Mastercard’s revised Scam Merchant Monitoring Program took effect on Friday 24 July 2026, first reported by Payments Dive from a panel at the Midwest Acquirers Association conference. The change that matters to merchants is not a new threshold. It is a deadline handed to your acquirer.
Mastercard set out the substance on its own site in May, saying it is revising its franchise standards to “drive greater consistency in fraud mitigation efforts” and that from July it would be “compressing the window between suspicious signals and enforcement”.
The mechanism is specific. Acquirers and payment facilitators must, in Mastercard’s words, “actively monitor merchant behavior” and “initiate an investigation within 72 hours when potential scam activity hits a certain risk threshold”. If the activity is confirmed, “the merchant must be stopped from accepting Mastercard transactions”. Mastercard’s own page never named a start date. The 24 July date comes from Payments Dive.
The SMMP 72 hour rule is an evidence rule
What is new since the program was announced is the proof burden. Industry consultant Ken Musante, who moderated the panel, put it plainly: acquirers “have to respond within 72 hours”, and “you have to have evidence of a response”. A file that shows the acquirer looked, and when.
For merchants that changes the texture of the request. Statements, fulfilment evidence, marketing screenshots and refund logs get asked for on a compressed timetable and framed as urgent, because the acquirer is working against its own deadline rather than yours. The triggers themselves have not moved: we set them out in full when the date was announced.
Mastercard mandates what Visa only prices
The contrast with Visa is the useful part. VAMP puts acquirers under measurement and attaches fee incentives and penalties, then leaves the decision about any given merchant to the parties. Mastercard is mandating the act of investigating and the timetable it happens on.
Behind the clock sits a scoring layer. Mastercard is building what it calls a merchant “trust profile” drawing on signals from beyond its own network, including “changes in business data, goods and services sold, and negative social content”. In an issuer pilot of its Merchant Scam and Risk Indicator, Mastercard says it detected around 80% of the issuer-identified risky merchants, many flagged as much as 90 days before the issuer escalated.
Why it matters
A young account is the exposed one. Merchants with under six months of Mastercard acceptance carry extra triggers, so an ordinary dispute spike in month three can open a scam file before anyone reads the context. If your acquirer asks for documentation with an unusual deadline attached, the clock is probably already running.
- Mastercard, “How to stop the scammers behind the storefronts,” mastercard.com, 19 May 2026. First reported by Payments Dive.