Visa VAMP and Mastercard ECM in Australia: what Shopify merchants need to know in 2026

A Sydney store owner reads a headline that says Visa is cutting the dispute limit for merchants, looks at her own numbers, sees 14 disputes on 1,100 orders last month, and panics. Is she about to be fined? Is Shopify going to shut her payments off? Having worked through the published material, my answer is: probably not, because the programmes that make headlines are built around volumes far above hers, but the picture is more tangled than most articles admit, and Shopify can still act on her account for its own reasons.

VAMP is Visa's Acquirer Monitoring Program, which measures how many of a merchant's card-not-present sales end in fraud reports or disputes. Mastercard's Excessive Chargeback Program (ECM) does something similar for chargebacks. For an Australian Shopify store, the practical points are these: both programmes have volume floors that most small stores never reach, the published thresholds differ between sources and I could not find an Australia-specific rule, and the real risk to a small store is usually Shopify's own risk review, which can place a reserve on your payouts when chargebacks climb. The useful habit is to calculate your own ratio every month.

This guide is for you if:

• You run an Australian Shopify store on Shopify Payments and want to know whether VAMP or Mastercard's programme can affect you.
• You have seen a conflicting set of thresholds online and want a clear account of what is known and what is not.
• You want a monthly check that takes ten minutes and tells you when to act.

Last updated: 22 October 2026. Written by the ChargeFix team. Reviewed against sources on 22 October 2026. General information, not legal or financial advice.

Disclosure. ChargeFix helps merchants respond to Shopify Payments disputes, so I have an interest in dispute rates being managed. I did not read Visa's or Mastercard's own rulebooks, which are not public in full. Everything below comes from third-party summaries of those rules, and I flag where they disagree. Treat the numbers as a guide and confirm them with Shopify or your acquirer.

The 30-second answer (TL;DR)

• VAMP's ratio is card-not-present fraud reports plus non-fraud disputes, divided by settled card-not-present transactions in the same month.
• Sources say a merchant is assessed only after it passes a minimum count of fraud and dispute cases in a month, 1,500 in Asia Pacific per one summary and 1,000 per another. Australia is not named in any source I read, but it sits in the Asia Pacific region.
• Sources give the "excessive" merchant threshold as 2.20% falling to 1.50% from 1 April 2026, but one summary says 1.5% from April 2025 and 0.9% from January 2026. They conflict.
• Mastercard ECM, per a third-party summary, needs at least 100 chargebacks in a month and a ratio over 1.5% in two months running.
• Your more immediate risk is Shopify's risk review. Shopify's reserve page names elevated chargeback activity as a factor in placing a reserve.

Do this today (10 minutes):

1. Count last month's disputes and fraud reports on card orders.
2. Count last month's settled card orders.
3. Divide the first number by the second. That is your approximate ratio, and the rest of this guide tells you how to read it.

Who is measured, and by what

Programme	Measured on	Who is assessed	Typical trigger (third-party summaries)
Visa VAMP	Fraud reports plus non-fraud disputes, over settled card-not-present transactions	Acquirers and merchants	Merchant ratio above the excessive threshold, with a minimum case count
Mastercard ECM	Chargebacks in the month over transactions in the previous month	Merchants, via acquirers	100 or more chargebacks and a ratio above 1.5% for two months
Shopify's own risk review	Whatever Shopify decides, including chargeback activity	Shopify Payments merchants	Elevated chargeback activity, rising refunds and other factors

What is VAMP, and how is the ratio worked out?

VAMP stands for Visa Acquirer Monitoring Program. ACI and Decta, two third-party summaries, give one formula: take card-not-present fraud reports and add non-fraud disputes, then divide by all settled card-not-present transactions for the same month. In Visa's technical language the numerator uses the TC40 (fraud) and TC15 (dispute) records and the denominator uses TC05 (settled sales), though a merchant never sees those codes.

Here is a worked example, with made-up numbers. An Australian store settles 6,000 card-not-present orders in a month. It receives 30 fraud reports and 36 non-fraud disputes.

Item	Count
Fraud reports	30
Non-fraud disputes	36
Total	66
Settled card-not-present transactions	6,000
VAMP-style ratio	66 divided by 6,000 = 1.10%

At 1.10% the store is under a 1.5% line but over the old 0.9% figure one source mentions. That is why the conflicting thresholds matter, and why I explain them below.

