What is risk scoring?
Risk scoring is the practice of giving something a number or a category based on how likely a bad outcome is and how much damage it would do. A likely event with a severe consequence outranks an unlikely one with a mild consequence. The point is ranking, so whoever reads the score deals with the worst cases first.
How risk scoring is calculated
A risk score is likelihood multiplied by impact. You rate each one on the same numeric scale.
Likelihood is your guess at how often the bad thing happens, from almost never to something you expect. Impact is how much it would hurt if it did, from an annoyance to a serious loss.
Multiply them and two judgment calls become one number you can rank against every other item you rated.
Say you rate both factors from 1 to 5. The lowest score is then 1 and the highest is 25. MetricStream maps that range onto three bands:
MetricStream says firms pick a scale to fit their size, the age of their risk program, and what they must report. The 1 to 5 rating and the three bands above are one common setup among many.
Risk scoring levels and what they mean
Scores get grouped into named bands, and each band maps to a fixed response. A raw score of 14 only becomes useful once you know it reads as Medium.
Scoring systems use three bands or five. MetricStream names both:
- Three bands: High, Medium, Low.
- Five bands: Critical, High, Medium, Low, Negligible.
Each band carries its own standard response:
The top of the range is where the two formats split. A five-band scale separates the merely bad from the emergency, but a three-band scale groups both under High.
Firms set their own cutoffs. A "High" on a three-band scale and a "High" on a five-band scale are different numbers.
Ask your processor which scores map to each band before you act on a label.
Risk scoring factors for chargeback and dispute risk
Your merchant risk score comes from the history your processor has already logged on your account. A fraud score reads one transaction as it happens. A merchant risk score reads months of your behavior.
Ratio, velocity, refunds, and card-range patterns carry most of the weight:
- Chargeback ratio: Your chargebacks divided by your transactions over a set window.
- Dispute velocity: How fast those chargebacks are arriving, which shows a rising merchant before the ratio itself moves.
- Refund rate: Refunds and disputes come from the same problems, so refunds rise first.
- Card range and geography patterns: Sales concentrated in card ranges or regions that dispute more often.
Underwriters check your chargeback ratio and your refund rate against published limits. 2Accept says a ratio above 1% triggers red flags, and going past 2% may get your application declined.
The same report puts the ecommerce refund-rate average at 16.9%.
No network publishes a number for velocity or card-range patterns. Processors watch both in their own models, where they shape how closely you get read.
Your merchant category code sets your starting baseline before any of your own history counts against you.
Check yours in our MCC lookup tool to see the risk tier your business gets assigned by default.
Your chargeback rate is one input into that account-level score.
Why risk scoring matters for merchants
A score that crosses a card network's published dispute-ratio limit puts you into a monitoring program with fees attached. Visa and Mastercard each publish one, and crossing it enrolls you automatically.
Visa's Acquirer Monitoring Program sets its Excessive limit for merchants at 1.5%, or 150 basis points, as of April 1, 2026.
Chargeflow reports that's down from the 2.2% launch rate, with disputes past that limit costing $8 each in the Excessive tier. CEMEA merchants keep the older 2.2% mark.
Mastercard runs its own version. Our Mastercard monitoring program guide covers where its limits sit.
By the time you cross a network threshold, your processor has usually acted already.
Processors run their own scoring models, and their limits sit below the network's. So yours can flag you, watch you, or move you onto a high-risk merchant account months before Visa's number ever applies.
FAQ
Is a risk score the same as a chargeback ratio?
A chargeback ratio counts what already happened, while a risk score estimates what happens next. Your ratio is one of several inputs that feed the score.
Can a merchant see or calculate their own risk score?
Rarely in full, because processors keep their models private. You can work out your own ratio and refund rate each month, and your acquirer will warn you when you're near a limit.
Does a high risk score mean an account will be closed?
A high score usually brings a review, a reserve, or a monitoring program first. Your account gets closed only if nothing improves.
