What Does Mastercard's Scam Merchant Monitoring Program Change on July 24, 2026?
Mastercard's SMMP update takes effect July 24, 2026. It applies to card-not-present merchants worldwide except Jordan (Chargeflow, 2026). When a qualifying account crosses the program's threshold, the acquirer or payment facilitator holding that account has to investigate within 72 hours. If they confirm scam-type activity, Mastercard and Maestro processing gets blocked immediately (Justt.ai, 2026).
Here's the mechanism in plain terms. Mastercard takes a rolling 30-day snapshot of refunds plus chargebacks and measures it against transaction volume. The obligation to act lands on your processor. Mastercard monitors your processor. Your processor monitors you.
Card-not-present just means the card wasn't physically swiped or dipped. Nearly every therapy practice running payments through a portal, an app, or a stored card on file falls into that category by default. That includes most practices billing cash pay instead of insurance panels.
Who Does the 5%-and-500-Transaction Trigger Actually Apply To?
This is the part most coverage of the rule glosses over. The 5% refund-and-chargeback rate paired with a 500-transaction floor is documented as a signal for new merchants. Mastercard defines those as accounts with six months or less of acceptance history (cSide, 2026). Established merchant accounts fall under a separate "standard monitoring" track. None of the payments-trade sources describing SMMP specify what that track's thresholds are.
That doesn't mean an established practice is immune to scrutiny under Mastercard's rules generally. It means the numbers making the rounds (5%, 500 transactions, 72 hours) belong to the new-merchant tier, not a universal standard applied to every practice regardless of history. Has your practice been on the same processor for over six months? Then this particular trigger is a low-priority worry. A practice that just switched processors, or just opened, is a different story.
How Many Card Transactions Does Your Practice Run Each Month?
The math matters more than the headline number. A solo clinician seeing 20 to 25 clients a week, each paying by card once per session, runs roughly 86 to 108 card transactions in a typical 30-day month. That's about a fifth of the 500-transaction floor. SMMP's new-merchant signal needs that floor cleared before the 5% rate even gets measured. Note that this is a count of transactions, so what you charge per session doesn't move the number at all.
Scale it up and the picture changes. Take a group practice with five or six clinicians, each carrying a comparable caseload. Count sessions, copays, and any split or corrected charges, and 500 combined card transactions in 30 days is reachable. That's the practical exposure zone: not the median solo LCSW, but a group practice with real combined volume, or any practice still inside its first six months on a new payment processor.
If you don't know your monthly transaction count, ask your payment processor or biller for it. Most processors print it on the monthly statement alongside gross volume, so this is usually a one-minute question rather than a project. It's worth knowing the number before a rule like this makes it matter.
Two Different Mastercard Programs, Two Different Triggers
SMMP isn't Mastercard's only chargeback-monitoring mechanism, and mixing it up with the older one leads to bad math. Mastercard's existing Excessive Chargeback Program (ECM) triggers at 100 to 299 chargebacks a month with a 1.5%+ ratio. The higher tier, HECM, kicks in at 300 or more chargebacks a month at a 3%+ ratio (Chargeback Gurus, 2026).
| Program | Trigger | What it measures | Who it applies to |
|---|---|---|---|
| ECM (Excessive Chargeback Program) | 100 to 299 chargebacks in a month at a 1.5%+ ratio | Absolute chargeback count against a ratio | Mastercard merchants. These sources describe no new-merchant window for it. |
| HECM (High Excessive Chargeback) | 300+ chargebacks in a month at a 3%+ ratio | Absolute chargeback count, higher tier | The same track as ECM, at its upper tier. |
| SMMP (Scam Merchant Monitoring Program) | 5%+ combined refund-and-chargeback rate across 500+ transactions in a rolling 30 days | Combined refund + chargeback rate | Card-not-present merchants worldwide except Jordan. The 5%/500 trigger is documented as a new-merchant signal (six months or less of history). |
SMMP works differently. It measures a combined refund-plus-chargeback rate, not a raw chargeback count, and it's built around the new-merchant window described above. Most private-pay therapy practices sit nowhere near ECM's 100-chargeback floor, because bank-initiated disputes are rare in that relationship. A practice can still fall inside SMMP's new-merchant math if its refund rate runs high during its first six months on a processor.
