Visa VAMP Explained: The New Dispute Rules Every Subscription Founder Should Know

Visa VAMP is the Visa Acquirer Monitoring Program, the single program that replaced the old VDMP and VFMP dispute and fraud monitoring programs in 2025. It watches one number: your VAMP ratio, which combines fraud reports (TC40) and disputes (TC15) against your settled transactions. Cross the line and your acquirer gets fined, which means you get fined, and in the worst case you lose the ability to process Visa cards at all.

If you run subscriptions on Stripe, this matters more than it used to. The merchant Excessive threshold tightened to 1.5% on April 1, 2026, according to Visa program updates reported by the Merchant Risk Council. That is down from 2.2% when the program launched. The room for sloppy billing practices just got a lot smaller.

What actually changed

Under the old setup, fraud and disputes were watched by two separate programs with separate thresholds. VAMP merges them into one ratio. Three things subscription founders should know about how it works:

• •One ratio now counts both TC40 fraud reports and TC15 disputes. A customer who calls their bank saying 'I never signed up for this' lands in the same bucket as actual stolen-card fraud.
• •Enumeration (card testing) transactions count too. If fraudsters run test cards through your checkout, those attempts feed the ratio even when they fail.
• •The Excessive threshold for merchants dropped from 2.2% to 1.5% on April 1, 2026. Acquirers have their own tighter thresholds (0.5% and 0.7%), which is why Stripe and other processors get nervous about your dispute rate long before Visa contacts anyone.

There are minimum transaction counts before a merchant lands in the program, so a two-person SaaS is unlikely to wake up inside VAMP overnight. But your acquirer watches the same math at lower volumes, and Stripe will warn you, restrict payouts, or ask for a remediation plan well before Visa gets involved. The program is the stick; the warnings are the early signal.

Why subscriptions are exposed

Recurring billing has a structural dispute problem that one-time e-commerce does not: the customer relationship is long, and memory is short.

Think about how a subscription dispute actually happens. Someone signs up in January, uses the product for two weeks, forgets about it, and sees the charge in June. They do not remember your brand name. The descriptor on their statement says something cryptic. They are not angry, they are confused, and the fastest path for a confused customer is the dispute button in their banking app.

That is friendly fraud, and for subscription businesses it is the majority of disputes, not the edge case. Industry reporting from chargeback vendors consistently puts first-party misuse ('I do not recognize this', 'I already canceled') ahead of true stolen-card fraud for recurring merchants. Your VAMP ratio does not care whether the dispute was honest confusion or deliberate theft. It counts the same.

The failed-payment connection nobody makes

Here is the part that surprises founders: your dunning flow is a dispute-prevention tool. Sloppy payment recovery generates disputes in three predictable ways.

• •Silent retries. A card fails, your system retries it six times over two weeks, and one finally goes through. The customer sees a charge on a random Tuesday for a product they mentally canceled. Dispute.
• •Robotic dunning emails from no-reply@ addresses. The customer never reads them, so the successful retry later is a complete surprise. Surprise is the raw material of disputes.
• •Hard-to-find cancellation. A customer who cannot cancel in two clicks does not email you. They call their bank. Every 'how do I cancel' buried in your docs is a future TC15.

Flip it around and the same flows become your defense. A dunning email sent from a real address that names the product, the amount, and the next retry date creates a paper trail. When the charge later succeeds, the customer was warned, in writing, with the exact amount. That email is both a recovery tool and dispute evidence.

A founder's checklist for staying under 1.5%

You do not need an enterprise risk stack. You need boring hygiene, done consistently:

• •Fix your statement descriptor. It should match the name customers know you by, not your legal entity or a random abbreviation. This alone kills a large share of 'I do not recognize this' disputes.
• •Send a receipt for every successful charge, instantly. No exceptions, including retried charges that succeed days later.
• •Warn before annual renewals. A 7-day heads-up email before a $500 annual charge is the cheapest dispute insurance that exists.
• •Make cancellation findable in under two clicks, and confirm it by email immediately. An ex-customer with a confirmation email does not dispute; they just leave.
• •Watch your dispute ratio monthly in the Stripe dashboard, not quarterly. Divide disputes by settled charges. If you are trending toward 0.5%, act now, not when a warning arrives.
• •Treat every dispute as data. If three disputes in a month all say 'did not recognize the charge', that is a descriptor problem, not a fraud problem.

"A dispute is usually a customer you confused, not a criminal you caught. Design your billing flow to confuse nobody."

Where to actually see your exposure

You do not need to wait for a warning letter to know where you stand. In the Stripe dashboard, the disputes view under Payments shows every dispute with its reason code and status. Export a few months of them and divide the monthly dispute count by your monthly successful charge count. That ratio is the number Visa-style math cares about, and watching it monthly turns VAMP from a scary acronym into a metric you manage like churn.

One nuance worth knowing: fraud reports (the TC40 side) do not always show up as disputes you can fight. A cardholder can report fraud to their bank without a formal chargeback ever reaching you, and it still feeds the ratio. This is why the prevention work matters more than the fighting work. You cannot respond your way out of a report that never became a dispute.

What to do if you get warned

If Stripe or your acquirer flags your dispute rate, do not panic and do not ignore it. Ask for the breakdown: which reason codes dominate, which products, which months. Reason code 10.4 (fraud) on a subscription with months of successful history is usually friendly fraud, and Visa's Compelling Evidence 3.0 rules now let you fight those with transaction and usage history. Fix the top cause first, document what you changed, and reply to your acquirer with the plan. They want a merchant who responds, and the founders who get in real trouble are the ones who go quiet.

One practical note on remediation plans: acquirers usually give you a window to bring the ratio down, measured in months, not days. Use it. Pick the two fixes with the biggest expected impact, ship them in week one, and report progress proactively instead of waiting to be asked. A founder who sends an unsolicited 'here is what we changed and here is the trend' email every two weeks almost never gets a second warning.

One more angle worth knowing: personal dunning emails, sent from your own address instead of a no-reply robot, do double duty here. They recover the failed payment, and they prove the customer knew exactly what was being charged and when. That is the philosophy behind StayPaid: recovery that sounds like a person, because confused customers dispute and informed ones update their card.