The Green Sheet Online Edition
June 22, 2026 • 26:06:02
Mastercard's Scam Merchant Monitoring Program (SMMP)
Regardless of advances in system security, scams that exploit human vulnerability will persist. AI is accelerating both the scale and sophistication of these schemes, enabling more convincing deception and increasing pressure on detection systems. At the same time, consumer complaints are rising and regulators are taking a more aggressive stance. Increasingly, enforcement actions are not limited to the bad actors themselves, but extend to the payment ecosystem: processors, payfacs and service providers, where there is evidence that warning signs were ignored or controls were insufficient.
For example, in 2025, Paddle.com agreed to a $5 million settlement with the Federal Trade Commission over allegations that it facilitated deceptive tech-support schemes targeting U.S. consumers.
In a separate matter, Block agreed to pay a $40 million civil penalty to the New York State Department of Financial Services related to deficiencies in its anti-money laundering and compliance controls tied to its Cash App platform. While they each have distinct fact patterns, both cases underscore heightened expectations around fraud prevention and oversight.
Card networks also raise expectations
The card networks are responding in parallel. Visa recently consolidated its fraud and dispute monitoring programs into the Visa Acquirer Monitoring Program (VAMP), enhancing its ability to identify problematic merchant activity earlier in the lifecycle. The shift reflects Visa's position that acquirers should proactively identify high-risk merchants rather than react after significant fraud or chargeback activity has occurred.
Mastercard is taking a similar approach with the introduction of its Scam Merchant Monitoring Program (SMMP), effective July 2026.
SMMP is specifically designed to address scams involving consumer manipulation, where cardholders are induced to authorize transactions under false pretenses. This represents a meaningful shift from traditional fraud models that focus primarily on unauthorized transactions. Under SMMP, acquirers are required to monitor merchant activity across a defined set of risk indicators, including transaction volumes, fraud rates, chargebacks and other behavioral metrics. While these data points are not new, the required response is. When a merchant is flagged under SMMP criteria, the acquirer must initiate an investigation within 72 hours. If scam activity is confirmed, the acquirer is required to take action, including potentially blocking the merchant from processing Mastercard transactions.
Acquirers must monitor and intervene early
Additional scrutiny applies to newly onboarded merchants with limited processing history, and acquirers are expected to incorporate network-provided intelligence, including issuer-reported fraud data and chargeback indicators tied to scam activity. As with Visa's VAMP framework, Mastercard is reinforcing the expectation that acquirers actively monitor and intervene, rather than relying solely on downstream indicators of fraud. These changes present operational challenges. Manual monitoring alone is unlikely to be sufficient given the volume, speed and complexity of emerging scam typologies.
Acquirers will need to leverage automated and AI-driven tools to augment human review and more effectively utilize internal expertise.
The direction is clear: both regulators and card networks are placing greater responsibility on the payment ecosystem to identify and disrupt scam activity earlier. Acquirers must manage third parties accordingly. In many cases, this means protecting consumers even when transactions are technically authorized but induced through deception. 
As founder of Humboldt Merchant Services, co-founder of Eureka Payments, and a former executive for such payments innovators as WePay, a division of JPMorgan Chase, Ken Musante has experience in all aspects of successful ISO building. He currently provides consulting services and expert witness testimony as founder of Napa Payments and Consulting, www.napapaymentsandconsulting.com. Contact him at kenm@napapaymentsandconsulting.com, 707-601-7656 or www.linkedin.com/in/ken-musante-us.
Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.
