Visa · Fraud
Reason code 10.5: Visa Fraud Monitoring Program
The issuer charges back a transaction because Visa identified the merchant as exceeding its fraud monitoring thresholds and the transaction was reported as fraud. The code takes its name from the retired Visa Fraud Monitoring Program (VFMP); since Visa consolidated VFMP and VDMP into the Visa Acquirer Monitoring Program (VAMP) in April 2025, it functions as VAMP's penalty mechanism against merchants identified at the excessive level. Once identified, issuers can recover reported fraud transactions without meeting the usual dispute requirements, and merchants have essentially no representment rights on a valid 10.5.
Issuer filing window
120 days from the transaction processing date
Merchant response window
typically 20-30 days to respond, depending on the acquirer, though representment rights on valid 10.5 disputes are effectively eliminated
Why 10.5 chargebacks happen
- Your MID exceeded the VAMP excessive threshold, a combined fraud-and-dispute ratio of 1.5% in most regions as of April 2026 that is enforced once you have at least 1,500 combined fraud and dispute transactions in the month, and Visa formally identified it.
- A cardholder reported a transaction as fraud to their issuer, generating the TC40 record that makes the transaction eligible for a 10.5.
- Sustained card-testing attacks inflated your fraud numbers past program thresholds before you noticed.
- Aggressive affiliate traffic delivered stolen-card orders that concentrated fraud on a single MID.
- A prior month's 10.4 problem was never fixed, and the combined VAMP ratio stayed above the identification line long enough for enrollment.
How to fight a 10.5 chargeback
- Accept that representment is generally not available; Visa strips dispute rights on valid 10.5 chargebacks, so your energy belongs in prevention and program exit.
- Verify the transaction was actually reported as fraud and processed while your MID was identified under VAMP; a 10.5 filed outside those conditions is invalid and can be challenged through your acquirer, and note that Visa paused 10.5 filings entirely between May and October 2025 during the VAMP transition, so anything dated in that window deserves extra scrutiny.
- Confirm the transaction was not 3DS-authenticated in a market or program tier where that still matters, and raise it with your acquirer if the filing looks non-compliant.
- Work with your acquirer on the VAMP remediation plan, because bringing the combined fraud-and-dispute ratio below thresholds for the required consecutive months is the only true fix.
- Audit incoming 10.5 activity weekly so you can measure whether remediation is actually bending the curve.
How to prevent 10.5 chargebacks
- Track your combined TC40 and dispute counts against the current VAMP thresholds every month instead of waiting for an identification letter, and verify the thresholds quarterly since Visa has already moved them once.
- Attack the 10.4 pipeline at the source with 3-D Secure, device fingerprinting, and velocity controls, since TC40 reports are what feed the program.
- Shut down card-testing exposure with checkout rate limiting, CAPTCHA, and small-authorization monitoring.
- Vet affiliate and paid traffic sources ruthlessly; fraud-heavy affiliates are the fastest route into the program for high-risk offers.
- Use pre-dispute tools like Order Insight and Rapid Dispute Resolution to intercept cases, while remembering that RDR and CDRN resolutions do not erase the underlying TC40 fraud reports, which still count toward VAMP.
- If you operate several MIDs, monitor each one separately so a single hot MID cannot be quietly identified while blended numbers look healthy.
Frequently asked questions
- Can I fight a 10.5 chargeback?
- In almost all cases, no. Once a merchant is identified at the VAMP excessive level, Visa removes representment rights for fraud-reported transactions, which is exactly what makes the code punishing. The narrow exceptions involve invalid filings, such as a transaction that was never reported as fraud, one processed before identification, or a filing dated between May and October 2025 when Visa had paused the code during the VAMP transition. Challenge those through your acquirer; concede the rest and fix the fraud pipeline.
- How does a merchant become subject to 10.5 now that VFMP is retired?
- Visa retired VFMP and VDMP in April 2025 and consolidated monitoring into VAMP, which combines TC40 fraud reports and non-fraud disputes into one ratio against settled card-not-present transactions. Identification at the excessive level, 1.5% in most regions as of April 2026 and only enforced once you have at least 1,500 combined fraud and dispute transactions in a month, is what opens the 10.5 dispute right for issuers. The inputs include TC40 reports, not just chargebacks, which is why winning disputes does not keep you out.
- How do I get out of VAMP identification?
- You exit by bringing the combined fraud-and-dispute ratio below the program thresholds and holding it there for the required number of consecutive months, typically demonstrated through your acquirer's remediation plan. That means cutting fraud at intake with 3DS, traffic vetting, and card-testing defenses rather than just deflecting disputes, since alert-resolved cases still carry their TC40s. Expect monthly progress reviews and enforcement fees while identified, and expect your acquirer to shut the MID down if the numbers do not move.
Related Visa codes