One note on the numerator: it counts fraud reports as well as disputes, so a fraud report that never became a chargeback can still count. The Acquired FAQ adds that disputes resolved through Verifi's Rapid Dispute Resolution are excluded and that non-fraud disputes with reason codes 11, 12 and 13 are counted. Your Shopify admin does not show fraud reports separately in the way Visa counts them, so your own ratio will be an estimate.

What are the VAMP thresholds, and why do sources disagree?

On VAMP they do disagree, and that is worth saying plainly. These are the figures each source gives.

Source (third party)	Merchant "excessive" threshold	Minimum volume before assessment	Notes
ACI	2.20% falling to 1.50% from 1 April 2026 for Asia Pacific, Canada, EU and US merchants	At least 1,500 fraud and dispute cases a month in those regions	Acquirer thresholds 0.5% above standard and 0.7% excessive
Decta	2.20% falling to 1.50% from 1 April 2026 for the EU and Asia Pacific	1,500 in many regions, merchants with fewer than 5 cases excluded	Says there are "some country-specific variations" and does not name Australia
Acquired FAQ	1.5% from April 2025, tightening to 0.9% from January 2026	Minimum of 1,000 fraud and non-fraud cases a month	Fines charged to acquirers, who may pass them on
SecurityBrief Australia	2.2% (a US$8 fee per dispute above it), dropping to 1.5% from April 2026	Not stated	Also describes an enumeration-attack threshold of over 20% of transactions

Two of these agree on 2.20% falling to 1.50% in April 2026 for Asia Pacific merchants. One gives a lower and different schedule. I cannot tell you which is right for an Australian merchant through Shopify Payments, because I did not read Visa's own documents, and none of the four names Australia in its merchant thresholds.

The sensible reading, if you want a rule of thumb, is to treat 1.5% as the line that matters from April 2026 and to aim well below it. If the stricter 0.9% figure turns out to apply to you, being well below 1.5% still gives you room. Ask Shopify support which threshold applies to your account.

The minimum volume matters more than the percentage for small stores. A floor of 1,000 to 1,500 fraud and dispute cases a month means a business has to be very large before the percentage is applied. A store with 14 disputes is orders of magnitude below it.

What is Mastercard's Excessive Chargeback Program?

Mastercard's programme is separate and works on chargebacks. Chargeback Gurus, a third party, describes it as follows, and I did not read Mastercard's own rules.

Level	Trigger	Ratio basis
ECM (Excessive Chargeback Merchant)	At least 100 chargebacks in one month, with a ratio above 1.5% in each of two consecutive months	Chargebacks received in one month divided by transactions processed in the preceding month
HECM (High Excessive Chargeback Merchant)	At least 300 chargebacks in one month, with a ratio of 3% or more	Same basis

The same summary says fines escalate with months in the programme, from nothing in the first month to US$1,000 in the second, then rising in steps, with a US$100 reporting fee, and that a merchant exits by staying below the threshold for three consecutive months. It also says the programme is enforced globally with no regional exceptions described, and that acquirers often end the merchant relationship long before the highest fines.

The count floor of 100 chargebacks is again far above what most small stores see. A store with 14 chargebacks on 1,100 orders has a ratio of 1.27%, close to the percentage line, but nowhere near the 100-chargeback floor.

Note the different denominators. VAMP divides by sales in the same month and includes fraud reports. Mastercard divides by sales in the preceding month and counts chargebacks only. The same store can have two different ratios.

Which programme actually affects a small Australian Shopify store?

For most small stores, the answer is neither directly. Visa and Mastercard act on acquirers and large merchants. As a Shopify Payments merchant, you do not contract with the card networks. Shopify is the one in the chain between you and them, and what it does to your account is Shopify's decision.

What Shopify says it can do, in its own help pages, is place a reserve. Its reserve page describes a reserve as a temporary hold on a portion, in some cases a full amount, of your transactions, and lists the factors it considers in a risk assessment: extended billing cycles, elevated chargeback activity, a rising refund rate, long delivery timelines such as custom orders and pre-orders, and sudden sales surges. The terms are emailed, there is an example of a 10% reserve held for 120 days, and some reserves can be appealed by replying to the email.

Risk	Likely source	What it does to you
Card network programme fine	Visa or Mastercard, via the acquirer	Mostly large merchants; I could not verify how Shopify passes anything on
Shopify reserve	Shopify's risk review	Holds part of your payouts for a period
Account review or restriction	Shopify	I did not find the details in the pages I read
Issuer behaviour	The customer's bank	Can decline cards more often if risk looks high

What I could not find is how Shopify applies card-network rules to individual merchants, or what dispute rate triggers a reserve. The pages I read do not give a number. That is another reason to keep your own ratio low and to read any email from Shopify about your account promptly.

