UK online merchant reviewing a chargeback dispute notification at their workstation

19 Oct 2026

Chargeback Liability Shift: What UK Merchants Must Know

For UK merchants processing card payments online, understanding the chargeback liability shift is no longer optional. When a customer disputes a transaction, the question of who bears financial responsibility depends on whether specific authentication conditions were met at the point of sale. The chargeback liability shift determines that outcome, and getting it wrong can be costly.

As fraud monitoring programmes tighten across Visa and Mastercard, UK businesses face growing exposure if their dispute rates climb beyond accepted thresholds. Whether you are scaling a direct-to-consumer brand, managing high-volume subscription billing, or expanding into cross-border markets, your approach to payment acceptance directly affects your liability position.

This guide explains how the liability shift works, what the current monitoring programmes require, and what UK merchants can do to protect their dispute rates.

What the Chargeback Liability Shift Means for UK Merchants

A chargeback occurs when a cardholder asks their issuing bank to reverse a transaction. This might follow a claim of fraud, non-receipt of goods, or a dispute about what was delivered. When a chargeback is raised, someone must absorb the financial loss. The chargeback liability shift is the mechanism that decides who that is.

Under standard card scheme rules, merchants are liable for fraudulent transactions they process. However, as Checkout.com's guide to payment liability shifts explains, when a transaction is authenticated through 3D Secure (3DS) and the authentication is successful - with the cardholder completing a frictionless or challenge flow and the Electronic Commerce Indicator (ECI) returning a positive value - liability for fraud-type chargebacks shifts from the merchant to the card issuer.^[1]

This credit card liability shift is significant because it removes the merchant's financial exposure for genuine fraud on authenticated transactions. Issuers who issue the card accept the loss instead. The shift does not apply to all dispute reason codes. Chargebacks based on fulfilment disputes, service not received, or quality issues remain the merchant's responsibility regardless of authentication outcome.

In the UK, Strong Customer Authentication (SCA) requirements mean that 3DS is now mandatory for many online card payments. Merchants who implement 3DS correctly and ensure their payment gateway returns positive ECI values stand to benefit directly from the liability shift on those transactions.

Visa and Mastercard Fraud Monitoring Programmes

Visa VAMP (Formerly VDMP)

Visa's current fraud and dispute monitoring framework is the Visa Acquirer Monitoring Programme (VAMP). It replaced the Visa Dispute Monitoring Programme (VDMP), which was retired on 31 March 2025. According to Ravelin's 2025 analysis of Visa's VAMP changes, VAMP came into effect on 1 April 2025, with enforcement applying from October 2025.^[2]

Under VAMP, Visa monitors merchants through their acquiring banks. The programme applies where a merchant generates a minimum of 1,500 disputes per month. The VAMP ratio is calculated as total disputes divided by total transactions for the same period. For the initial period running from June 2025 to March 2026, the threshold is set at a combined dispute ratio of 2.2%. From April 2026, this tightens to 1.5%.^[2]

Merchants who breach the VAMP threshold face a fine of $8 per card-not-present dispute. Acquirers may also impose remediation requirements or, in persistent cases, terminate the merchant relationship. A three-month grace period applies for merchants who enter the programme for the first time.^[2]

The keyword "visa chargeback monitoring program" that merchants commonly search remains relevant under VAMP, as the programme continues to measure dispute rates with equivalent commercial consequences.

Mastercard Excessive Chargeback Programme

As detailed in Chargebacks911's 2025 Mastercard monitoring guide, Mastercard operates the Excessive Chargeback Programme (ECP), which monitors merchants across two escalating tiers.^[3]

The Excessive Chargeback Merchant (ECM) tier applies when a merchant generates 100 or more chargebacks per month and maintains a chargeback ratio of 1.5% or higher. The High Excessive Chargeback Merchant (HECM) tier applies at 300 or more chargebacks per month with a ratio of 3% or higher. Both thresholds must be exceeded simultaneously for the programme to activate.^[3]

Separately, the Excessive Fraud Merchant (EFM) programme targets card-not-present fraud. Merchants who exceed EFM thresholds may face fines that accumulate month-on-month and can reach significant sums. Acquirers may also require remediation plans before allowing continued processing.^[3]

Dispute reason codes assigned to chargebacks determine which monitoring programme applies and how liability is categorised. Fraud-related codes sit differently from service dispute codes, which is why authentication outcomes remain important throughout a merchant's chargeback response process.

