Visa VAMP 2026: What Every Shopify Merchant Must Know Before April

If you sell on Shopify and accept Visa, there is a number you need to know: 1.5%. That is the new Visa Acquirer Monitoring Program (VAMP) threshold taking effect in April 2026, and crossing it can get your Shopify Payments account suspended --- or terminated entirely.

Chargebacks cost merchants an estimated $33.79 billion globally in 2024, and Visa is done waiting for the industry to fix itself. The VAMP program is their answer: a single, unified metric that replaces the old Visa Dispute Monitoring Program (VDMP) and Visa Fraud Monitoring Program (VFMP). It is simpler, stricter, and already in effect.

This guide covers exactly what VAMP is, how it affects your Shopify store, and the concrete steps you can take before the April enforcement date.

What Is Visa VAMP?

VAMP stands for Visa Acquirer Monitoring Program. It is Visa’s consolidated framework for monitoring fraud and dispute activity across payment processors (acquirers) and the merchants they serve.

Before VAMP, Visa ran two separate programs:

VDMP (Visa Dispute Monitoring Program) --- tracked chargeback ratios
VFMP (Visa Fraud Monitoring Program) --- tracked fraud ratios via TC40 reports

Starting October 2025, Visa merged both into a single program with a single ratio. The logic is straightforward: instead of tracking chargebacks and fraud separately, VAMP combines them into one metric that captures the full picture of dispute activity.

For Shopify merchants, VAMP matters because Shopify Payments is itself an acquirer. When your store’s dispute activity pushes Shopify’s aggregate VAMP numbers up, Shopify has every incentive to shut you down before you become a liability.

Timeline: What Changed and When

The VAMP rollout happened in three phases. If you are reading this in March 2026, you are in the final window before full enforcement.

Phase 1: October 2025 --- Program Launch

Visa officially replaced VDMP and VFMP with VAMP. The initial VAMP ratio threshold was set at 1.5% for acquirers. During this phase, Visa focused on monitoring and education. Merchants exceeding the threshold received warnings but faced limited enforcement.

Key change: the new combined formula (TC40 + chargebacks) went live. Merchants who had been tracking only their chargeback ratio suddenly discovered their real dispute exposure was higher than they thought.

Phase 2: January 2026 --- Enumeration Controls

Visa introduced stricter enumeration (card testing) controls under VAMP. Acquirers became responsible for detecting and blocking card testing attacks at the transaction level. The $8 per-dispute fee for CNP (card-not-present) transactions also took full effect.

This phase hit Shopify merchants hard. Card testing attacks --- where bots validate thousands of stolen card numbers against your checkout --- generate TC40 fraud reports even when no chargeback occurs. Under the old system, these might fly under the radar. Under VAMP, they count against your ratio.

If you have been seeing mysterious small-dollar authorizations on your store, read our card testing guide for immediate steps.

Phase 3: April 2026 --- Full Enforcement

This is where we are now. Starting April 2026:

The 1.5% VAMP ratio threshold is enforced with financial penalties
Acquirers (including Shopify Payments) face escalating fines for non-compliance
Merchants exceeding thresholds face account reviews, fund holds, and termination
The per-dispute CNP fee of $8 applies to every fraud report and chargeback above the threshold
Visa can mandate that acquirers offboard specific merchants

The grace period is over. If your VAMP ratio is above 1.5%, you are operating on borrowed time.

How the VAMP Ratio Is Calculated

The VAMP ratio replaces the old chargeback-only calculation with a broader formula. Here is how it works:

VAMP Ratio = (TC40 Fraud Reports + Chargebacks) / Total Visa Transactions x 100

Let’s break down each component:

TC40 Fraud Reports: When a cardholder’s bank identifies a transaction as fraudulent, it files a TC40 report with Visa. This happens regardless of whether the cardholder files a chargeback. Card testing attacks, stolen card purchases, and friendly fraud all generate TC40s.
TC15 (Issuer) Reports: In some documentation, Visa references TC15 as the issuer-side counterpart. For practical purposes, TC40 is what matters on the acquirer/merchant side.
Chargebacks: Standard Visa disputes initiated by cardholders.
Total Visa Transactions: Your total count of Visa transactions in the monitoring period.