Here's the part worth underlining. Under the program's combined-rate design, refunds you issue voluntarily count toward the same rate as chargebacks a client's bank initiates. That matters if your practice issues a lot of session-fee adjustments or corrections early on with a new processor. It matters more if you're changing your fee mid-year and correcting a run of charges while clients catch up to the new rate.
What Should a New or Growing Practice Do to Stay Off the Radar?
Good billing hygiene hasn't changed. This rule just raises the cost of skipping it. The fastest way to keep a refund or a disputed charge from ever reaching your processor's radar is to make the transaction self-explanatory before anyone questions it. A few habits do most of the work:
- Get the cancellation and no-show policy signed at intake. A verbal mention is hard to point to later. Put the fee amount in writing, dated, with a signature on it.
- Itemized receipts, every charge, sent automatically. Date, service, session length, rate. It's the same itemization a superbill needs, and six weeks later nobody should be squinting at a mystery line item on a card statement.
- Card-on-file billing needs its own written consent. Before the charge, not after.
- Log every voluntary refund with a date and a one-line reason. Practices skip this one the most. It's also the piece that feeds SMMP's combined rate directly, which makes it a bad candidate for skipping.
- Answer billing questions fast. A client who can reach a human usually calls you first.
This is ordinary protection, and it earns its keep whether or not a monitoring program ever looks at you. It's the same documentation trail that helps a practice if a client's bank does open a dispute, whatever the reason. Clean session notes and billing records that tie a charge to a documented, consented-to service do double duty here. That overlap is part of why I've been opinionated about documentation in the software I work on, VibeCheck.luxury included: the habits that keep clinical documentation defensible tend to keep the billing paper trail defensible too.
The Rest of Mastercard's 2026 Fraud Buildout
SMMP isn't the only piece of Mastercard's 2026 fraud-detection work. The company is separately introducing "Merchant Trust Services" alongside a Merchant Scam & Risk Indicator (MSRI). Both are network-side infrastructure meant to flag risky merchants earlier. In a Mastercard-reported pilot, MSRI identified roughly 80% of merchants that issuers had already flagged as risky. In some cases it did so as much as 90 days before the issuer's own estimate (Mastercard, 2026).
The direction is consistent across all of it. Mastercard is investing in catching problems early in a merchant's life on the network. For a practice opening a brand-new merchant account, that's an argument for getting documentation habits in order on day one, while the account is small and the paperwork is easy.
FAQ
Does this Mastercard rule apply to every therapy practice that takes credit cards?
No. The 5% refund-and-chargeback rate paired with the 500-transaction floor is documented specifically as a new-merchant signal for accounts with six months or less of Mastercard history (cSide, 2026). Established accounts fall under a separate, unspecified "standard monitoring" track.
How many card transactions does a typical solo private-pay therapist run per month?
Roughly 86 to 108, based on 20 to 25 sessions a week over a 30-day month. That's well under the 500-transaction floor SMMP's new-merchant trigger requires before its 5% rate is even calculated.
When does Mastercard's new Scam Merchant Monitoring Program take effect?
July 24, 2026, applying to card-not-present merchants worldwide except Jordan (Chargeflow, 2026).
What happens if my practice's payment processor flags an account under SMMP?
The acquirer or payment facilitator has 72 hours to investigate. If scam-type activity is confirmed, Mastercard and Maestro processing is blocked immediately (Justt.ai, 2026).
Is SMMP the same as Mastercard's Excessive Chargeback Program?
No. ECM and its higher tier, HECM, trigger on absolute chargeback counts (100+ or 300+ a month). SMMP measures a combined refund-plus-chargeback rate against a 500-transaction floor for new merchant accounts (Chargeback Gurus, 2026).