What Is TC40 Data? TC40, SAFE, and the VAMP Connection
TC40 data is a fraud report an issuing bank sends to Visa when a cardholder disputes a charge as fraud. Mastercard's equivalent is SAFE. Both are records, and neither moves any money.
I've spent years in a support role digging through merchants' processor setups, and no two acquirers handled this data the same way. Some passed the fraud reports straight through, and others never mentioned them. That gap matters more now, because Visa's VAMP counts your TC40 volume directly.
Key takeaways
- TC40 is the Visa fraud-report record, and SAFE is the Mastercard version.
- A TC40 record is informational, and the money stays where it is.
- Visa flags a merchant Excessive at 2.2% combined fraud and dispute volume.
- Request TC40 data from your acquirer, since no merchant portal exists.
- Our platform's dispute alerts stop up to 91% of chargebacks before they file.
Want fewer disputes reaching this stage? Our chargeback alerts resolve disputes before they turn into chargebacks.
What is TC40 data?
TC40 data is a fraud report that a cardholder's issuing bank files with Visa when a customer disputes a charge as fraud. Mastercard collects the same thing in its Fraud and Loss Database (FLD).
FLD used to be called SAFE, short for System to Avoid Fraud Effectively. Plenty of people still use the old name.
Only the banks pass this record along, and it goes one way. Your customer calls their bank and says the charge was fraud. The issuing bank writes up the report and sends it to the card network, which passes it to your acquirer.
You're never a step in that chain, so the data never reaches your payment dashboard.
How the data flows to your acquirer
Here's what that path looks like from claim to acquirer.
What details does a TC40 record contain?
A TC40 record carries the details the network needs to spot a pattern. That means the date, the amount, the card type, your merchant category code, and the fraud reason the cardholder gave. You can check that reason against our reason code lookup tool.
The bank files the report whether or not you hear about the dispute. What you see depends on what your acquirer shares. Two merchants on the same processor can end up with sharply different views of their own fraud.
How can merchants access TC40 data?
You get TC40 and SAFE data by asking your acquiring bank or payment processor for it. Neither Visa nor Mastercard runs a portal a merchant can log into. The networks hand this data to acquirers, who each decide whether to pass it on.
Most acquirers have no automated way to send it. The raw files are huge and built for bank systems, so a request only works when it spells out exactly what you want.
Send your account representative these five things:
- The exact date range you want, stated as calendar months.
- Your merchant ID or MIDs, so they pull the right accounts.
- A reason-code breakdown, not just a total fraud count.
- Your preferred format, usually CSV or whatever report they already run.
- A recurring cadence, monthly or quarterly.
What comes back varies a lot. Some acquirers send a full record for every report, with the date, amount, and fraud code. Others send a monthly count and nothing else.
Take the bare count if that's the offer, because you can still see whether your fraud reports are rising month over month.
Ask whether the reporting is included in your agreement before you assume it's free. Some acquirers charge for it inside a fraud-monitoring package, and finding that out late is expensive.
If your rep doesn't know what you're asking for, name the record type. Use TC40 for Visa, and SAFE or FLD for Mastercard. Their risk team uses those terms internally.
Is a TC40 report the same as a chargeback?
No. A TC40 or SAFE record tells the card network that fraud happened, while a chargeback takes money out of your account and gives it back to the cardholder.
The two happen at different moments, and each can occur alone. A chargeback only follows if the bank opens a formal dispute against your acquirer, with its own reason code and deadline.
Here's how the two differ on the things a merchant cares about:
The notification row is the one that surprises people. You find out about a chargeback because money leaves your account. A fraud report can sit at the network for months while you have no idea it exists.
Plenty of fraud claims stop at the report. The bank writes off a small amount, or the customer drops it, or you refund the charge while the claim is still open.
This is where merchants misjudge how their fraud looks to Visa. Count only chargebacks and you're counting what survived the bank's filtering. The networks see every claim that came in.
So you can have a chargeback rate you're proud of and still file enough fraud reports to worry your acquirer. That's usually why their warning arrives with no warning signs in your own dashboard.
Some of those reports are chargeback fraud rather than a stolen card. A customer can dispute a charge they recognize, and their bank still logs it as fraud.
How TC40 data feeds into VAMP
Since June 2025, the Visa Acquirer Monitoring Program has added your TC40 fraud reports to your disputes, then divided the total by your settled transactions. So fraud reports count against you even when no chargeback followed.
That changes which number you track. Visa used to measure fraud and disputes separately. Now they share a number, and one bad fraud month raises your ratio even if your dispute count holds.
Per Visa's VAMP fact sheet, Visa calls a merchant Excessive at 220bps, or 2.2%, in the US, Canada, EU, and Asia-Pacific. Those same four regions drop to 150bps on April 1, 2026.
A volume floor sits under all of it. Most regions won't flag you below roughly 1,500 combined fraud reports and disputes a month. So a small store has room the ratio alone hides.
You have a lever on each half. Resolving disputes early keeps them out of the count, and a recognizable charge stops the fraud report being filed at all.
Our chargeback alerts reach you at the moment your customer calls their bank, so the case can close before it counts.
Look up Visa fine amounts and you'll still find $25,000 and $75,000 attached to the old monitoring programs. Those belong to the program VAMP replaced, retired on June 1, 2025. Check which program a source means before you plan around its numbers.
Can TC40 data prevent fraud and chargebacks?
TC40 data records fraud that already happened, so prevention has to come earlier. What stops a chargeback is resolving the dispute before the bank files it.
Alerts are how you get that window. Ethoca (Mastercard) and Verifi (Visa, which operates RDR and CDRN) tell you when a cardholder has contacted their bank.
You then refund or fix the transaction before the bank turns it into a dispute. Across merchants enrolled on our platform, dispute alerts stop up to 91% of chargebacks this way.
Alerts also keep the case out of your VAMP ratio. A dispute resolved through a pre-dispute alert never posts as a counted dispute, so it drops out of the numerator. The carve-out depends on Visa's data-pull timing, so a case settled right at the cutoff can still land in the count.
The fraud report is the part that stays. Your bank made that record when your customer called, and resolving the dispute later doesn't erase it.
Two changes cut fraud reports before a customer ever calls their bank:
- Fix your descriptor. Set your billing statement descriptor to your trading name plus a support number, not your legal entity name.
- Route risky payments through 3DS. Send orders above your average value, or with mismatched billing and shipping countries, through 3D Secure.
Both work on the claim itself. A customer who recognizes the charge lets it stand, and an authenticated payment is harder to disown later.
How we sourced our data
The prevention figure in this article comes from alert data across merchants enrolled on the Chargeback.io platform. It reflects our own book of business.
We count the alerts we receive and the disputes we resolve across enrolled merchants, then report the result as a share of the total.
Results vary with your processor, your descriptor, and how fast you act on an alert, which is why we state the figure as an upper bound. That figure is what alerts have done for merchants on our platform.
Your own numbers will depend on your setup.
FAQ
What is the difference between TC40 and TC15?
TC40 is Visa's transaction code for a fraud report, while TC15 covers disputes. Both feed the VAMP ratio, so a merchant can raise it through either one.
Does a TC40 report show up on my processing statement?
No. Fraud reports are filed between banks and the card network, so they never appear on your merchant processing statement or in your payment dashboard.
Can one dispute generate two TC40 reports?
Generally no, since the issuer files one fraud report per disputed transaction. Each disputed transaction gets its own record, even when they sit on the same card.
Does canceling before a dispute stop a TC40 filing?
A fraud report can still be filed on charges that already went through. The one thing that stops it is a refund the customer accepts before they call their bank.
