Can a cardholder trigger a 4849 chargeback?

Not directly. This code is based on the merchant's status in Mastercard fraud monitoring and security bulletins, not on an individual dispute. The cardholder may be unaware a chargeback was filed at all; the issuer initiates it because your merchant location was flagged.

How do I find out if my business is on a Mastercard audit program?

Through your acquirer. Mastercard communicates program identification to the acquiring bank, which is required to notify and remediate the merchant. If you are receiving 4849 chargebacks, ask your acquirer for the specific program status, listing dates, and the exit criteria.

Mastercard · Fraud

Reason code 4849: Questionable Merchant Activity

Issuers file 4849 when a merchant has been flagged under Mastercard's fraud monitoring programs, historically the Global Merchant Audit Program (GMAP), or listed in a Mastercard security bulletin for questionable activity. Unlike most chargebacks, this one is driven by the merchant's compliance standing rather than a specific cardholder complaint. It effectively lets issuers claw back transactions from merchants Mastercard has identified as high fraud risks.

Issuer filing window

typically 120 days from the central site business date

Merchant response window

typically 45 days to respond via second presentment

Why 4849 chargebacks happen

Your MID exceeded Mastercard fraud monitoring thresholds and was published in a security bulletin, allowing issuers to charge back qualifying transactions.
Your merchant account was placed on a Mastercard audit program after sustained elevated fraud-to-sales ratios reported through SAFE data.
Transactions were processed during a period when your merchant location was listed for questionable activity, making them eligible for this chargeback regardless of individual cardholder claims.
An acquirer continued processing for a flagged merchant, and issuers used 4849 to recover fraud-coded transactions from the listed window.

How to fight a 4849 chargeback

Verify through your acquirer whether your merchant location was actually listed in the referenced security bulletin during the transaction date range; if not, the chargeback is invalid.
Confirm the transaction meets the program's qualifying criteria; issuers can only charge back transactions that fall within the listed period and reporting requirements.
Provide evidence the specific transaction was properly authorized and reported, since procedural defects in the issuer's filing can support a second presentment.
Work with your acquirer on the response; 4849 representments are largely a compliance argument between acquirer and issuer, and Mastercom filings here need acquirer coordination.

How to prevent 4849 chargebacks

Keep your SAFE-reported fraud ratio well below Mastercard audit program thresholds by controlling card-not-present fraud at the source.
Monitor monthly fraud basis points per MID and treat any sustained climb as an emergency, since program identification happens on trailing data.
Ask your acquirer for your Mastercard fraud program status regularly; merchants are often flagged months before they feel the impact.
If you operate in a high-fraud vertical, implement 3DS and pre-authorization screening before fraud accumulates, not after a bulletin listing.

Frequently asked questions

Can a cardholder trigger a 4849 chargeback?: Not directly. This code is based on the merchant's status in Mastercard fraud monitoring and security bulletins, not on an individual dispute. The cardholder may be unaware a chargeback was filed at all; the issuer initiates it because your merchant location was flagged.
How do I find out if my business is on a Mastercard audit program?: Through your acquirer. Mastercard communicates program identification to the acquiring bank, which is required to notify and remediate the merchant. If you are receiving 4849 chargebacks, ask your acquirer for the specific program status, listing dates, and the exit criteria.

Related Mastercard codes