Mastercard GMAP: How Fraud and Dispute Monitoring Is Changing in 2027

Mastercard is changing how it monitors fraud and disputes.

The biggest change is straightforward: fraud reported to Mastercard can contribute to a merchant’s GMAP performance even when it never becomes a chargeback. GMAP also introduces new merchant and acquirer categories and gradually tightens the existing Excessive Chargeback Merchant (ECM) threshold through 2031.

For merchants, this means that looking only at your chargeback ratio may no longer give you the complete picture of your Mastercard risk exposure.

So, what is Mastercard GMAP, how will it work, and what should merchants do before April 2027?

Important: Mastercard’s GMAP requirements and implementation details may be updated before the programme takes effect. This article reflects information available as of October 2026 and should be used alongside Mastercard’s latest programme documentation and guidance from your acquirer or payment provider.

What is Mastercard GMAP?

Mastercard GMAP, or Global Merchant Audit Program, is a framework for monitoring fraud and dispute activity at both merchant and acquirer level.

The revised programme is scheduled to take effect on 1 April 2027.

GMAP will replace the current Acquirer Chargeback Monitoring Program (ACMP) and bring Mastercard's existing merchant monitoring categories, including Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM), into the new framework.

It also introduces four new categories:

• High Dispute Merchant (HDM)

• Excessive Dispute Merchant (EDM)

• High Dispute Acquirer (HDA)

• Excessive Dispute Acquirer (EDA)

The objective is to give Mastercard a broader view of fraud and dispute performance rather than treating fraud and chargebacks as completely separate risks.

Why is Mastercard changing the model?

Under the new framework, fraud reported to Mastercard's Fraud and Loss Database (FLD) can count towards the combined GMAP metric even if the transaction does not ultimately result in a chargeback.

That is an important distinction.

A merchant could previously look at its chargeback ratio and conclude that its performance was healthy, while a significant amount of reported fraud remained outside that particular calculation.

GMAP brings these signals closer together.

In simple terms: Mastercard is moving from monitoring chargebacks alone to a broader view of fraud and disputes.

1. Important information for merchants

There are several changes merchants should understand before GMAP takes effect.

Fraud can count even without a chargeback

The new GMAP ratio includes:

Fraud reports + non-fraud chargebacks ÷ previous month's sales

The fraud component is based on transactions reported to Mastercard's Fraud and Loss Database. Non-fraud chargebacks are then added to the calculation.

Fraud-related chargebacks are not simply added again as non-fraud disputes, helping avoid double-counting the same fraudulent transaction.

This means merchants need to monitor reported fraud and chargebacks together, rather than relying exclusively on their chargeback ratio.

New merchant categories have relatively low activity thresholds

The new High Dispute Merchant (HDM) and Excessive Dispute Merchant (EDM) categories can apply to merchants with as few as five cleared transactions in a month, provided the other applicable criteria are also met.

That makes GMAP particularly relevant for merchants with lower or seasonal transaction volumes.

Monitoring can become more granular

For EFM, ECM and HECM, Mastercard is moving towards using the sub-merchant ID when one is available, rather than relying solely on the parent merchant ID.

This is particularly relevant to payment facilitators, marketplaces and other businesses operating with multiple sub-merchants.

ECM thresholds will become stricter

The ECM ratio threshold is scheduled to decrease in stages:

The existing requirement of at least 100 chargebacks remains, while HECM remains at a 3% ratio threshold.

This means merchants that are already operating close to the ECM threshold should not wait until 2031 to start reducing their dispute exposure.

2. How Mastercard GMAP measures fraud and disputes

The new combined metric is one of the most important parts of GMAP.

The GMAP ratio

For the new HDM and EDM merchant categories, the ratio is calculated using:

GMAP ratio = (reported fraud + non-fraud chargebacks) ÷ previous month's sales

For example, imagine a merchant has:

• 10,000 Mastercard sales in the previous month

• 75 transactions reported as fraud to Mastercard

• 25 non-fraud chargebacks

The calculation would be:

(75 + 25) ÷ 10,000 = 1%

The 1% figure is then considered alongside the other requirements for the relevant GMAP category.

This is why merchants need more than a conventional chargeback report to understand their exposure.

Your internal monitoring should bring together:

• Mastercard sales volume

• Fraud reported to Mastercard

• Fraud-related activity

• Non-fraud chargebacks

• Chargeback values

• Merchant IDs

• Sub-merchant IDs where applicable

• Acquirer information

• Transaction trends over time

The earlier merchants can see these metrics together, the more time they have to act.

HDM and EDM thresholds are based on multiple criteria

It is important not to interpret the new ratios in isolation.

A merchant does not automatically enter HDM or EDM simply because its ratio reaches 5% or 50%.

