--- title: "Mastercard SMMP 2026: What Subscription Merchants Must Know" description: "Mastercard's Scam Merchant Monitoring Program gives acquirers 72 hours to investigate flagged merchants. Here's how SaaS subscription businesses can prepare." url: https://www.corgilabs.ai/insights/mastercard-scam-merchant-monitoring published: 2026-10-17 --- # Mastercard SMMP 2026: What Subscription Merchants Must Know ## Your Acquirer Has 72 Hours to Decide If You're a Scammer A SaaS company processes 600 transactions a month on Stripe. After a rebrand, the billing descriptor on card statements changes and customers don't recognize the charge. Two issuers file chargebacks referencing "manipulation of cardholder." Within days, the acquirer receives a flag from Mastercard's Scam Merchant Monitoring Program. The company isn't a scammer. But it now has 72 hours before its acquirer must formally investigate. That scenario became real on July 24, 2026, when Mastercard's revised Scam Merchant Monitoring Program (SMMP) took effect globally (applicable worldwide except Jordan). If you run a subscription or SaaS business on Mastercard rails, this program changes how your acquirer evaluates your risk on a timeline that leaves almost no room for reaction. ## SMMP Is Not Another Chargeback Threshold Program If you're familiar with Mastercard's Excessive Chargeback Merchant (ECM) or Excessive Fraud Merchant (EFM) programs, set those mental models aside. ECM and EFM are ratio-based: breach a threshold, pay fines, get a remediation window. You have time to fix the problem. SMMP works differently. It's signal-driven and investigation-based. A merchant can have perfectly clean chargeback ratios and still face immediate processing termination if scam signals are confirmed. There are no fines, no grace period, no remediation window. As cside noted in their analysis, "a merchant can be perfectly clean under ECM rules, dispute ratios within acceptable limits, and still get flagged under SMMP if the pattern of activity looks like a scam operation." The distinction matters because it changes what you monitor and how fast you respond. Chargeback ratios are lagging indicators you can manage over months. SMMP triggers are real-time signals that compress your response window to days. ## The Four Triggers That Start the Clock SMMP defines four categories of signals. Any one of them starts a 72-hour investigation window for your acquirer. **1. Authorization rate collapse.** Your authorization approval rate drops by 50 or more percentage points within 72 hours, or falls below 30%. Both thresholds require a minimum of 25 purchase transactions. A routing misconfiguration during a flash sale could push you from 94% to 38% in two days, enough to trip the wire. **2. A Mastercard GRIP letter.** Mastercard's Global Risk and Intelligence Platform identifies your merchant ID as linked to suspected scam activity and notifies your acquirer directly. **3. New-merchant fraud signals.** This is the category that catches the most legitimate businesses. If you have fewer than six months of Mastercard processing history, three sub-triggers apply: - Two or more issuers file chargebacks with fraud reason code 56 ("Manipulation of Cardholder") - Multiple issuers submit chargebacks with scam-related documentation - Your combined refund and chargeback rate exceeds 5% over any rolling 30-day window (minimum 500 transactions) **4. An alert from a Merchant Monitoring Service Provider (MMSP).** Third-party monitoring services approved by Mastercard can flag merchants independently, triggering the same 72-hour clock. ## The 5% Combined Threshold: A Hidden Landmine for Subscription Businesses The third trigger category deserves its own section because it's where legitimate SaaS and subscription merchants are most vulnerable. Most payments teams track refunds and chargebacks as separate metrics. SMMP counts them together. That combined 5% threshold over a rolling 30-day window (for merchants processing at least 500 transactions in that period) is lower than it sounds for any business with recurring billing. Consider the math. You process 600 transactions a month. A product update confuses a segment of customers, and 15 request refunds while eight file chargebacks. That's 23 combined out of 600, or 3.8%. Add a seasonal bump in trial cancellations and you're at 5.2%. You haven't done anything wrong, but you've tripped a trigger designed to catch scam merchants. As Roenen Ben-Ami, co-founder and chief risk officer at Justt, noted in the firm's SMMP analysis: "Winning a chargeback at re-presentment does not reduce the count of chargebacks for SMMP, ECP, or EFM purposes. Once the chargeback is filed, it is counted in the ratio regardless of who eventually wins the dispute." Winning disputes doesn't erase the signal. The only effective strategy is keeping the combined number below the line in the first place. ## Why "New Merchant" Means More Than You Think The new-merchant fraud signals apply to any merchant with fewer than six months of Mastercard acceptance history. That sounds like it only affects startups. It doesn't. Your six-month clock resets when you: - Open a new acquiring relationship - Switch payment service providers - Expand