The Visa Acquirer Monitoring Program (VAMP) is Visa’s monthly program for watching fraud, disputes and enumeration (Visa’s term for card testing). For enumeration, Visa’s own VAMP fact sheet gives two measures. The first is an enumeration ratio of 2,000 basis points or more: 20% of all approved and declined authorizations. The second is a count of 300,000 or more enumerated transactions. The fact sheet “requires acquirers to take proactive steps” to keep their merchants below these levels. That is why your processor cares about card testing on your website, even when almost every attempt is declined.
Vendor blogs on VAMP disagree with each other, especially on the merchant ratio (1.5% or 0.9%?) and on fees. This post sticks to what Visa’s public fact sheet says, and labels anything else as secondary.
What is VAMP?
According to Visa’s fact sheet, VAMP brings three earlier programs (the old VAMP, the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program) into a single global program. Brazil, Chile and India will be “announced later.” The new thresholds took effect on 1 June 2025, and the advisory period ended on 30 September 2025.
Each month, Visa measures fraud, dispute and enumeration levels and identifies acquirers or merchants that exceed the thresholds. Entities identified this way are “required to implement risk mitigation control measures.”
How does Visa define the enumeration thresholds?
The fact sheet defines both enumeration measures in terms of authorizations:
- VAMP Enumeration Ratio: the count of enumerated authorization transactions (approved plus declined), divided by the count of all authorization transactions (approved plus declined). The threshold is 2,000 bps or more, which is 20%.
- VAMP Enumeration Transaction Count: the number of enumerated transactions (approved plus declined). The threshold is 300,000 or more.
Two details matter for merchants:
- Declines count. Both measures include declined authorizations. A card testing attack that your gateway declined still adds to your enumeration numbers. Only blocking attempts before they reach the issuer keeps them out of the count.
- The fact sheet doesn’t say how a transaction is classified as “enumerated.” Visa does the classification. If your acquirer says you have an enumeration problem, ask for the report behind it.
The fact sheet lists the ratio and the count one after the other. Many secondary guides read them as working together, so that a small merchant with a high ratio but far fewer than 300,000 enumerated attempts would not hit the program threshold. The fact sheet doesn’t spell this out, so confirm with your acquirer how it applies the two measures. Either way, your acquirer can still act on card testing well below Visa’s levels.
What are the VAMP fraud and dispute thresholds?
The main VAMP metric is separate from enumeration. It is a count-based ratio for card-not-present transactions:
VAMP ratio = (fraud reports (TC40) + disputes (TC15)) ÷ settled transactions (TC05)
Visa excludes disputes resolved through pre-dispute solutions, and fraud reports that qualify for Compelling Evidence 3.0, subject to the timing of the data extract.
According to the fact sheet:
- Acquirer portfolios: “Above Standard” at a VAMP ratio of 50 bps (0.5%) or more, and “Excessive” at 70 bps (0.7%) or more.
- Excessive merchants: these thresholds apply when the acquirer itself is not Above Standard or Excessive.
- AP, Canada, EU and US: 220 bps at launch, reduced to 150 bps (1.5%) on 1 April 2026 (footnote 5), with at least 1,500 fraud reports and disputes in the month.
- LAC: 150 bps, with at least 1,500 fraud reports and disputes.
- CEMEA: 220 bps, with at least 150 fraud reports and disputes and at least USD 75,000.
Card testing affects this ratio too. When a stolen card is approved during testing, the real cardholder often reports it, and that fraud report or dispute is added to the top of the ratio.
Is the merchant threshold 1.5% or 0.9%?
For US merchants today, Visa’s fact sheet gives 1.5% (150 bps), which took effect on 1 April 2026.
The 0.9% figure doesn’t appear anywhere in Visa’s VAMP fact sheet. One secondary source, Forter, suggests where it comes from: it describes 0.9% as the level used by each of the two programs VAMP replaced, the fraud and dispute monitoring programs. We could not confirm that against a current Visa document. Articles that give 0.9% as the current VAMP merchant threshold are probably repeating the older programs. Some secondary sources also describe the 1,500 minimum as a count of settled transactions. The fact sheet says it is a count of fraud reports and disputes.