Example Calculation

Suppose your Shopify store processes 10,000 Visa transactions in a month:

You receive 80 TC40 fraud reports (some from card testing, some from actual fraud)
You receive 50 chargebacks

VAMP Ratio = (80 + 50) / 10,000 x 100 = 1.3%

In this example, you are below the 1.5% threshold --- but barely. One bad week of card testing could push you over.

Now consider a store doing 2,000 Visa transactions per month:

15 TC40 fraud reports
18 chargebacks

VAMP Ratio = (15 + 18) / 2,000 x 100 = 1.65%

This store is already in violation. And because smaller stores have lower transaction volumes, even a handful of disputes can spike the ratio dramatically.

The Critical Detail Most Merchants Miss

Under the old VDMP system, only chargebacks counted. A store with 50 chargebacks out of 10,000 transactions had a 0.5% ratio --- well under the old 0.9% threshold.

Under VAMP, those same 50 chargebacks plus 80 TC40 reports push the ratio to 1.3%. TC40 fraud reports are the hidden variable that catches merchants off guard. You do not receive direct notification when a TC40 is filed against your store. You only see the impact when it is too late.

What Happens When You Exceed the VAMP Threshold

Exceeding 1.5% triggers a cascade of consequences:

Notification: Visa flags your acquirer (Shopify Payments). Shopify’s risk team reviews your account.
Financial penalties: The $8 per CNP dispute fee applies to each TC40 and chargeback above the threshold. At 200 excess disputes, that is $1,600/month in fees alone.
Remediation mandate: You are required to submit a fraud remediation plan. Visa expects measurable improvement within 3—6 months.
Escalating fines: If the ratio does not improve, Visa imposes escalating fines on the acquirer --- which get passed to you.
Account termination: Persistent non-compliance leads to mandatory merchant offboarding. Your acquirer is required by Visa to drop you.
MATCH list: In severe cases, you may be placed on the Member Alert to Control High-risk Merchants (MATCH) list, making it extremely difficult to get a new payment processor.

The financial math is punishing. A mid-size store processing 5,000 Visa transactions monthly with a 2.0% VAMP ratio has roughly 100 disputes. If the threshold is 75 disputes (1.5% of 5,000), the 25 excess disputes cost $200/month in per-dispute fees on top of the chargeback losses themselves.

How Shopify Payments Is Affected

This is where VAMP gets personal for Shopify merchants. Shopify Payments is not just a payment gateway --- it is an acquirer. That means Visa holds Shopify directly responsible for the aggregate dispute activity of every merchant on the platform.

What Shopify Does When You’re Flagged

Shopify’s risk team monitors VAMP metrics across all merchants. When your store approaches or exceeds thresholds, Shopify takes action:

Payment holds: Shopify may hold a percentage of your payouts (typically 10—30%) as a reserve against future disputes.
Rolling reserves: New funds are held for 90—120 days before release.
Account suspension: Your Shopify Payments account is frozen. You cannot process new transactions until the issue is resolved.
Permanent termination: Shopify terminates your Payments account. You must find an alternative payment processor --- and your MATCH listing may make that difficult.
Store-level impact: In extreme cases, Shopify may suspend your entire store, not just Payments.

The Shopify Payments Suspension Trap

Here is the scenario that catches merchants off guard: your store gets hit by a card testing attack over a weekend. Bots run 500 stolen card numbers against your checkout. Even though most are declined, the ones that go through generate TC40 reports. Your VAMP ratio spikes. By Monday, your Shopify Payments account is under review.

You did nothing wrong. Your products are legitimate. Your real customers are happy. But Visa does not distinguish between merchant negligence and merchant victimization. The ratio is the ratio.

This is why proactive fraud prevention --- blocking attacks before they generate disputes --- is the only reliable defense.

Who Is Most at Risk

Not all Shopify stores face equal VAMP exposure. Certain business models and categories carry higher inherent risk:

Digital Goods and Downloads

Digital products have no shipping address to verify, no delivery confirmation, and instant fulfillment. Fraudsters prefer them because there is no physical evidence trail. If you sell digital downloads, courses, or software licenses, your TC40 rate is likely higher than you think.