What dispute ratio is safe for an Australian Shopify store?

There is no single safe number, because Shopify has not published one that I could find and the network programmes differ. As a working guide, use three bands on your own monthly ratio.

Your monthly ratio (disputes and fraud reports over card orders)	Reading	What to do
Below 0.5%	Comfortable	Keep your routine and audit quarterly
0.5% to 1.0%	Watch	Look for the reason with the most disputes and fix it
1.0% to 1.5%	Elevated	Act now; review Shopify emails and your largest reasons
Above 1.5%	High	Treat as urgent; contact Shopify support and cut disputes fast

These bands are my own practical guide, not a published standard. They exist so that you have a line to act at before any programme's line is reached.

The A$25 fee also matters. On Shopify Payments in Australia, each dispute costs the amount plus a A$25 fee, returned only on a win. At 14 disputes a month that fee alone is A$350 before any lost sales.

How do you lower your ratio?

Ratios fall when disputes fall, and disputes fall when customers understand the charge and can reach you. Four levers do most of the work.

Lever	What to change	Effect on the ratio
Clear emails	Order confirmation with your trading name, delivery date and contact route	Fewer "I don't recognise this" disputes
Tracked, signed delivery	Signature or photo proof on higher-value parcels	Fewer "not received" disputes that you lose
Fast refunds	Refund legitimate requests quickly	Fewer customers going to their bank
Fraud screening	Review risky orders before shipping	Fewer genuine fraud reports

One thing to know about winning: a dispute you win still counts in the numerator if it was a fraud report or an opened dispute, as far as the summaries show. Winning protects your money and fee. It does not necessarily lower your ratio. Only the Verifi Rapid Dispute Resolution exclusion the Acquired FAQ mentions removes some disputes from the count, and I could not confirm whether it is available through Shopify Payments. So prevention matters more for the ratio than representment does.

Our guides to calculating your chargeback rate and thresholds and to what to do on a Shopify rate warning cover this in more detail.

What about enumeration attacks?

SecurityBrief Australia describes a separate VAMP element for enumeration attacks, where criminals test stolen card details with many low-value transactions. It says a merchant is caught by the programme if more than 20% of its transactions are identified as enumeration attacks, regardless of value. This is not the same as ordinary disputes, and I could not verify how it applies on Shopify Payments.

If you see many small orders of a few dollars, from many different cards, failing and succeeding in bursts, you may be a target. Signs include a flood of low-value orders for your cheapest product, many declined payments, new accounts with throwaway emails, and customers who dispute tiny charges. Report it to Shopify support, and consider limiting checkout to logged-in customers or adding a minimum order value as a short-term step. I have not tested any particular defence, so ask Shopify what controls are available for your plan.

What should you ask Shopify support about VAMP and your ratio?

Because the thresholds are unclear and Shopify sits between you and the networks, ask Shopify directly. Send this from the account email, keep the reply, and put the date in your log.

Subject: Dispute ratio, VAMP and reserves: questions for my Australian store

Hello,

I run an Australian store on Shopify Payments. Please could you confirm in writing:

1. Whether Visa's VAMP and Mastercard's Excessive Chargeback Program apply to my account, and which thresholds Shopify applies to merchants in Australia.
2. How Shopify counts disputes and fraud reports against my account, and whether disputes resolved through Verifi Rapid Dispute Resolution are excluded.
3. Whether Shopify shows me a dispute ratio anywhere in my admin, and how often it is updated.
4. What dispute ratio or count would lead Shopify to review my account or apply a reserve.
5. How I will be notified, and how long I have to respond.
6. Whether any card network fines or fees are passed on to merchants on Shopify Payments.

Thank you,
[Your name]
[Store URL]

You may get a general answer. Even so, the reply tells you whether Shopify acts on a ratio, a count or a judgement, and it gives you something to point to if a reserve email arrives later.

How can a ratio drift during a sale period?

A ratio is a snapshot of one month, and it can swing when orders spike. Disputes arrive weeks after the sale, so the month with the most orders often has the best ratio and the following months look worse. Here is a made-up store across the sale season.

