Small-Store Chargeback Thresholds: The 0.5% Trap

On this page

The 0.5% trap
Two counting rules that change your number
Every limit that can catch a small store, in order
Worked example: a 1,000-order store
What to do at each limit
Frequently asked

For sellers and merchants running a small store, the famous thresholds are a distraction. Visa VAMP Excessive needs 1,500 fraud reports and disputes in a month; Mastercard ECM needs 100 chargebacks. A store taking 1,000 orders a month will never see either — and that is exactly how it gets caught. The limits that bite small stores sit far lower, and three of them are not network programs at all in the way merchants imagine: a conditional Visa exposure, a processor rule, and a terminated-merchant criterion. This guide covers each one, states honestly what is conditional, what is eligibility-only, and what is a real trip — and pairs with the Small-Store First-Limit Checker, which runs your own month's figures through all five in order.

The 0.5% trap

The trap is the gap between two true statements. Visa's own fact sheet presents 0.5% as an acquirer-level figure: a portfolio at 0.5% to below 0.7% is Above Standard, and at 0.7% or more it is Excessive. Stripe's monitoring documentation, meanwhile, lists 0.5% with 5 events as a merchant Non-Compliant level. Both are real — they are the same mechanism seen from two sides. Braintree's VAMP documentation (PayPal developer docs) states the mechanism plainly: if the acquirer's portfolio (BID) is flagged, any merchant with a 0.50% VAMP ratio and a VAMP count of at least 5 could be notified of inclusion in the program, with published per-event assessments of $4 if the acquirer is Above Standard and $8 if Excessive. So a store at 0.6% with 6 events is far from the 1.5% headline line and can still be in the program — if its acquirer is flagged. If the acquirer is not flagged, the merchant Excessive line of 1.5% with 1,500 events is the only Visa tier. That conditional is the whole trap: a merchant who checks only the headline number believes it is safe, while its exposure depends on a portfolio ratio it cannot see. The honest question to ask your processor is not "what is my ratio?" but "is our acquirer portfolio flagged, and what is my VAMP count?"

Why the count gate is 5 and not 1,500 matters for arithmetic: at 1,000 Visa orders, 0.5% is 5 events. Five disputes plus fraud reports in a month — a bad week for a small store — is enough to cross the ratio line. Whether anything follows depends on the acquirer condition, but the ratio line itself is crossed at a volume any small store can reach.

Two counting rules that change your number

First, disputes count when they arrive, not when you sold. Visa and Mastercard assign a dispute or fraud report to the month the network received it. A dispute filed in March on a January order counts in March — so a quiet sales month can carry a loud dispute month, and disputes in a month can exceed that month's orders. Second, outcomes do not remove disputes from the rate. Shopify's Help Center says its NDRP-inclusive chargeback rate includes disputes that you win; Stripe's documentation, as summarised by Chargeflow and Paperblog, says monitoring programs do not consider dispute outcomes, and do not consider refunds when identifying disputes either. Winning recovers the money; it does not lower the ratio. Refunding after a dispute posts does not lower it either. The moves that lower the ratio are the ones that stop an event from posting: refund before a dispute is filed, resolve through a pre-dispute alert, or stop the fraud before capture. Visa's VAMP ratio adds a third wrinkle for Visa sellers: it counts TC40 fraud reports as well as TC15 disputes, so a transaction that appears in both reports counts twice, and the ratio Visa sees can run well above your raw chargeback rate.

Every limit that can catch a small store, in order

Order	Limit	Line	What happens
1	Visa VAMP non-compliant exposure	0.5% + 5 events, acquirer flagged	Notification of inclusion; published per-event assessments of $4 (acquirer Above Standard) or $8 (acquirer Excessive), passed through by the acquirer. Your merchant agreement governs the figure actually charged.
2	Mastercard MATCH code 04 criterion	Over 1% + $5,000 in a month, no minimum count	Nothing automatic. If — and only if — your acquirer terminates your account for excessive chargebacks, network rules require it to add you to MATCH, where the listing stays five years and only the adding acquirer can remove it early. Future applications get harder.
3	Shopify NDRP enrolment	1.5% NDRP-inclusive rate over 90 days	Automatic enrolment possible; eligible disputes are refunded automatically with no evidence window, a fee applies per dispute resolved through the program, and a 10% reserve is applied to payouts. Exit requires the 90-day rate below 1.00% for 30 consecutive days. Merchants below an unpublished minimum order volume are excluded.
4	Mastercard ECM	1.5% + 100 chargebacks	Entry into the Excessive Chargeback Program; assessments from the second month in program; exit after three consecutive months below the line. Mastercard counts first-presentment chargebacks against the previous month's transactions.
5	Visa VAMP merchant Excessive	1.5% + 1,500 events	Remediation plan and per-event assessments (published merchant Excessive tier of $8 per report or dispute, first-time grace period typically three months). Standard regions since April 1, 2026; CEMEA uses 2.2% with 150 events plus $75,000.