The applicable transaction count, combined fraud and non-fraud dispute amount, and ratio requirements all need to be considered together.

These criteria are assessed over the relevant monthly monitoring period.

The important takeaway is that both the volume and value of disputes matter, not just the percentage.

3. What happens when a merchant enters HDM or EDM?

GMAP introduces two new merchant-level categories based on combined fraud and dispute activity.

For HDM, reported assessments increase after prolonged non-compliance. Mastercard may also notify issuers after a merchant meets the HDM threshold for two consecutive months.

For EDM, the consequences are considerably more serious. After two consecutive months at the EDM level, the merchant can become liable for certain fraud-related chargebacks associated with transactions from the three months before identification and the following six months.

This creates a strong incentive to detect problems before a merchant reaches the highest level.

For merchants, the goal should therefore be to identify deteriorating fraud and dispute performance before Mastercard monitoring thresholds become an issue.

4. What should merchants do before April 2027?

The good news is that merchants have time to prepare.

The best approach is not to wait for Mastercard to identify a problem. Instead, merchants should build their own early-warning system.

Step 1: Calculate your Mastercard exposure

Start by establishing your current baseline.

Review Mastercard transactions across all relevant MIDs and payment providers and calculate:

• Fraud rate

• Chargeback rate

• Fraud + non-fraud dispute rate

• Transaction volume

• Fraud and dispute values

• Trends by country, product, payment method and customer segment

If you use several PSPs or acquirers, make sure the data can be viewed together.

Step 2: Create internal warning thresholds

Do not make Mastercard's threshold your internal target.

Create an earlier warning level that gives your team time to investigate the cause and take corrective action.

For example, if a business is approaching a monitoring threshold, it should already have an escalation process in place.

Step 3: Identify the sources of fraud

Not all fraud comes from the same source.

Look for patterns involving:

• Countries and regions

• BIN ranges

• IP addresses

• Customer accounts

• Email domains

• Payment tokens

• Repeated attempts

• Unusual transaction velocity

• Specific products or subscription plans

This is where a centralised fraud strategy becomes particularly useful.

Step 4: Prevent fraud before authorisation

Rather than relying exclusively on post-transaction chargeback management, merchants should use risk controls before a transaction reaches the processor.

UpGate's Risk Engine allows merchants to define fraud rules based on transaction and customer indicators such as country, BIN range, amount, payment type, IP address, email domain, Customer ID and transaction frequency. Rules can trigger actions including declining a transaction or forcing a 3DS challenge.

The advantage of applying risk controls at the orchestration layer is consistency.

The same risk logic can be applied across connected processors instead of creating separate fraud strategies for each one.

Key takeaway: The earlier you identify potentially fraudulent transactions, the more options you have to prevent downstream disputes.

Step 5: Act on fraud alerts early

Fraud alerts can provide an opportunity to intervene before a dispute becomes a chargeback.

UpGate supports scheme fraud alerts through integrations powered by Verifi and Ethoca, allowing merchants to configure actions such as automatic refunds or adding identifiers to a central Negative Database.

The goal is simple: resolve preventable disputes before they become more expensive problems.

Step 6: Review your dispute-prevention strategy

Look beyond chargeback representment.

Ask:

• Which disputes could have been prevented?

• Which fraud alerts could have triggered an earlier refund?

• Are customers recognising transactions on their statements?

• Are recurring payments generating avoidable disputes?

• Are the same customers, cards or identifiers generating repeated fraud attempts?

The earlier these patterns are identified, the easier it becomes to build targeted prevention rules.

Step 7: Review your acquirer and PSP strategy

Ask your payment partners how they plan to monitor GMAP exposure.

In particular, merchants should understand:

• Which MIDs and sub-MIDs are being monitored.

• How fraud and dispute data is consolidated.

• How Mastercard alerts will be communicated.

• What internal thresholds the acquirer applies.

• What remediation process applies if a merchant's risk profile deteriorates.

Remember that your acquirer may act before you reach a formal Mastercard monitoring threshold.

5. How does GMAP relate to ACMP, ECM, HECM and EFM?

This is one of the easiest parts of the new framework to get confused.

Think of GMAP as the umbrella framework bringing existing Mastercard merchant monitoring categories into a broader fraud-and-dispute environment while adding new merchant and acquirer categories.

Mastercard monitoring: old vs new

The simplest way to remember the change is:

ACMP → GMAP at acquirer level

EFM + ECM + HECM → continue within the broader GMAP framework

HDM + EDM → new merchant categories

HDA + EDA → new acquirer categories

For merchants, the most important new concepts to understand are HDM and EDM.

For acquirers, the focus shifts to HDA and EDA.

6. Acquirers are on the hook too

GMAP is not only a merchant compliance issue.