Subscription Businesses

Recurring charges generate recurring disputes. A single fraudulent signup can produce months of TC40 reports before the subscription is cancelled. The compounding effect on your VAMP ratio is significant.

Cross-Border / International Sales

International transactions have higher fraud rates and higher dispute rates. Currency confusion, longer shipping times, and language barriers all increase the likelihood of chargebacks. Merchants selling from the US/EU to other regions should monitor their VAMP ratio by geography.

Low-Volume Stores

As shown in the calculation examples above, low-volume stores are mathematically more vulnerable. Ten disputes out of 500 transactions is a 2.0% ratio. The same ten disputes out of 5,000 transactions is only 0.2%. If you process fewer than 1,000 Visa transactions per month, a single card testing attack can put you over the threshold.

High-AOV (Average Order Value) Stores

Higher-value orders attract more sophisticated fraud. A $500 fraudulent order generates the same single TC40 as a $5 order, but the financial loss and likelihood of a chargeback are both much higher.

5 Steps to Protect Your Shopify Store

Here are five concrete actions you can take right now to reduce your VAMP exposure.

1. Know Your Current Ratio

You cannot fix what you cannot measure. Calculate your current VAMP ratio using the formula above.

Where to find the data:

Chargebacks: Shopify Admin > Analytics > Fraud reports, or your chargeback notification emails.
TC40 reports: These are harder to access directly. Your payment processor may surface them. If you use Shopify Payments, contact Shopify support and ask for your TC40 volume.
Transaction count: Shopify Admin > Analytics > filter by Visa transactions.

If you cannot get exact TC40 data, estimate conservatively. A common rule of thumb: your TC40 volume is 2—4x your chargeback volume for CNP merchants.

2. Block Card Testing at the Storefront Level

Card testing is the single biggest preventable source of TC40 reports. Bots validate stolen cards by running small transactions against your checkout. Each successful validation generates a fraud report.

Effective card testing prevention requires blocking at the storefront level --- before the bot even reaches checkout:

Implement device fingerprinting to identify automated traffic
Rate-limit checkout attempts by IP address and device
Use behavioral analysis to distinguish human shoppers from bots
Deploy honeypot fields that bots fill in but humans skip

ShieldFlow provides all four of these layers as a Shopify app, blocking card testing bots before they can generate fraud reports against your store.

3. Tighten Your Fraud Filters

Review your Shopify Fraud Analysis settings and any third-party fraud tools:

AVS (Address Verification): Decline transactions where the billing address does not match the card. At minimum, require a zip code match.
CVV verification: Always require CVV. Never process transactions without it.
3D Secure: Enable 3DS for high-risk transactions. Liability shifts to the issuer for 3DS-authenticated transactions, and these are excluded from VAMP calculations.
Velocity checks: Flag multiple orders from the same IP, email, or device within a short window.

4. Respond to Chargebacks Aggressively

Every chargeback you win is removed from your VAMP ratio. Do not ignore dispute notifications:

Respond within 24 hours, not the 30-day deadline
Include compelling evidence: shipping confirmation, delivery photos, customer communication logs, IP/device data
Use Shopify’s chargeback response tools or a service like Chargeflow for automation
Track your win rate --- aim for 40%+ on non-fraud disputes

5. Monitor Weekly, Not Monthly

VAMP ratios are calculated on rolling windows. A monthly review cadence means you are always 2—4 weeks behind the actual data. Shift to weekly monitoring:

Set calendar reminders every Monday to check dispute volume
Create alerts for sudden spikes in declined transactions (a leading indicator of card testing)
Track your ratio trend over time --- a rising trend is a warning even if you are still below 1.5%

How ShieldFlow Monitors Your VAMP Ratio

ShieldFlow was built specifically for the VAMP era. Here is how it helps Shopify merchants stay below the threshold:

Pre-checkout blocking: ShieldFlow’s storefront fingerprinting and checkout guard block fraudulent sessions before they can complete a transaction. No completed fraud means no TC40 report and no chargeback. This is the most effective way to reduce your VAMP ratio because it prevents disputes from being created in the first place.