into a new geographic region - Launch a new legal entity Expanding into Europe with a new entity? You're a new merchant in Mastercard's eyes, regardless of your three-year US processing history. The clock restarts with every PSP switch. Wyllo's analysis put it directly: "The signals correlate with growth, not just with fraud. A sudden spike in approval declines because an issuer recalibrated its model. A new product line that confuses customers. These are the textures of building a real business, and they look statistically similar to the textures of building a fake one." ## What Happens When It Goes Wrong: The MATCH List If an SMMP investigation confirms scam activity, Mastercard and Maestro processing terminates immediately. But the consequences extend far beyond losing one card network. A confirmed SMMP scam termination would typically qualify a merchant for placement on the MATCH (Member Alert to Control High-Risk Merchants) list. According to Chargebacks911, acquirers must add terminated merchants to MATCH within five days of termination. A MATCH entry stays on record for five years. That five-year mark matters. A MATCH listing makes securing any new processing relationship extraordinarily difficult. Many mainstream acquirers won't onboard a MATCH-listed merchant. The remaining options typically involve: - High-risk processors with elevated per-transaction fees - Reserve accounts holding 5-10% of processing volume - Long-term contracts with limited bargaining power For a SaaS business processing tens of millions in annual recurring revenue, losing mainstream processing access doesn't just increase costs. It threatens the viability of the billing model. ## The Acquirer Dynamic Has Changed SMMP doesn't just change what Mastercard watches. It changes how your acquirer thinks about you. Since January 2026, Mastercard requires acquirers to scan every new merchant's website before the first transaction processes. If a Merchant Monitoring Service Provider flags issues during that scan, the merchant gets a 15-day remediation window before processing can begin. More broadly, the revised standards push acquirers from reactive monitoring to proactive, near-real-time intervention. Equifax's analysis describes this as a fundamental shift in the acquirer obligation model. The practical consequence: acquirers now have every incentive to offboard merchants who look risky before an investigation lands. As Chargeflow put it, "Acquirers won't wait for an investigation to offboard a risky-looking merchant. Rather be the merchant no one needs to investigate." Your acquirer relationship is no longer just about rates and settlement timing. It's about demonstrating, proactively and continuously, that your transaction patterns don't trigger the signals Mastercard is watching. ## Mastercard's Upstream Intelligence: MSRI and Merchant Trust Services Mastercard isn't just tightening enforcement. It's building the intelligence layer to feed it. Announced May 19, 2026, Merchant Trust Services combines network intelligence, identity verification, and real-time analytics to help acquirers distinguish legitimate merchants from risky ones. The Merchant Scam & Risk Indicator (MSRI) provides issuers with merchant-level risk signals at the point of authorization. The pilot results are worth noting. In testing with a leading issuer, MSRI detected approximately 80% of risky merchants, with many flagged as early as 90 days before the issuer would have escalated on its own. MSRI launches first in Europe and the US, with global expansion planned within the year. While the exact data pipeline between MSRI and SMMP triggers isn't publicly documented, it's reasonable to expect that upstream MSRI signals will eventually inform SMMP investigations. For merchants, this means the detection window is getting shorter and the signal fidelity is improving. Being proactive about your own transaction hygiene matters more, not less, as Mastercard's intelligence capabilities expand. ## Your SMMP Preparedness Checklist The program is live. Here are six concrete steps to reduce your exposure. 1. **Track your combined refund and chargeback rate on a rolling 30-day basis.** Not separately, together. Set an internal alert at 3.5% to give yourself a buffer before the 5% trigger. 2. **Audit your billing descriptors.** Every descriptor that appears on a cardholder statement should clearly identify your company name, product, and a support URL or phone number. Test this by running a small charge on your own card and checking how it appears. Descriptor confusion is the single most preventable cause of "unrecognized charge" chargebacks. 3. **Brief your acquirer proactively.** If you're planning a PSP migration, geographic expansion, entity restructuring, or any change that resets your new-merchant clock, tell your acquirer before it happens. Provide context on expected transaction patterns, seasonal variability, and your fraud prevention stack. 4. **Instrument transaction-level evidence collection.** Capture device fingerprints, IP addresses, session recordings, and customer consent timestamps at the point of purchase. This evidence won't prevent a flag, but it dramatically improves your position during the 72-hour investigation window. 