Two near-misses worth naming so they are not mistaken for limits. Stripe publishes no enrolment number of its own; it cites an industry benchmark of dispute activity above 0.75% as excessive and says it will reach out on higher or spiking activity — a watch line, not a program tier. And Visa's VMSS code 22 (the Visa terminated-merchant equivalent) needs 1,000 disputes at a 1.8% ratio, which no small store reaches; it is listed here only so a merchant who finds it in a table does not mistake it for a live threat.

Worked example: a 1,000-order store

Take a store with 1,000 card orders in a month, 8 disputes, 3 fraud reports, and $6,000 of disputed value, on Shopify Payments. Its dispute ratio is 0.80% and its VAMP ratio (11 events over 1,000 orders) is 1.10%. Run through the order: (1) Visa conditional exposure is met on ratio and count (1.10% ≥ 0.5%, 11 ≥ 5) — but only bites if the acquirer is flagged, so the store's next step is to ask, not to panic. (2) The MATCH criterion is not met, because 0.80% is not over 1% despite the $6,000 clearing the amount gate — one more dispute at these orders would not change that either, since 9 over 1,000 is still under 1%; it would need 11 disputes. (3) Shopify NDRP is not met on this month alone (0.80% under 1.5%), and Shopify measures a rolling 90 days anyway. (4) ECM is not met (8 chargebacks, far under 100). (5) VAMP Excessive is not met (11 events, far under 1,500). The store's real exposure is therefore the conditional first line and its processor relationship — exactly the two things a headline-only check would have hidden.

Change one number and the story changes: at 12 disputes on the same 1,000 orders with $6,000 disputed, the MATCH criterion is met (1.20% over 1%, $6,000 over $5,000) — still not a listing, but the store is now one account termination away from a five-year listing, which is a very different conversation with its processor than "we are under 1.5%".

What to do at each limit

At the Visa conditional line: ask your processor, in writing, whether your acquirer portfolio is flagged and what your VAMP count is for the month — the processor's count, not your dashboard's, is the binding one. At the MATCH criterion: treat it as the last warning before termination risk becomes listing risk; fix the dispute source now, because a listing cannot be undone by fixing the cause afterwards. At Shopify NDRP: expect automatic refunds and a 10% reserve, and plan cash flow for the reserve while you bring the 90-day rate below 1.00% for 30 days. At ECM or VAMP Excessive: expect a remediation plan, monthly review, and assessments from the second month — and the same prevention work, because nothing you win after filing lowers the ratio. Across all five, the highest-leverage moves are the same: a billing descriptor customers recognise, painless cancellation and renewal reminders, pre-dispute alerts so a refund replaces a dispute before it posts, and fraud screening before capture rather than refunds after it.

Frequently asked

Visa's 0.5% figure is an acquirer-portfolio line in Visa's fact sheet, but Stripe lists 0.5% with 5 events as a merchant Non-Compliant level — and Braintree's documentation states the mechanism: if the acquirer portfolio is flagged, a merchant at 0.50% with at least 5 events can be notified of inclusion, with $4 or $8 per-event assessments depending on the acquirer tier. A small store can cross 0.5% with a handful of events while believing the 1.5% headline line keeps it safe.

No. MATCH is a terminated-merchant list: meeting the criterion alone does not list you. A listing follows your acquirer terminating your account for excessive chargebacks, and it then stays for five years, removable early only by the acquirer that added you.

No. Monitoring programs count disputes when they are filed and do not consider outcomes — Shopify's NDRP-inclusive rate explicitly includes disputes you win. Winning recovers the money; only stopping a dispute from posting lowers the rate.

Visa's VAMP ratio adds TC40 fraud reports to TC15 disputes, and a transaction appearing in both counts twice. Early fraud warnings that never become disputes still count toward the VAMP ratio.

Shopify Help Center says merchants with an NDRP-inclusive chargeback rate of 1.5% or higher over the last 90 days can be automatically enrolled, with a 10% payout reserve; exit requires the rate below 1.00% for 30 consecutive days. Merchants below an unpublished minimum order volume are excluded.

Small-Store Chargeback Thresholds: The 0.5% Trap and Every Limit Below the Headlines