgiving than it sounds. Two ordinary dispute loads in the first months both cross it:
| Scenario | Txns | Chargebacks | Refunds | Combined |
|---|---|---|---|---|
| New subscription adult merchant, 800 monthly billings | 800 | 14 (1.8%) | 28 (3.5%) | 5.25% |
| New iGaming merchant, 600 deposits | 600 | 18 (3.0%) | 17 (2.8%) | 5.8% |
Illustrative dispute loads typical of each vertical, both merchants inside their first six months. Neither chargeback rate alone is alarming; combined with refunds, both trigger.
In the subscription case, a 1.8% chargeback rate looks clean on its own. Add a 3.5% refund rate from customers who cancel and escalate, and the combined figure crosses 5%. The iGaming merchant, still inside its first six months, clears the 500 transaction floor and trips the trigger in month one, before there has been time to optimize anything. For an established merchant past six months, this combined rate is not itself an SMMP trigger, though the all merchant signals still apply. For a new merchant, these are not edge cases. They are ordinary dispute loads for these categories.
What happens when a trigger fires
Your acquirer has 72 hours to open a formal investigation and document the findings. That is not a courtesy warning. That is the investigation window.
If the review confirms scam activity, Mastercard and Maestro processing is terminated with no fine ladder and no appeal ladder. A MATCH record is a likely follow on. Re-entering the Mastercard ecosystem after an SMMP termination is not a conversation you want to be having.
If the review clears you, processing continues. But the account is now flagged, and a second trigger moves faster.
Who is most at risk
Mastercard describes SMMP as general infrastructure for all card not present merchants. In practice, the risk profile is concentrated.
Subscription billing, iGaming, adult content, AI companion platforms, nutraceuticals, and digital goods all share the same structural problem: their business models produce above average refund and dispute volumes by design. Subscription platforms take “I forgot I signed up” disputes. iGaming takes chargebacks from losing players. Adult platforms deal with cardholder regret and third party declines from embarrassed customers.
A 5% combined rate sounds high until you look at actual dispute data for these categories, and for a merchant in its first six months some are already near it.
New merchants, those with six months or less of Mastercard processing history, face the steepest scrutiny. Their extra triggers include issuer fraud reports under reason code 56 from two or more issuers and scam referenced chargebacks from two or more issuers. Both can fire SMMP before you have had time to stabilize your dispute rate.
What to do before 24 Jul
Pull your combined refund and chargeback count for the last 30 days and divide by total transactions. If the number is above 3%, you are in uncomfortable territory. At 4%, you need a plan. If you are in your first six months, 5% is the trigger, and even past six months a rate that high invites the scrutiny the all merchant signals feed on.
Check your card descriptor. A confusing or mismatched descriptor is one of the fastest paths from a confused customer to a dispute. Make it recognizable and consistent with what the cardholder sees at checkout.
Get your evidence capture in order. SMMP investigations run on documentation: clean transaction records, consistent descriptors, and session level evidence collected before a cardholder calls their bank. If your dispute process is reactive and manual, that changes now.
Talk to your acquirer. Some have already received MMSP alerts on accounts they have not flagged to the merchant directly. Ask explicitly whether any SMMP signals have been noted against your MID.
SMMP is not a problem to address next quarter. 24 Jul is the enforcement date. You have days, not weeks.
- Chargeflow, “Mastercard SMMP 2026: What eCommerce & SaaS Merchants Must Know,” chargeflow.io.
- c/side, “Mastercard Scam Merchant Monitoring 2026: What Merchants Must Know Before July,” cside.com.
- Justt, “Mastercard SMMP 2026: Triggers, Thresholds & Compliance Guide,” justt.ai.
- The Paypers, “Mastercard’s new scam merchant initiative: from monitoring fraud to monitoring trust,” Amber McGirr (Chargeback Nerd), thepaypers.com, 7 Jul 2026.
