Visa’s Acquirer Monitoring Program (VAMP) is causing problems for acquirers and merchants, both for its design and its rollout. While the motivation to limit losses is understandable, Accertify’s director of global product management, Michael Mallon, said customer frustration is too.
Visa said VAMP combines five fraud and dispute programs, along with 38 remediation processes, into one. It aims to deliver clarity by creating globally aligned fraud thresholds for domestic and cross-border card-not-present transactions. VAMP is also expected to evolve from outlier management into lifecycle risk management.
Acquirers and merchants deemed “above standard” or excessive under VAMP may be subject to enforcement fees. First-time offenders will get a three-month grace period. Following an advisory period that ends on Sept. 30, acquirers may be charged $5 per fraudulent or disputed transaction in the “above standard” category, while acquirers and merchants reaching the “excessive” level are subject to $10 a pop.
“For the global payments ecosystem, which depends on seamless, secure interoperability for success, every participant must do its part for commerce to flourish,” Visa said on March 24. “At Visa, we think about security 24/7/365, our focus and resources going toward constant innovation and education that helps reduce fraud at each point of a transaction…
“Visa is introducing the evolved and improved Visa Acquirer Monitoring Program (VAMP), which seeks to ultimately reduce fraud and enumeration across the global payments ecosystem by helping acquirers improve their risk controls. The new VAMP has the potential to address four times the amount of fraud globally, accounting for more than $2.5 billion in losses, compared to previous programs.”
Why Visa introduced VAMP
Mallon said payments have dramatically evolved over the past 25 years. Digital technology has produced more payment options for more players. Concurrently, technologies, led by artificial intelligence, have allowed fraud to flourish.
This makes identifying real fraud harder for Visa, leading it to demand that acquirers and merchants prove which transactions are legitimate and define the buyer experience. Was it actual fraud or buyer’s remorse? They must provide compelling evidence (data) so fraud or legitimacy can be proven.
“The rapidly evolving payment ecosystem, increasing complexity of players involved, and technological advancements in payment methods have resulted in the rise of fraud, disputes, and enumeration attacks,” Visa said in March. “Enumeration, which is a rapid, brute force card testing attack at scale, leads to $1.1 billion annually in fraud losses. Disputes are also a growing concern; consumers disputed approximately $11 billion worth of charges with U.S. card issuers last year (up from $7.2 billion in 2019), and Visa has a unique ability to help ensure the disputes processed are above board.
“Visa and our clients have a collective calling to protect each party in the payment journey — from acquirers and issuers to merchants and consumers — from fraudulent activity. VAMP creates more seamless controls and processes for acquirers and merchants to effectively deter fraud and enumeration and effectively manage disputes, contributing to a more secure environment.”
Mallon said that Visa is setting higher standards for everyone in the ecosystem. They expect acquirers and merchants to use available technologies to reduce dispute volume. The goal is to accelerate the process so fraudsters can be quickly caught, thereby reducing their impact.
“They want you to do things more speedily, so that the consumer gets made whole quicker, so that the fraud gets out of the network quicker, and ultimately, the ecosystem is cleaner,” Mallon said.
Problems with VAMP
VAMP is rife with issues, beginning with the fact that some sectors have unique traits that lead to more disputes than others. Subscription services may only interact with their customer once per year. Perhaps the customer forgets about the renewal but still initiates a dispute. Its legitimacy is moot at this point; another dispute enters the system.
“It’s an example of the problem,” Mallon explained. “People sign up for the things, and they don’t realize what the end cost is to them, so other businesses are making a business out of trying to help with that visibility in that process.
“But the problem is, when you get charged and you’re unhappy, you always have the recourse of going back to your card company saying, you didn’t authorize this, or it wasn’t as described, or you didn’t get the expected services. Subscriptions are a thorny one, because compelling evidence wants you to show the person has done business with you multiple times, and when there’s 12 months between the two purchases, it’s hard to do that, because really, you don’t have enough history.”
There may soon be some progress here. Mallon said the chargeback process may allow data points like usage rates to give a more holistic view beyond payments alone.
Gambling platforms are fertile chargeback territory. That puts banks in a tough spot.
“There’s always the ability to call the issuing bank, which wants to keep you happy as a customer; that’s the problem as well,” Mallon said. “Their job is to keep the consumer happy, not necessarily make sure the consumer pays for the things they purchased.
“There’s a challenge in that space. Issuers want more data. Merchants would like to provide it. Technology isn’t quite there yet. It’s moving in that direction. It’ll get better over time, but it takes a long time for such a large ecosystem to adopt technology across the board in a meaningful way.”
To say VAMP’s rollout had had a few kinks is polite. Visa initially didn’t count rapid dispute resolutions (RDR) or cardholder dispute resolution network (CDRN) activity in its VAMP calculations. Then it announced at a major conference that such activity would now be part of the calculations. That left more vulnerable industries on a precipice.
“All of a sudden, they had no way to control something that they honestly have little control over,” Mallon said.
Reduced penalty thresholds irking merchants, acquirers
Visa has dramatically reduced the penalty thresholds. Where merchants previously had to be under 90 basis points for fraud and chargebacks separately, they were told the initial combined line was 150 basis points. It is not being enforced during a six-month analysis period scheduled to end on Sept. 30.
Before VAMP, acquirers saw a penalty threshold of 10 basis points for them and a 100-point chargeback to sales. Under VAMP, the acquirer currently has a 50-basis-point standard. Come Jan. 1, 50 is deemed “excessive”, while 30-49 points is “above standard”.
Given the tight timelines, Mallon said merchants will struggle to adapt without declining more transactions, giving more refunds, or making it easier to cancel transactions.
AI and dispute resolution
While AI will be key to the future of dispute resolution, Mallon said its present is murkier. Some programs are better than others. On the fraud side, it allows criminals to pivot quickly.
Over time, AI and machine learning will evolve and help parties detect anomalies and adjust much faster.
Mallon said the Visas have exponentially more data points at their disposal, yet they share little about how they use AI to prevent fraud.
“You would think that they could help the issuer be more efficient, have understanding when something looks funny, and yet the networks, for the most part, don’t talk about how they help issuers or the system. They put that onus back on the issuer and acquirer.”
Mallon is watching how Mastercard, PayPal and Amex react to VAMP.
“It would be nice to understand where they’re going, because they don’t mention anything. In some cases, depending on the industry, you could have 15, 20% of the wallet running through. It would be good to understand if they are going to follow suit with moving towards a technology and database process.”