Mastercard introduces new merchant monitoring rules: a full bill_line guide for business

Online payments market has grown consistently year on year — undeterred by shifts in political leadership, major geopolitical conflicts, or global pandemics. But sustained market growth inevitably brings a rise in threats. In the payments space, fraud activity sits at the top of that list. That is precisely why international payment systems continue to raise the bar on security standards, acting ahead of the curve rather than in response to it. As part of this effort, updated Mastercard standards for merchant monitoring rules aimed to the potentially fraud merchants that will be fully operational by 24 July 2026. In short, this is a structural change in how the international payment network distributes responsibility between acquirers and merchants. bill_line team is online – and if you sell online or work as PSP that processes payments, this article is for you.

What’s changing

Previously, Mastercard operated with a set of recommendations for acquirers dealing with suspicious merchants. The new Merchant Monitoring Program (MMP) standards replace those recommendations with concrete, mandatory requirements – complete with defined criteria and strict timelines.

Mastercard’s emphasis is on speed of response. If a merchant meets the defined criteria for potential fraud, the acquirer or payment facilitator is required to initiate an investigation within 72 hours. Should the fraud be confirmed, authorisation and clearing operations for that merchant are blocked. The standards apply to all card-not-present merchants globally, with a small number of exceptions.

bill_line: key triggers to be aware of

The updated Mastercard guidelines cover a wide range of parameters that businesses should review when assessing their readiness. As a payment orchestration platform, bill_line handles updates of this nature on an ongoing basis – informing partners about outcomes rather than asking them to navigate the process by themselves. In complex integration scenarios, our support and dev teams work directly alongside partners to implement changes. Our priority is keeping our partners focused on uninterrupted, efficient operations.

So, to help set the context, here are the most common triggers for flagging suspicious activity that merchants encounter:

• A sharp drop in approval rates (for merchants or PSPs). If the authorisation rate falls by 50% or drops below 30% within a 72-hour window – with a minimum of 25 transactions – this constitutes an automatic trigger. Exceptions apply for system-level failures on the acquirer side and BIN attacks.
• Receipt of a GRIP letter from Mastercard. GRIP stands for Global Rules Investigation Program. This is Mastercard’s internal mechanism for investigating violations. Receiving such a letter indicates the network has already identified suspicious activity linked to a specific account.
• Being a new merchant or acquirer (under 6 months of operation). In this case, any one of the following conditions is sufficient to trigger a review: two issuers have recorded transactions flagged under Fraud Type 56 (Manipulation of Cardholder); two or more issuers have raised chargebacks with documentation citing manipulation; the combined refund and chargeback rate has exceeded 5% during any 30-day rolling period with a transaction volume of at least 500.
• Signals from Merchant Monitoring Service Providers. If an accredited provider identifies a merchant as potentially fraudulent, the 72-hour countdown begins automatically.

Why this affects more than just fraudsters

The new standards are aimed squarely at scam merchants – those who deliberately mislead buyers or conceal the true nature of their business. However, the metrics used to identify them are not exclusive to bad actors. How does that happen?

Any tightening of anti-fraud policy is, first and foremost, a response to increasingly sophisticated fraud schemes. It’s therefore important to recognise some of these metrics can be triggered by entirely legitimate businesses – particularly those that are new to the market or scaling rapidly into new territories.

Subscription-based models, free trial offers, and high-volume e-commerce naturally generate more disputes than traditional retail. Recurring transactions carry a lower approval rate due to errors accumulate across the customer lifecycle, like expired bank cards or insufficient funds. A sudden surge in transaction volume or a tech outage can temporarily push the approval rate below the threshold, triggering a review that has nothing to do with fraud and everything to do with the nature of the business model.

This is where chargebacks become a meaningful indicator: for new merchants, a combined refund and chargeback rate above 5% in a rolling month is already a warning signal. According to the Global State of Scams 2024 report, shopping scams are the most prevalent form of fraud, affecting 22% of respondents worldwide, with total losses from scams exceeding $1 trillion in a single year. In 2025, a similar research was conducted. According to it, 57% of adults globally encountered a scam in the past year. Shopping scams remain the most common type, affecting 54% of those who fell victim. Mastercard is shifting risk responsibility up the chain – and legitimate merchants find themselves in that zone alongside bad actors.

bill_line: what businesses should do before 24 July

First and foremost – understand your position within the monitoring framework. Determine whether your business falls under heightened scrutiny under the new standards. New merchants (under 6 months), subscription-based models, and high-volume e-commerce operations face the greatest risk of false-positive triggers. If your business is growing rapidly or has launched recently, tracking these metrics should already be a routine practice – not a protocol activated only when something goes wrong. The same rule goes for PSPs with that kind of merchants.

Secondly, tighten your control over chargebacks. A combined chargeback and refund rate above 5% in a rolling month – with a minimum of 500 transactions – is a direct trigger for investigation for new merchants. For established merchants, Mastercard’s Excessive Chargeback Program begins counting from 100 chargebacks per month at a rate of 1% or above. A significant share of these disputes can be prevented proactively: a clear billing descriptor, a straightforward cancellation flow, and a confirmation receipt after each billing event for subscription merchants are baseline requirements that Mastercard explicitly mandates.

Thirdly, build a transparent dispute workflow. If an investigation has already been initiated, 72 hours is a tight window. Your business needs to be ready to produce documentation on disputed transactions, confirmation of service delivery, and records of client communications. And do it quickly. All of this should be structured in advance, with clear processes for retrieving detailed information when needed.

Last but not least – speak with your payment partner about monitoring. Acquirers are required to monitor the Fraud and Loss Database on a daily basis. The updated MMP standards also require the involvement of accredited providers for BRAM monitoring and the detection of transaction laundering. If your provider cannot explain how they track these signals and what steps they take upon detection, it is worth finding out. This is firmly in your interest.

Industry context and what comes next

These changes aren’t an isolated Mastercard initiative. Almost a year ago, in April 2025, Visa launched its updated Acquirer Monitoring Program (VAMP). According to compliance industry assessments, taken together with the MMP updates, this represents one of the most significant shifts in payments compliance in recent years. Both networks are moving in the same direction: pushing risk responsibility to the point of entry – to acquirers and merchants.

For businesses with well-established dispute management processes, this is another regulatory update to absorb. For those who respond to issues post-factum, the adaptation window is narrowing. And if your business needs to move quickly – bill_line is ready to help.