Month	Card orders	Disputes and fraud reports	Ratio
October	2,000	14	0.70%
November (sale)	5,000	20	0.40%
December (Boxing Day)	6,500	55	0.85%
January	2,200	52	2.36%

January looks alarming, but the disputes are from December's sales while the orders have fallen back to normal. This is the pattern to expect after any large sale period, and it is why the monthly check pairs the ratio with the count and the reason. If you run a big sale, plan for the disputes that arrive in the quarter after it. A VAMP-style ratio is the number to watch, and the count floor still protects a store this size, but Shopify's risk review looks at activity, not at a threshold in a document.

Two protections help in that quarter. Keep your response routine ready, with deadlines in your calendar, and keep some cash aside, because the disputed amount and fee leave your balance at once. Our guide on chargeback automation in Australia shows how to handle volume without losing control.

What do the VAMP changes mean if you sell internationally?

If you sell to customers outside Australia, your sales are still card-not-present sales, and they count in the same ratio. A source such as ACI says the VAMP ratio applies across regions with differing minimum volumes, and Decta says there are country-specific variations. I could not verify how Shopify Payments treats cross-border orders in the ratio, so the safe approach is to keep your overall ratio low and to check the ratio by destination country in your own log.

Cross-border orders often have weaker delivery proof and higher fraud rates, which pushes the numerator up. If one destination produces many disputes, consider tracked and signed shipping, a minimum order value or pausing that destination until you have fixed the cause. The log in this guide gives you the data to apply the calculation.

What is a monthly check that takes ten minutes?

Put this in your calendar for the first Friday of each month. Copy it into a sheet and fill it in, and keep twelve months of rows so you can see a trend and show it to Shopify or an adviser if asked.

Month: [x]
Settled card orders: [n]
Disputes opened: [n]
Fraud reports (if you can see them): [n]
Ratio: (disputes + fraud reports) / card orders = [x]%
Largest reason: [reason], [n] cases
Dispute fees paid and not returned: A$[x]
Shopify emails about my account this month: [none / summary]
Action for next month: [x]

Here is a dated plan to start, beginning Monday 26 October 2026.

Date	Task	Time
Mon 26 Oct	Count last month's card orders, disputes and fraud reports	20 minutes
Tue 27 Oct	Work out the ratio and place it in a band above	10 minutes
Wed 28 Oct	List disputes by reason and pick the largest	20 minutes
Fri 30 Oct	Check your Shopify inbox for any reserve or risk emails	10 minutes
Mon 2 Nov	Fix the biggest cause: emails, tracking or screening	60 minutes
Fri 6 Nov	Set the monthly check in your calendar	5 minutes
Mon 30 Nov	Calculate November's ratio and compare	20 minutes
Fri 4 Dec	Prepare for Boxing Day and January sale volumes	30 minutes

What does this look like for three Australian stores?

These stores are made up to show how the numbers play out.

Eucalyptus Candles. 1,100 orders a month, 14 disputes and 3 fraud reports. The ratio is 17 divided by 1,100, or 1.55%. That is above the 1.5% line, though far below any count floor. This store is not a candidate for a network fine, but it is a candidate for a Shopify reserve review. The right response is to find why 14 customers disputed, for example an unclear descriptor, and fix it.

Harbour Tech. 9,000 orders, 80 disputes and 40 fraud reports. The ratio is 120 divided by 9,000, or 1.33%. Still under 1.5% but over the 0.9% figure from one source. The store should aim for below 0.9% to be safe, and should look closely at its 40 fraud reports, which suggest a screening gap.

Little Wattle. 250 orders, 2 disputes. The ratio is 0.8%. A tiny count means one more dispute moves the percentage a lot, so watch the count and the reason, not just the percentage.

What is different for Australian merchants?

• Region. Australia is part of Asia Pacific in the summaries I read, but none of them lists Australia by name for merchants, so confirm with Shopify.
• Fee. Shopify's Australian dispute fee is A$25, returned only on a win.
• Shopify Payments. You deal with Shopify, not the card networks, so a network programme reaches you through Shopify's own rules.
• Reserves. Shopify's reserve page lists elevated chargeback activity as a risk factor.
• Carriers. Australia Post, StarTrack, Sendle and Couriers Please proof differs, and weak proof of delivery raises your "not received" disputes that you lose.
• Shopify Protect. It is for US stores only, so there is no free guarantee to lean on.

What I could not verify: Visa's and Mastercard's official thresholds for Australia, how Shopify applies network programmes to individual merchants, what dispute rate triggers a Shopify reserve, and whether Rapid Dispute Resolution is available to you. Ask Shopify support, and treat third-party summaries as a guide only.

What are the common mistakes with dispute ratios?

