Mastercard's 72-Hour Scam Clock Changes How Fast Merchants Must Explain Unusual Patterns

Mastercard introduced a 72-hour clock for investigating suspected scam merchants. If scam activity is confirmed, the merchant must be stopped from accepting Mastercard transactions in three days. The interesting implication is for legitimate businesses: a sharp drop in authorization rates, refund and chargeback spikes, or issuer scam reports can trigger scrutiny. Promotions, new channels, subscription issues, and confusing billing descriptors can look the same. Visa's VAMP changes reduced the margin for error. Mastercard's changes reduce the time available to understand it.

One of the biggest changes in fraud monitoring this year is how quickly payment providers will be expected to react.

Mastercard introduced a 72-hour clock for investigating suspected scam merchants. If scam activity is confirmed, the merchant must be stopped from accepting Mastercard transactions in three days.

At first glance, this looks like another compliance change aimed at obvious scam merchants. The more interesting implication is what it means for legitimate online businesses.

Legitimate patterns can look like warning signals

A sharp drop in authorization approval rates can trigger scrutiny. For newer merchants, more than 5% of purchases resulting in refunds and chargebacks combined over a rolling 30-day period can become a warning signal. Issuer reports of scams or manipulation can also trigger investigation.

The problem is that legitimate businesses can generate unusual patterns too. A successful promotion suddenly changes transaction volumes. A new acquisition channel brings a different customer profile. A subscription issue creates a spike in refunds. A confusing billing descriptor generates disputes. Approval rates suddenly fall.

None of these necessarily mean the merchant is fraudulent. But under a faster monitoring environment, merchants have much less time to understand what's happening and explain it.

Networks are looking across signals together

Historically, many businesses have treated these metrics separately. Fraud sits with the fraud team, refunds are a customer service problem, authorization rates are a payments metric, and customer complaints are handled by support. Increasingly, payment networks are looking across those signals together.

That's why the biggest takeaway from Mastercard's changes is visibility. Merchants need to understand:

• What is causing sudden changes in authorization rates?
• Where refunds and chargebacks are originating?
• Whether customers recognise their billing descriptors?
• Which acquisition channels are creating higher-risk behaviour?
• Whether unusual patterns are fraud, operational issues, or normal changes in customer behaviour?
• What evidence they have available if their processor starts asking questions?

Visa's VAMP changes earlier this year reduced the margin for error. Mastercard's latest changes reduce the time available to understand the error. Fraud management is moving away from reviewing what happened last month. The merchants best prepared are the ones who can understand what's happening right now and explain why.

Related: Visa's VAMP threshold reduction, what to do if Stripe warns your dispute rate is too high, how it works, and the FAQ.

If you want chargebacks classified by type so you can explain the mix - not only the rate - book a demo.

Originally shared on LinkedIn.