How the Excessive Fraud Merchant Programme works
The programme looks at fraud, not at disputes in general. As in Mastercard's other merchant programmes, the acquirer is the party Mastercard deals with, and any cost reaches the merchant through the acquirer's contract.
What the public rulebook says is limited. The Security Rules and Procedures, Merchant Edition, of 4 August 2026 names the Excessive Fraud Merchant (EFM) programme in section 7.2: a suspected or confirmed violation obliges the acquirer to repeat its onboarding screening of the merchant. The criteria themselves are published to Mastercard's customers and not to the public.
How EFM relates to Mastercard's other programmes
The Excessive Chargeback Programme counts all of a merchant's chargebacks against its transactions, while EFM concerns fraud. Separately, an acquirer that terminates a merchant for excessive fraud lists it in MATCH under reason code 05, which has a definition of its own in the manual.
The raw material is the same for all of them: the fraud that issuers report to Mastercard's Fraud and Loss Database, and the fraud chargebacks that follow.
Why EFM matters to an online merchant
The practical levers are the ones that cut fraud chargebacks: 3-D Secure on risky payments, fraud scoring before authorisation, and alerts that allow a refund before a chargeback. A payment facilitator watches the same figures for each of its sub-merchants, because the acquirer holds it answerable for them.
EFM or the Excessive Chargeback Programme?
- Excessive Chargeback Programme
- Measures chargebacks of every kind per merchant in basis points, with two levels, ECM and HECM.
- VAMP
- The Visa Acquirer Monitoring Program, Visa's own programme, described under that term.
Where Mastercard's Excessive Fraud Merchant Programme shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Analytics & monitoringProduct analytics, attribution, engagement and crash reports, on a tracking plan you control.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.