How UK Merchants Keep Dispute Rates Under Control

Managing dispute rates requires action at both the prevention and resolution stages. The following steps help UK merchants maintain position within acceptable programme thresholds.

Implement 3DS correctly. Ensure your payment gateway is configured to trigger 3DS for all eligible transactions, with correct ECI value capture. Successful authentication unlocks the 3DS liability shift on fraud chargebacks and removes those disputes from your net exposure.
Map dispute reason codes. Chargebacks arrive with assigned reason codes that identify the dispute type. Tracking your reason code mix reveals whether your dispute volume is driven by fraud, fulfilment issues, or customer confusion, each requiring a different operational response.
Use pre-dispute resolution tools. Ethoca Alerts and Verifi CDRN allow merchants to resolve disputes before a formal chargeback is filed. Connecting your chargeback management to these networks reduces filed disputes, which directly lowers your monitored ratio.
Apply SCA exemptions carefully. Low-value exemptions, MOTO transactions, and trusted beneficiary flags remove the SCA requirement, but they also remove the 3DS liability shift. Assess whether the friction reduction is worth the increased liability for each transaction type.
Monitor your acquirer reporting. Both Visa VAMP and Mastercard ECP calculate ratios on a monthly basis. Reviewing your dispute data against your transaction volume each month allows early intervention before a threshold breach occurs.

ONERWAY UK supports online merchants with ecommerce payment solutions that include integrated 3DS authentication, giving merchants the technical foundation to secure the liability shift on eligible transactions. For businesses with more complex payment infrastructure needs, ONERWAY's embedded finance capabilities offer additional control over how payment flows interact with your fraud and dispute exposure.

Conclusion

The chargeback liability shift is not a one-time compliance task. It is a live operational variable that interacts with your authentication setup, your dispute reason code mix, your monitoring programme status, and your acquirer relationship. UK merchants who understand how the shift works and who invest in the right payment and dispute controls are better placed to keep their chargebacks within acceptable limits and avoid the escalating costs that come with programme entry.

To assess your current dispute exposure and review your 3DS configuration, explore ONERWAY's payouts and settlement capabilities, or speak directly with the ONERWAY UK team.

Frequently Asked Questions

What is a chargeback liability shift?

A chargeback liability shift is when financial responsibility for a fraudulent card transaction moves from the merchant to the card issuer. This occurs when the transaction has been successfully authenticated through 3D Secure, with a positive ECI value recorded.

Does 3DS always trigger a liability shift?

No. The liability shift applies only when authentication is successful and the ECI value is positive. Exemptions to SCA, such as low-value transactions or MOTO payments, do not carry a liability shift because no 3DS challenge is performed.

What replaced the Visa Dispute Monitoring Programme?

The VDMP was retired on 31 March 2025 and replaced by the Visa Acquirer Monitoring Programme (VAMP), effective 1 April 2025. VAMP uses a combined dispute ratio threshold, beginning at 2.2% and reducing to 1.5% from April 2026.

What are the Mastercard chargeback programme thresholds?

The Excessive Chargeback Merchant (ECM) tier is triggered at 100 or more chargebacks per month and a ratio of 1.5% or higher. The HECM tier activates at 300 or more chargebacks per month and a ratio above 3%.

What dispute reason codes matter most for UK merchants?

Fraud-related codes such as Visa's reason code 10.4 (Other Fraud - Card Absent Environment) are the most significant for CNP merchants, as these are directly affected by 3DS authentication outcomes and VAMP programme calculations.