Questionable Merchant Audit Program (QMAP)

The Questionable Merchant Audit Program (QMAP) is Mastercard's investigative program for identifying merchants engaged in collusive, fraudulent, or otherwise inappropriate transaction activity.

Unlike the Excessive Chargeback Program (ECP) or the Excessive Fraud Merchant (EFM) program, which monitor threshold-based metrics on a monthly cycle, QMAP is case-driven: Mastercard initiates an investigation when suspicious patterns are detected or reported, evaluates the merchant's transaction history over a defined case period, and declares the merchant "questionable" if the evidence meets specific criteria.

QMAP addresses the most severe forms of merchant fraud, including bust-out schemes, transaction laundering, and coordinated fraudulent activity. The program is being revised effective April 1, 2027 alongside the Global Merchant Audit Program (GMAP), with lower transaction thresholds, shorter case periods, and broader merchant eligibility.

‍

‍

‍

Why QMAP Matters

‍

Investigative, Not Threshold-Based

ACMP, ECM, and EFM operate on fixed monthly thresholds that merchants either breach or don't. QMAP operates differently. Mastercard or an issuer identifies suspicious patterns, opens a case, and evaluates the merchant's full transaction history over a defined scope period. This investigative approach catches fraud that stays below monthly monitoring thresholds but shows clear signs of collusive or coordinated criminal activity when examined over a longer window.

‍

Severe Financial Consequences for Acquirers

When Mastercard declares a merchant questionable, the acquirer is debited 50% of actual fraud losses tied to that merchant's activity. These debited amounts are distributed as partial fraud recovery to affected issuers. The acquirer also faces audit fees of up to $2,500 and extended chargeback liability, typically lasting at least one year, during which issuers can file chargebacks under reason code 4849 (Questionable Merchant Activity). If the acquirer continues processing for a merchant after it has been declared questionable, the acquirer assumes full responsibility for all subsequent 4849 chargebacks.

‍

MATCH Listing as a Standard Outcome

Termination of a merchant declared questionable under QMAP results in automatic MATCH listing, flagging the merchant as high-risk across the entire Mastercard network. Unlike ECM or HECM, where MATCH listing is a risk at the end of a prolonged non-compliance period, QMAP cases typically result in MATCH listing as a direct and immediate consequence of the investigation's findings.

‍

‍

‍

How QMAP Investigations Work

‍

1. Case Initiation

Mastercard opens a QMAP case when it detects suspicious patterns through its own monitoring systems, or when an issuer files a report through Mastercard's online reporting form. Triggers include multiple transactions from a single cardholder in a short period, sudden spikes in transaction volume, an unusually high number of transactions linked to bust-out accounts, and recurring dispute patterns reported by issuers.

‍

2. Case Scope Period and Thresholds

Under current rules, Mastercard evaluates the merchant's activity over a 120-calendar-day case scope period preceding the investigation. The merchant must have submitted at least five transactions totaling at least $50,000 during this period. Effective April 1, 2027, the case scope period drops to 30 days (extendable to 60 days), and the minimum transaction volume drops from $50,000 to $10,000. These revisions enable Mastercard to investigate smaller and newer merchant accounts and to identify concentrated fraud over shorter timeframes.

‍

3. Classification Criteria

QMAP uses two classification paths. For bust-out cases, at least 50% of the merchant's total transaction volume during the case period must involve cardholder bust-out accounts. For non-bust-out cases, the merchant must meet at least two of three tests: a fraud-to-sales ratio of 70% or higher, a decline or referral rate of at least 20%, or fraudulent transactions, declines, and referrals exceeding approved transactions by count or dollar amount. Under current rules, non-bust-out cases also require the merchant to have been operating for fewer than six months. This age restriction is being removed in the April 2027 revision, allowing investigation of established merchants.

‍

4. Acquirer Response Window

When Mastercard issues preliminary findings, the acquirer has 15 days to contest the designation by submitting additional supporting information. If the acquirer does not respond or the contest is unsuccessful, the merchant is formally declared questionable.

‍

5. Post-Declaration Obligations

Once a merchant is declared questionable, Mastercard publishes an announcement listing to notify issuers. The acquirer is debited 50% of actual fraud losses. Issuers gain extended chargeback rights under reason code 4849 for a period typically lasting at least one year. If the acquirer terminates the relationship, the merchant is placed on the MATCH list.

‍

‍

‍

QMAP in Practice: A Real-World Scenario

An issuer reports recurring fraud disputes tied to a single merchant processing through a mid-size acquirer. The issuer has received 35 chargebacks from different cardholders, all reporting unauthorized transactions at the same merchant over a six-week period.

‍

Mastercard opens a QMAP case and evaluates the merchant's 120-day transaction history. During this period, the merchant processed $72,000 across 180 transactions. Analysis reveals a fraud-to-sales ratio of 78%, a decline rate of 32%, and more declined transactions than approved ones. All three non-bust-out criteria are met.

‍

Mastercard issues preliminary findings to the acquirer. The acquirer reviews its records and finds no documented underwriting due diligence beyond basic KYB verification. The merchant's website was a template site with stock images, and no web presence analysis was conducted at onboarding. The acquirer does not contest the findings.

‍

The merchant is declared questionable. The acquirer is debited $28,000 (50% of fraud losses), pays $2,500 in audit fees, terminates the merchant, and places them on MATCH. Issuers file additional 4849 chargebacks over the following year, totaling $18,000 in further losses to the acquirer.

‍

‍

‍

Strategic Impact on Payment Providers

‍

Onboarding Quality as the First Line of Defense

QMAP cases frequently reveal gaps in the acquirer's initial underwriting process. Merchants that pass minimal KYB checks without web presence analysis, digital footprint verification, or content review are the most common subjects of QMAP investigations. Strengthening onboarding due diligence directly reduces QMAP exposure. Under the revised rules (effective April 2027), the removal of the six-month merchant age restriction means that even established merchants can be investigated, making ongoing monitoring as important as initial screening.

‍

Lower Thresholds Expand the Investigation Pool

The April 2027 revisions reduce the minimum transaction volume from $50,000 to $10,000 and shorten the case period from 120 days to 30 days. This means smaller merchants processing lower volumes can now trigger QMAP investigations. Acquirers with large numbers of small or micro-merchants, common in payment facilitator models, face expanded QMAP exposure under the revised rules.

‍

Financial Impact Beyond Direct Assessments

The 50% fraud loss debit is the immediate financial consequence, but the extended chargeback liability under reason code 4849 creates ongoing exposure for at least one year after the merchant is declared questionable. Acquirers that continue processing for a flagged merchant absorb 100% of subsequent 4849 chargebacks. The total financial impact of a QMAP case, including fraud debits, audit fees, extended chargebacks, and internal investigation costs, typically exceeds the direct assessment by a significant margin.

‍

‍

‍

How Ballerine Supports QMAP Prevention

‍

Ballerine's fraud and scam detection platform identifies the merchant risk patterns that lead to QMAP investigations before they reach Mastercard's attention. The system analyzes web presence, digital footprint, ownership structure, and transaction behavior during onboarding and through continuous monitoring, detecting transaction laundering, bust-out indicators, and elevated fraud ratios at the merchant level. As one of five solutions globally certified under Mastercard's MMSP, Ballerine helps acquirers reduce scheme fines by up to 75% while preventing the merchant fraud that triggers QMAP cases.

‍