Mastercard Chargeback Monitoring Program: ECM vs. EFM

Mastercard runs two separate monitoring programs for chargebacks, and they measure different things. One tracks your overall dispute ratio. The other tracks fraud-specific chargebacks on card-not-present sales.

On my own stores, I've fixed the billing descriptor before touching anything else in the dispute process. Fixing what customers saw on their statement did more than any alert. A charge nobody recognizes turns into a chargeback.

Most merchants treat Mastercard's monitoring as one thing when it's two. Each program has its own number to watch. This guide gives you both sets of thresholds and the way out from under either.

Key takeaways

• Mastercard runs two programs, ECM for chargebacks and EFM for fraud.
• ECM starts at 100 chargebacks and a 1.5% ratio in one month.
• EFM starts at 1,000 sales, $50,000 in fraud, and 50 basis points.
• Trip both in one month and only the EFM fee applies.
• Exit either program by staying under its threshold for three straight months.

What is Mastercard's chargeback monitoring program?

Mastercard runs two separate chargeback monitoring programs, and a merchant can land in one or both at once:

• Excessive Chargeback Merchant (ECM): watches your overall dispute volume.
• Excessive Fraud Merchant (EFM): watches card-not-present fraud.

Most merchants only hear "Mastercard's monitoring program" from their acquirer, so they assume it's one rule with one number.

Both programs measure you at the Merchant ID (MID) level, using monthly reports from your acquirer. What differs is what each one counts.

ECM counts every first-presentment chargeback you get. EFM counts only fraud-reason-code chargebacks on e-commerce sales. That one difference is why the two ratios move on their own.

A merchant with a clean overall ratio can still trip EFM if fraud chargebacks climb past the fraud threshold. It works the other way too. You can stay under EFM's fraud threshold and still cross ECM. That happens when non-fraud disputes push your total past 1.5%.

Track both numbers, because staying safe on one tells you nothing about the other.

Both programs sit inside the wider Mastercard rules our Mastercard chargeback guide walks through.

For the cross-network basics that apply beyond Mastercard, start with our chargeback monitoring programs explainer.

What is the Excessive Chargeback Merchant (ECM) program?

ECM enrolls a merchant at 100 or more chargebacks and a 1.5% ratio in one calendar month. High ECM (HECM) escalates at 300 chargebacks and a 3% ratio. Both conditions have to hold in the same month for the MID to enroll.

The measure behind them is the chargeback-to-transaction ratio (CTR). You take the current month's chargeback count and divide it by the prior month's sales count for the same MID.

Because the denominator is last month's sales, your exposure lags your own volume by a month. A slow sales month followed by a normal chargeback month can push the ratio up on its own.

Here are Mastercard's two published entry lines:

A separate charge kicks in once you pass 300 chargebacks in a month. Per Mastercard's Excessive Chargeback Program Guide, published December 2019, Mastercard applies an issuer recovery assessment of $5 for every chargeback over 300.

A merchant with 500 chargebacks owes $1,000 in issuer recovery, per that same guide, worked out as 500 minus 300, times $5. That charge sits on top of the tier fine as an extra line.

Fines only start in the second straight month you stay over threshold, so a single month above it is free. That gives you a short window to pull the ratio back down before any assessment lands.

ECM and HECM fees by month in violation

Mastercard's data shows ECM fines climb from $1,000 a month at month two to $100,000 a month at month 19 and beyond. HECM fines run about double ECM at every step. The penalty is a step function tied to consecutive months over threshold.

The cost compounds the longer you're enrolled.

Here's the full schedule by month, from that same guide:

This schedule dates to Mastercard's 2019 guide. Card network rules change, and this source is already several years old. Confirm the current amounts with your acquirer before you make a live compliance decision on these numbers.

Run your own chargeback count against this fee ladder in our ROI calculator. It shows what a month in either program would actually cost you.

What is Mastercard's Excessive Fraud Merchant program?

EFM enrolls a merchant only when three conditions all hit in the same month. Miss any one of them and the program doesn't apply that month. The three are the transaction count, the fraud dollar amount, and the fraud ratio:

EFM only looks at card-not-present e-commerce sales. It counts just two fraud reason codes, 4837 (No Cardholder Authorization) and 4863 (Cardholder Does Not Recognize). ECM counts first-presentment chargebacks of any reason code or type. That narrow scope is what lets the fraud ratio run high while the overall ratio stays clean.

