From July 24, 2026, Mastercard is introducing new scam-monitoring requirements for acquirers and payment facilitators, which includes PAYSTRAX. The change is part of a wider industry push to reduce scams and protect cardholders. While much of it happens behind the scenes, it’s worth understanding what it means for your business and how to stay ahead of it.
What the SMMP is designed to do
Scam Merchant Monitoring Program strengthens how scam-related activity is identified across the payments ecosystem. Mastercard now expects acquirers and payment facilitators to actively monitor for scam indicators, review flagged activity and act within a defined timeframe.
The aim is not to penalise legitimate businesses. It is to catch deceptive or fraudulent merchant activity earlier and give genuine merchants a clear, evidence-based way to demonstrate they are operating properly.
When a merchant review may be triggered
Mastercard has defined specific triggers for when an acquirer or payment facilitator may need to review a merchant’s activity. Some apply to all merchants, and a few additional ones apply to newer merchants with six months or less of Mastercard acceptance history.
Importantly, a trigger is not an accusation. As Mastercard puts it, a risk indicator does not confirm scam activity – it simply means further assessment and supporting evidence may be needed. Legitimate explanations, such as a confirmed BIN attack or a processor outage, can be documented and evidenced.
One of the newer-merchant triggers, the combined refund-and-chargeback rate, is worth understanding in a little more detail:
How the 5% threshold is calculated
Formula:
(refunds + chargebacks) ÷ total purchase transactions
Period: rolling 30 calendar days
Minimum activity: at least 500 purchase transactions
Example: 70 refunds + 35 chargebacks ÷ 2,000 purchases = 5.25%, so the threshold is exceeded
The 72-hour window
This is the part most worth planning for. Mastercard requires acquirers and payment facilitators to initiate and complete their review within 72 hours of a trigger being identified. In practice, that means if your payment provider requests information, you may need to provide it within the same short window.
Having records organised and ready in advance makes all the difference between a quick, painless review and a stressful scramble. If a review does turn up real problems, the response can range from closer monitoring to restrictions on processing. That’s why clear records and a quick reply matter so much.
What may be requested
If a review is initiated, an acquirer may request evidence such as website screenshots, customer-journey documentation, order records, customer communications, proof of delivery or service use, refund and cancellation records, chargeback evidence, affiliate monitoring evidence, or a root-cause analysis and remediation plan.
Most of this is information a well-run business already keeps. The key is being able to produce it quickly.
How merchants can stay ahead of it
The reassuring part is that the habits that keep you clear of scrutiny are the same ones that make for a trustworthy, well-run business:
✅ A transparent customer journey: product or service description, price, trial terms, renewal terms, refund rules and cancellation process all clear before payment is made.
✅A clear billing descriptor customers will recognise on their statement.
✅Accessible customer support: visible, accurate and responsive contact details.
✅Accurate marketing: advertisements, landing pages, affiliate content and checkout pages that reflect what is actually being sold.
✅Good evidence retention: order records, customer communications, proof of delivery or service use, refund logs, cancellation records and complaint-handling evidence.
✅Early notification to your to your payment provider of material business changes, including new markets, new traffic sources, new affiliates, technical changes, significant volume increases or changes to the customer journey.
For PAYSTRAX merchants
As an acquirer, PAYSTRAX is already preparing to meet these requirements so that our merchants can navigate them smoothly. Our goal is to help you stay compliant with as little disruption as possible, and to make any review quick and straightforward if one does happen.
If you keep clear records, maintain a transparent customer journey, and let us know about significant changes in advance, you will already be well positioned. And if you have any questions about how the SMMP applies to your business, our team is here to help – just reach out to your dedicated account manager.
