How 3D Secure Affects Your Visa VAMP Ratio

Merchants under pressure from the Visa Acquirer Monitoring Program (VAMP) often ask one question about 3D Secure: does authenticating a transaction keep it out of the VAMP ratio? Based on what Visa has published, the answer is ‘partly’. Authentication bears on whether a card-not-present fraud dispute can be raised and how it is assessed. It does not appear among the published exclusions for fraud reports, which make up the other half of the ratio. Since 1 April 2026 the threshold for an Excessive merchant in Visa’s Asia Pacific, Canada, EU and US regions has been 150 basis points (1.5%), so the difference matters.

How Visa calculates the VAMP ratio

Visa’s fact sheet defines the VAMP ratio as a count-based measure of fraud and disputes on card-not-present VisaNet transactions, domestic and cross-border:

VAMP ratio = count of [fraud reports (TC40) + disputes (TC15)] / count of settled transactions (TC05)

The fact sheet lists two exclusions. Disputes resolved through pre-dispute solutions are excluded, and fraud reports that qualify for Compelling Evidence 3.0 are excluded, both depending on the timing of the data extract. The updated thresholds took effect on 1 June 2025.

Who	Threshold	Minimum monthly count
Acquirer portfolio, Above Standard	50 bps or more	Same minimum as Excessive
Acquirer portfolio, Excessive	70 bps or more	1,500 in AP, Canada, EU and US; in CEMEA, 150 and USD 75,000
Merchant, Excessive (AP, Canada, EU, US)	150 bps or more since 1 April 2026 (previously 220 bps)	1,500 fraud and disputes
Merchant, Excessive (Latin America and Caribbean)	150 bps or more	1,500 fraud and disputes
Merchant, Excessive (CEMEA)	220 bps or more	150 fraud and disputes and USD 75,000

 

The merchant thresholds apply where the acquirer is not itself identified as Above Standard or Excessive. Visa says programmes for Brazil, Chile and India will be announced separately. The fact sheet uses Visa’s regional labels, so a merchant outside the EU but in Visa’s European region, such as a UK merchant, should confirm with its acquirer which threshold applies.

Where 3D Secure protection applies

The dispute half of the ratio is where authentication has a published effect. Visa’s Dispute Management Guide for Merchants (October 2026) says a fraud dispute under condition 10.4, Other Fraud in a card-absent environment, typically occurs when, among other things, the transaction was processed without additional authentication such as 3D Secure. It says outcomes for many card-absent fraud disputes are influenced by how the transaction was authenticated, and it recommends using 3D Secure to authenticate the cardholder as a way to reduce these disputes.

Fewer fraud disputes means fewer TC15 records in the numerator. For merchants whose ratio is driven mainly by card-absent fraud disputes, authentication is one of the most direct levers available.

What authentication does not remove from the ratio

The fraud-report half works differently. A TC40 is the issuer’s report that a transaction was fraudulent. The fact sheet’s exclusions cover pre-dispute resolutions and Compelling Evidence 3.0 qualification. Authentication is not one of them, so on the published formula a fraud report filed against an authenticated transaction still counts.

Visa’s guide adds a second caveat. Under dispute condition 10.5, Visa Monitoring Programs, a transaction can be included regardless of whether it was originally processed as a secured or unsecured transaction. A merchant that is already in a monitoring programme should not assume authentication shields it from disputes raised on that basis.

The practical conclusion is that 3D Secure reduces one component of the ratio and, by giving issuers better data to decline or challenge fraudulent attempts, can reduce fraud reaching settlement in the first place. It does not remove fraud reports by itself.

How to use 3DS data to manage the ratio

1. Split your ratio by authentication status. Group fraud reports and disputes by whether the transaction was authenticated (from the electronic commerce indicator in authorisation). This shows how much of your ratio sits in unauthenticated volume.
2. Check that authentication reaches authorisation. A transaction authenticated in 3DS but submitted for authorisation without the authentication data can lose the protection the authentication would otherwise give. See Why Authenticated Transactions Lose Their 3D Secure Protection at Authorisation.
3. Use the challenge indicator deliberately. For transactions your own risk checks flag, request a challenge rather than leaving the decision to default settings. Our guide to when merchants should request a 3DS challenge explains the options.
4. Send complete data. Better data in the authentication request helps issuers make the right decision. See the field-level rules behind 3DS requestor data quality.
5. Keep the evidence Compelling Evidence 3.0 needs. Visa’s guide lists identifiers such as device ID or fingerprint, IP address, login ID and delivery address that may link a disputed transaction to earlier undisputed ones. Store them with each order.
6. Watch enumeration separately. Card testing is measured under its own VAMP criteria, covered below.

Card testing and the enumeration measure

VAMP also requires acquirers to stop merchants exceeding enumeration thresholds. The enumeration ratio is the count of enumerated authorisation transactions, approved and declined, divided by all authorisation transactions, and the threshold is 2,000 basis points (20%) together with at least 300,000 enumerated transactions. This is measured on authorisations, not settled transactions, so card-testing attempts count even when they are declined. Where 3D Secure helps against card testing, and where it does not, is covered in this article.

Where ActiveServer fits

ActiveServer is GPayments’ 3DS Server for merchants, acquirers and payment service providers. If you want to review how authentication data flows through your checkout and into authorisation, speak with a 3DS specialist.

Frequently asked questions

Are 3D Secure authenticated transactions excluded from VAMP?

Not as a category. Visa’s published exclusions cover disputes resolved through pre-dispute solutions and fraud reports qualifying for Compelling Evidence 3.0. Authentication affects fraud disputes under condition 10.4, but fraud reports on authenticated transactions still count on the published formula.

Does the VAMP ratio include card-present transactions?

No. The fact sheet defines the ratio on card-not-present VisaNet transactions, domestic and cross-border.

What is the difference between a TC40 and a TC15?

In the VAMP formula, TC40 is the issuer’s fraud report and TC15 is a dispute. One fraudulent transaction can generate both, and both appear in the numerator.

Is a merchant with fewer than 1,500 fraud reports and disputes a month in VAMP?

In AP, Canada, EU, US and Latin America and Caribbean, the Excessive merchant threshold applies only with a monthly count of at least 1,500 fraud reports and disputes. Acquirers can apply their own stricter limits, so check your merchant agreement.

Does frictionless authentication count the same as a challenge for disputes?

Visa’s merchant guide refers to how the transaction was authenticated and does not separate frictionless from challenged authentication in its description of condition 10.4. For the precise treatment of a given authentication outcome, check the Visa Core Rules with your acquirer.