What are the VAMP fees, and why does my processor pass them on?
Visa’s public fact sheet lists no fee amounts. It describes thresholds and the requirement to put mitigation controls in place, and refers readers to their acquirer, processor or Visa representative for more detail.
Fee figures in circulation come from secondary sources. Forter, for example, reports a fine of $8 per violation for merchants over the threshold, possibly $16 when a fraud report and a dispute fall on the same transaction, and $4 for acquirers in the Above Standard band. These are secondary-source figures that we could not verify against a Visa primary document. Treat them as indicative only.
Why merchants end up paying: VAMP is an acquirer program. Visa measures the acquirer’s portfolio, and the acquirer is the party Visa expects to keep merchants under the enumeration thresholds. Whether that cost reaches you, and how, depends on your merchant agreement with your processor. Look for a clause on card brand fees, fines or assessments, and ask what extra controls the processor can require. If an MSP manages your payments, ask them to check too. Our PCI non-compliance fee guide covers a similar pass-through cost.
How do I keep my business under the enumeration threshold?
Enumeration counts authorizations, declines included. That makes the most effective control one that stops scripted attempts before they reach the issuer:
- Detect and block bots at checkout: CAPTCHA or a challenge, rate limits per browser and network, and minimum amounts on donation forms.
- Use your gateway’s velocity filters, with an action that declines before authorization. On Authorize.net, that means the AFDS velocity filters set to decline or do-not-authorize. See our Authorize.net card testing guide.
- Refund approved test charges quickly so they don’t become disputes that count toward the VAMP ratio.
- Monitor your decline rate daily and have an incident plan. Our card testing attack guide walks through the first hour, and there is a printable incident checklist.
- Ask your acquirer for your numbers. Enumeration is classified by Visa and reported through acquirers, so the acquirer is the source for your own figures.
CardSecurity card-testing protection, live in pilot for merchants on Payroc, is built around this approach. It scores each checkout attempt and blocks scripted attackers before anything is sent to the processor. Riskier customers are asked to verify, and low-risk customers go straight through. Support for other processors is in testing; tell us yours.
Frequently asked questions
What is enumeration in Visa VAMP?
Enumeration is the term Visa’s program uses for card testing: automated attempts to find valid card details by submitting large numbers of authorizations. Under VAMP, Visa counts enumerated authorizations, both approved and declined, and compares them with total authorizations. Visa’s fact sheet sets the thresholds at a 2,000 basis point (20%) enumeration ratio and 300,000 enumerated transactions, and expects acquirers to keep merchants below them.
Do declined transactions count toward VAMP enumeration?
Yes. Visa’s fact sheet defines both the enumeration ratio and the enumeration count as approved plus declined authorizations. Declining card testing attempts at the issuer does not keep them out of your numbers. To keep the count down, stop scripted attempts before authorization, with bot challenges, velocity limits that decline before authorization, or a pre-authorization screening layer.
What is the current Visa VAMP merchant threshold in the US?
According to Visa’s VAMP fact sheet, the Excessive Merchant threshold for the US, Canada, EU and Asia Pacific was lowered from 220 to 150 basis points (1.5%) on 1 April 2026. A merchant also needs at least 1,500 fraud reports and disputes in the month. The ratio is fraud reports plus disputes divided by settled card-not-present transactions.
How much is the Visa VAMP fee for merchants?
Visa’s public VAMP fact sheet does not publish fee amounts. Secondary sources such as Forter report about $8 per violation for merchants over the threshold, but we could not confirm that figure against a Visa primary document. The amount you actually pay depends on your acquirer and your merchant agreement, so ask your processor how it passes through VAMP fees.
If enumeration is pushing you toward your acquirer’s limits, see how CardSecurity card-testing protection stops scripted attempts before they become authorizations.