5. **Set up prevention alerts through Ethoca and Verifi.** These services notify you of chargebacks before they become formal, giving you the option to refund proactively and keep the chargeback off your combined ratio entirely. 6. **Document your legitimacy story.** Prepare a one-page brief that explains your business model, customer acquisition channels, typical transaction patterns, and fraud prevention measures. If your acquirer calls with a 72-hour clock ticking, you want to hand them a clear narrative, not scramble to assemble one. ## Proactive Monitoring Beats Network Surprises SMMP's signal-based approach creates a specific problem for subscription and SaaS merchants: the triggers watch for patterns that your business model naturally produces. Trial conversions, renewal failures, seasonal spikes, descriptor changes, and PSP migrations all generate signals that overlap with what Mastercard designed to catch scam operations. The gap between "looks suspicious to a network-level algorithm" and "is actually suspicious" is where merchant-level intelligence matters most. Generic fraud rules applied at the network or acquirer level can't distinguish between a billing descriptor change that confuses customers and a scam merchant cycling through identities. Corgi Model, trained on your specific transaction data, learns the difference between your normal patterns and genuinely anomalous activity. Corgi Intelligence surfaces the combined refund and chargeback metrics SMMP watches, giving you visibility into the same signals your acquirer sees, before they see them. When your acquirer's 72-hour clock never starts, you never have to worry about what happens when it runs out. ## Be the Merchant No One Needs to Investigate Global consumer scam losses reached $442 billion in 2025, according to the Global Anti-Scam Alliance. Mastercard's response, compressing investigation timelines and expanding signal detection, is proportionate to the scale of the problem. SMMP isn't going away. The intelligence feeding it will only get sharper. For SaaS and subscription businesses, the path forward is straightforward: monitor the metrics SMMP watches, maintain clean transaction hygiene, and build the evidence trail that makes investigation unnecessary. The merchants who prepare won't feel the weight of this program. The ones who don't will feel it in 72 hours or less. [Book a Demo →](https://www.corgilabs.ai/#book-demo) ## Sources 1. Solidgate: "Mastercard's revised scam merchant monitoring in 2026" (June 19, 2026). [https://solidgate.com/blog/mastercard-scam-merchant-monitoring/](https://solidgate.com/blog/mastercard-scam-merchant-monitoring/) 2. cside: "Mastercard Scam Merchant Monitoring 2026: What Merchants Must Know Before July" (May 5, 2026). [https://cside.com/blog/mastercard-scam-merchant-monitoring-2026](https://cside.com/blog/mastercard-scam-merchant-monitoring-2026) 3. Equifax: "Beyond Compliance: Navigating Mastercard's New Scam Merchant Monitoring Standards" (June 12, 2026). [https://www.equifax.com/business/blog/-/insight/article/beyond-compliance-navigating-mastercard-s-new-scam-merchant-monitoring-standards/](https://www.equifax.com/business/blog/-/insight/article/beyond-compliance-navigating-mastercard-s-new-scam-merchant-monitoring-standards/) 4. Mastercard: "How to stop the scammers behind the storefronts / Merchant Trust Services" (May 19, 2026). [https://www.mastercard.com/us/en/news-and-trends/stories/2026/merchant-trust-services.html](https://www.mastercard.com/us/en/news-and-trends/stories/2026/merchant-trust-services.html) 5. Chargeflow: "Mastercard's New Scam Merchant Rules: What Every eCommerce and SaaS Merchant Needs to Know Before July 2026" (May 13, 2026). [https://www.chargeflow.io/blog/mastercard-scam-merchant-monitoring-program-2026](https://www.chargeflow.io/blog/mastercard-scam-merchant-monitoring-program-2026) 6. Chargeback Gurus: "The New Rules for Mastercard's Scam Merchant Monitoring" (May 20, 2026). [https://www.chargebackgurus.com/blog/mastercards-scam-merchant-Monitoring](https://www.chargebackgurus.com/blog/mastercards-scam-merchant-Monitoring) 7. Justt: "Mastercard SMMP 2026: What the Scam Merchant Monitoring Program Means for Legitimate Merchants" (May 20, 2026). [https://justt.ai/blog/mastercard-smmp-program-2026/](https://justt.ai/blog/mastercard-smmp-program-2026/) 8. Wyllo: "Mastercard's July 24, 2026 Scam Merchant Rules: What High-Growth Mid-Market Ecommerce Merchants Need to Know" (May 22, 2026). [https://wyllo.ai/mastercard-scam-merchant-monitoring-mid-market-guide/](https://wyllo.ai/mastercard-scam-merchant-monitoring-mid-market-guide/) 9. Ballerine: "Mastercard MMSP Acquirer Obligations and Program Requirements" (May 4, 2026). [https://ballerine.com/blog/mastercard-mmsp-explained](https://ballerine.com/blog/mastercard-mmsp-explained) 10. Chargebacks911: "The MATCH List: What It Means to Be Listed (and How to Avoid It)" (May 13, 2026). [https://chargebacks911.com/match-list/](https://chargebacks911.com/match-list/) 11. Global Anti-Scam Alliance: "Global State of Scams 2025." [https://gasa.org/knowledge-base/reports/global-state-of-scams-2025](https://gasa.org/knowledge-base/reports/global-state-of-scams-2025)