Mastercard is also introducing monitoring categories for acquirers.

The High Dispute Acquirer (HDA) threshold is reported at 0.5%, while the Excessive Dispute Acquirer (EDA)threshold is 0.7%, subject to the applicable minimum activity requirements.

This matters because an acquirer is responsible for managing the risk across its merchant portfolio.

If an acquirer has a concentration of merchants with high fraud and dispute levels, the impact can extend beyond individual merchant accounts.

The reported consequences for sustained acquirer non-compliance escalate over time. After prolonged non-compliance, Mastercard may require additional review and corrective action, with continued non-compliance potentially leading to restrictions, suspension or termination of the Mastercard licence.

What does this mean for merchants?

It means your acquirer has a stronger incentive to monitor your risk profile.

Acquirers may introduce internal thresholds that are more conservative than Mastercard's published thresholds. Merchants with elevated fraud or dispute rates could therefore face additional scrutiny or remediation requirements before they technically reach a Mastercard GMAP threshold.

For merchants, maintaining healthy fraud and dispute performance is increasingly important not just for avoiding network assessments, but also for maintaining strong relationships with payment providers.

8. Why a payment orchestration layer can help

GMAP makes one thing particularly clear: payment data cannot live in silos.

If a merchant uses multiple PSPs, acquirers and fraud tools, it can be difficult to understand its total exposure.

One processor may show a healthy chargeback ratio while another holds important fraud signals. Looking at each provider independently can therefore create a fragmented view of risk.

A payment orchestration platform can help centralise transaction routing, risk controls and supported fraud and dispute signals.

With UpGate, merchants can apply fraud rules before routing a transaction, maintain a central Negative Database across processors, trigger 3DS based on defined risk conditions and act on supported processor and scheme fraud alerts.

UpGate also supports Visa Rapid Dispute Resolution (RDR) for enrolled merchants, enabling automated pre-chargeback resolution based on merchant-defined rules.

While RDR is a Visa solution rather than a Mastercard GMAP requirement, the underlying principle is relevant: the earlier a merchant can identify and resolve preventable payment disputes, the less likely they are to become costly operational problems.

Frequently Asked Questions About Mastercard GMAP

When does Mastercard GMAP take effect?

The revised Mastercard Global Merchant Audit Program is scheduled to take effect on 1 April 2027.

What does GMAP stand for?

GMAP stands for Global Merchant Audit Program.

What does Mastercard GMAP replace?

GMAP will replace the Acquirer Chargeback Monitoring Program (ACMP) and bring the existing EFM, ECM and HECM merchant monitoring categories into the broader framework. It also introduces HDM, EDM, HDA and EDA categories.

Does GMAP count fraud that does not become a chargeback?

Yes. Reported fraud in Mastercard's Fraud and Loss Database can contribute to the GMAP combined metric even when the transaction does not result in a chargeback.

What is the GMAP ratio?

For the new combined merchant and acquirer categories, the GMAP ratio is calculated using reported fraud plus non-fraud chargebacks, divided by the number of sales from the previous month.

What is a High Dispute Merchant (HDM)?

HDM is a new merchant-level GMAP category. A merchant can qualify when it meets the applicable minimum transaction count, combined fraud and non-fraud dispute amount, and 5% or higher ratio during a month.

What is an Excessive Dispute Merchant (EDM)?

EDM is the more severe merchant-level category. The reported criteria include at least five cleared transactions, at least $10,000 in combined reported fraud and non-fraud chargebacks, and a ratio of at least 50%.

Does reaching a 5% ratio automatically make a merchant an HDM?

No. The ratio is only one part of the criteria. The merchant must also meet the applicable minimum transaction count and combined fraud and non-fraud dispute amount.

What happens if a merchant reaches EDM?

If a merchant reaches the EDM level for two consecutive months, additional fraud-related chargeback liability can apply to transactions from the three months before identification and the following six months.

Will GMAP affect small merchants?

Potentially, yes. The new HDM and EDM categories can be triggered with as few as five cleared transactions when the relevant dollar and ratio thresholds are also met. This means low-volume merchants should not assume they are automatically protected from monitoring.

Are acquirers affected by GMAP?

Yes. GMAP introduces High Dispute Acquirer (HDA) and Excessive Dispute Acquirer (EDA) categories, extending the monitoring framework to the acquirer portfolio level.

How can merchants prepare for Mastercard GMAP?

Start by consolidating Mastercard transaction, fraud and dispute data; calculate your current exposure; establish internal warning thresholds; review fraud-prevention and 3DS rules; act on fraud alerts early; and work with your acquirer or payment partners to understand how your portfolio will be monitored.

Want to see how UpGate can help you build a more proactive fraud and payment strategy? Request a demo with UpGate.