Real-time VAMP dashboard: ShieldFlow tracks your estimated VAMP ratio in real time, combining your chargeback data with estimated TC40 volume based on blocked fraud attempts. You see your ratio trend daily, not monthly.

Card testing detection: ShieldFlow’s behavioral analysis layer identifies card testing bots at the storefront level --- before they reach your checkout. This is the single highest-impact action for VAMP ratio reduction, since card testing generates the majority of TC40 reports for most Shopify stores.

Automated alerts: When your estimated VAMP ratio approaches 1.0% (well below the 1.5% threshold), ShieldFlow sends you an alert so you can take action before Visa or Shopify flags your account.

Frequently Asked Questions

What is the difference between VAMP and the old VDMP program?

VDMP only tracked chargebacks. VAMP combines chargebacks and TC40 fraud reports into a single ratio. This means your VAMP ratio is almost always higher than your old VDMP ratio was, because TC40 reports --- which you may never have tracked --- now count against you. VAMP also shifts more accountability to acquirers (like Shopify Payments), which in turn increases pressure on individual merchants.

How do I check my VAMP ratio on Shopify?

Shopify does not currently display your VAMP ratio directly in the admin dashboard. You can calculate it manually by dividing your total disputes (chargebacks + estimated TC40 reports) by your total Visa transaction count. For TC40 data, contact Shopify Payments support or use a fraud prevention tool like ShieldFlow that estimates your ratio automatically.

Does 3D Secure (3DS) help with VAMP?

Yes. Transactions authenticated via 3D Secure are excluded from VAMP calculations because liability shifts to the card issuer. Enabling 3DS for high-risk transactions is one of the most effective ways to reduce your VAMP ratio. The tradeoff is a slight increase in checkout friction, which may reduce conversion rates by 1—3% depending on your market.

What is the $8 CNP dispute fee?

Visa charges an $8 fee per card-not-present (CNP) dispute that exceeds the VAMP threshold. This fee applies to both TC40 fraud reports and chargebacks. It is separate from the chargeback fee your payment processor charges. For a merchant with 50 excess disputes per month, this adds $400/month in Visa fees alone --- on top of the lost revenue and processor fees.

Can I get removed from VAMP monitoring once I’m flagged?

Yes, but it requires sustained improvement. You must bring your VAMP ratio below the threshold and maintain it there for a consecutive monitoring period (typically 3 months). During remediation, you are expected to submit a fraud prevention plan and demonstrate measurable progress. Working with a fraud prevention solution and responding to chargebacks aggressively are the fastest paths to getting out of the program.

What happens if Shopify Payments terminates my account?

If Shopify Payments terminates your account due to VAMP violations, you will need to find an alternative payment processor. Options include Stripe (direct integration via Shopify’s third-party payment providers), Authorize.net, or specialized high-risk processors. Be aware that if you are placed on the MATCH list, most mainstream processors will decline your application. Prevention is significantly cheaper than remediation.

Are Mastercard and Amex implementing similar programs?

Mastercard has its own monitoring program (Excessive Chargeback Merchant program) with similar thresholds. Amex has less formal monitoring but does terminate merchants with high dispute rates. VAMP is the most aggressive of the card network programs, and because Visa represents the largest share of card transactions, it has the most impact on Shopify merchants.

The Bottom Line

Visa VAMP is not a theoretical risk. It is live, it is being enforced, and the April 2026 threshold of 1.5% is the strictest monitoring standard Visa has ever applied to CNP merchants.

The merchants who will survive VAMP are the ones who treat fraud prevention as infrastructure, not an afterthought. That means blocking attacks at the storefront level, monitoring your ratio weekly, and responding to every dispute.

If you are running a Shopify store and you have not calculated your VAMP ratio yet, do it today. The math takes five minutes. The consequences of ignoring it can take months to recover from.

Need help protecting your Shopify store from VAMP violations? ShieldFlow blocks card testing and fake checkouts before they generate disputes --- keeping your VAMP ratio safe. Learn more.