You can read what each code means in our Mastercard reason codes guide.

The fraud ratio uses basis points the same way ECM's CTR does. Here's Mastercard's own worked case.

Take 100 e-commerce fraud chargebacks this month. Divide by 10,000 e-commerce transactions from last month, then multiply by 10,000. That comes to 100 fraud basis points, double the EFM threshold. These figures come from Mastercard's Excessive Fraud Merchant Program FAQ, dated February 2022.

There's a way out of the fraud dollar and ratio conditions. Per the EFM Program FAQ, keep 3D Secure use above 10% in the US and Canada, or above 50% in Europe. That keeps you out of EFM even when the fraud numbers would qualify.

Keeping 3D Secure high protects your compliance status too, on top of cutting fraud losses.

How ECM and EFM interact when both are triggered

If a MID trips both ECM and EFM in the same month, only the EFM assessment applies. The ECM fine is suspended until the merchant exits EFM. You pay one penalty for the month.

Mastercard treats EFM as the more serious flag because it targets confirmed fraud. So it takes assessment priority when both trigger at once.

The ECM violation still sits on the books, and its fine waits behind the fraud program.

Your ECM history survives an EFM exit. Once the EFM audit closes, ECM assessments resume from wherever your ECM standing already sits.

How to exit the ECM or EFM program

You exit either program by staying below its threshold for three straight calendar months. After that, Mastercard resets your status and removes you automatically. The clock is unforgiving, and a single good month won't reset it.

Any month back above threshold restarts the count from zero. If your MID gets flagged again after an audit has closed, Mastercard treats it as first-time noncompliance. The fine schedule resets to month one rather than picking up where it left off.

Mastercard's own timeline shows how the count works. A merchant sits in ECM month one with no violation. Mastercard's data shows they hit a $1,000 fine at ECM month two, and a $2,000 fine at HECM month three.

Three clean months after that close the audit. A later violation starts the clock over at month one.

How alerts keep your ratio under both thresholds

A dispute resolved through a pre-dispute alert never enters the ECM or EFM ratio. Both programs only count chargebacks that actually post. Stop the chargeback from filing and it stays out of both numbers.

Alert networks route the dispute signal to you while it's still pre-chargeback. Issue an auto-refund at that point. You fix the customer's issue with no chargeback filed against your MID. The dispute closes before it can count.

For Mastercard traffic that network is Ethoca, which Mastercard owns. Among the merchants on our platform, Ethoca is the largest single alert network by volume.

For Visa, the network is Verifi, a Visa solution that runs the RDR and CDRN products.

Alerts only catch the disputes the bank and network route through the system. A chargeback filed outside that path, or from a non-participating bank, still posts and still counts. So alerts lower your exposure without erasing it.

Getting chargeback alerts in place is the most direct way to keep both ratios under threshold.

Do other card networks run monitoring programs?

Yes. Visa runs its own monitoring under the Visa Acquirer Monitoring Program (VAMP). American Express and Discover apply their own, less publicly detailed thresholds. If you process both Mastercard and Visa, you're tracking two separate rule sets at once.

VAMP folded Visa's former dispute and fraud programs into a single ratio. The math is fraud plus disputes divided by settled transactions. Our Visa Acquirer Monitoring Program guide has the full mechanics.

Our Visa dispute monitoring program guide covers the history of what VAMP replaced.

FAQ

Is a high-risk designation the same as ECM or EFM?

No. A high-risk designation is a separate acquirer and MATCH-list status, unrelated to the chargeback-ratio programs.

What is Mastercard's BRAM program?

BRAM (Business Risk Assessment and Mitigation) monitors illegal or brand-damaging merchant activity. It's a separate compliance track with no bearing on the ECM or EFM thresholds.

Can a merchant be in ECM and EFM at the same time?

Yes. Both enrollments can sit on one MID at the same time, even though the billing side pauses ECM while EFM runs.

Does winning a Mastercard dispute remove it from the ratio?

No. The ratio counts chargebacks received, so a representment you win later still leaves the original chargeback in the count.