1. Panicking at a headline. Check the count floor and your own numbers first.
2. Using one source's threshold as fact. The sources conflict, so aim well below all of them.
3. Ignoring Shopify's risk review. A reserve can bite long before a network fine.
4. Counting only chargebacks. VAMP also counts fraud reports.
5. Assuming a win lowers the ratio. Prevention does that.
6. Not tracking the ratio monthly. A ten-minute check catches drift.
7. Ignoring small counts. With few orders, one dispute moves the percentage a lot.
8. Missing enumeration signs. Bursts of tiny orders are a warning.
9. Skipping Shopify emails. Reserve and risk notices have response windows.
10. Treating this guide as official. Confirm the figures with Shopify or your acquirer.

Frequently asked questions

What is VAMP?

VAMP is Visa's Acquirer Monitoring Program. It measures card-not-present fraud reports and non-fraud disputes as a share of settled card-not-present transactions in a month. Third-party summaries say it applies to acquirers and merchants, with thresholds that tightened over 2025 and 2026 and a minimum case count before a merchant is assessed.

Does VAMP apply to Australian Shopify merchants?

Australia is part of Visa's Asia Pacific region, and summaries describe Asia Pacific merchants being assessed above a minimum case count. None of the sources I read names Australia in its merchant thresholds, and Shopify sits between you and the networks. Ask Shopify support how the programme applies to your account.

What is the VAMP threshold for merchants?

Sources conflict. ACI and Decta give 2.20% falling to 1.50% from 1 April 2026 for Asia Pacific merchants. The Acquired FAQ gives 1.5% from April 2025 and 0.9% from January 2026. I could not read Visa's own rules, so aim well below 0.9% to stay safe whichever applies.

What is Mastercard's Excessive Chargeback Program?

A Mastercard programme that, per a third-party summary, flags merchants with at least 100 chargebacks in a month and a ratio above 1.5% across two consecutive months. A higher tier applies at 300 chargebacks and 3%. Fines escalate with months in the programme. I did not read Mastercard's own rules.

Can a small store be fined by Visa or Mastercard?

Directly, it is unlikely, because the programmes have count floors in the hundreds or thousands of cases and act on acquirers. The more realistic risk is Shopify's own risk review, which can place a reserve on your payouts when chargeback activity is elevated. Check any Shopify email about your account promptly.

What dispute rate triggers a Shopify reserve?

Shopify's reserve page does not give a number. It lists factors such as elevated chargeback activity, a rising refund rate, long delivery timelines and sudden sales surges. Keep your ratio low, read Shopify's emails and reply within the stated window if a reserve is applied, since some can be appealed.

How do I calculate my VAMP-style ratio?

Add your disputes and fraud reports on card orders for the month, then divide by your settled card orders for the same month. For example, 66 divided by 6,000 is 1.10%. Your Shopify admin may not show fraud reports as Visa counts them, so treat your result as an estimate.

Does winning a dispute lower my ratio?

Not necessarily. A dispute you win still counts if it was opened, as far as the summaries show, though Verifi's Rapid Dispute Resolution cases are said to be excluded. Winning protects your money and the A$25 fee. Preventing disputes in the first place does more for your ratio.

What is an enumeration attack?

It is when criminals test stolen card details with many low-value transactions. SecurityBrief Australia says VAMP catches merchants when more than 20% of transactions are identified as enumeration attacks. If you see bursts of tiny orders from many cards, contact Shopify support and consider a minimum order value as a short-term step.

How do I lower my chargeback ratio?

Reduce disputes at the source: clear order emails with your trading name, tracked and signed delivery on higher-value parcels, fast refunds, and review of risky orders before shipping. Then track the ratio monthly. These steps lower the numerator, which responding to disputes does not.

Start free trial with ChargeFix

Disputes you win do not lower your VAMP ratio, but they do save the money and the fee. ChargeFix gathers the real order, payment-check and delivery records for each Shopify Payments dispute, scores the evidence and drafts the response from your own data, never inventing facts, with manual review as the default. Start free trial

Sources

• What you need to know about Visa's new Acquirer Monitoring Program (VAMP), ACI Worldwide
• What is VAMP (Visa Acquirer Monitoring Programme)?, Decta
• VAMP Frequently Asked Questions, Acquired.com
• Visa's VAMP sets stricter thresholds for fraud disputes, SecurityBrief Australia
• Understanding the Mastercard Excessive Chargeback Program, Chargeback Gurus
• Overview of reserves in Shopify Payments, Shopify Help Center
• ChargeFix support page