TC40 data has existed as a fraud reporting mechanism for decades, but its practical importance for acquirers and their merchants has changed significantly over the past two years. The launch of Visa’s Acquirer Monitoring Program (VAMP) in April 2025 placed TC40 reports at the center of a new ratio calculation that determines monitoring status and fee exposure for both acquirers and merchants. Understanding how TC40 data works, what its limitations are, and how to use it proactively has become a more pressing operational requirement than it was under previous monitoring frameworks.
For acquirers and processors, TC40 data serves two distinct functions: it feeds into compliance calculations that affect portfolio risk, and it provides an upstream fraud signal that arrives before chargebacks appear in conventional monitoring. Both functions matter, and both are underutilized by the merchants who most need to pay attention to them.
How TC40 Data Is Generated & What It Contains
A TC40 report is generated by an issuing bank when a cardholder reports a transaction as fraudulent. The issuer submits the report to Visa, which then makes it available to the merchant’s acquirer. The report contains the bank identification number, geographic information about the transaction, currency code, merchant identification information, and details about the reported fraud type.
The distinction between a TC40 report and a chargeback is operationally significant. A chargeback is a formal dispute that initiates a defined process with deadlines, evidence requirements, and liability determinations. A TC40 report is a fraud notification. It records that a cardholder reported fraud on a transaction; it does not initiate a dispute process, and merchants have no mechanism to challenge it. A single fraudulent transaction can generate a TC40 report without ever producing a chargeback, particularly when the transaction value is low enough that the issuer chooses to absorb the loss rather than initiate a formal dispute.
This is where many merchants misunderstand their fraud exposure. A merchant whose chargeback ratio appears manageable may be accumulating TC40 reports at a rate that tells a different story about their fraud profile. Under previous monitoring frameworks, this gap between TC40 volume and chargeback volume was less consequential. Under VAMP, it directly affects compliance status.
TC40 Data & the VAMP Ratio
A seller’s dispute and fraud ratio under VAMP is calculated by adding TC40 fraud reports and TC15 dispute records, then dividing by total settled card-not-present transactions. This formula makes TC40 volume a direct input into the ratio that determines whether a merchant falls within acceptable thresholds or triggers monitoring and fee enforcement.
The double-counting problem compounds this exposure in a way that merchants and acquirers must understand clearly. When a fraud-related transaction produces both a TC40 report and a chargeback, it appears in the VAMP ratio numerator twice: once as a TC40 fraud report and once as a TC15 dispute. A merchant with a high proportion of fraud-driven chargebacks therefore carries a disproportionately elevated VAMP ratio compared to a merchant whose chargebacks are predominantly non-fraud disputes.
The practical consequence of this calculation becomes visible with a straightforward example. Under previous monitoring frameworks, a merchant with 70 fraud disputes and 10 non-fraud disputes out of 10,000 transactions carried a ratio of 0.8%, just below the enforcement threshold. Under VAMP’s current formula, the same merchant carries a ratio of 1.5%, which as of April 2026 sits at the merchant excessive threshold. The underlying transaction profile hasn’t changed; the calculation methodology has.
VAMP applies separate thresholds at the acquirer level and the merchant level. The acquirer excessive threshold is 0.7% at the portfolio level. The merchant excessive threshold sits at 1.5% as of April 2026. Acquirers facing portfolio-level pressure often impose merchant-level thresholds below the published merchant limit to maintain adequate buffer. A merchant who believes they are safely below Visa’s published threshold may still face acquirer-imposed consequences if their TC40 volume is elevating the processor’s portfolio ratio.
TC40 Data as an Early Warning Signal
The timing of TC40 reports relative to chargebacks is one of their most operationally useful characteristics, and one that receives insufficient attention in most discussions of fraud monitoring. TC40 reports are filed by issuers when cardholders report fraud, which typically happens before the issuer has initiated a formal chargeback. This means TC40 volume can indicate emerging fraud exposure before it appears in chargeback data.
For acquirers monitoring merchant portfolios, a spike in TC40 reports against a specific merchant signals that fraud is being reported at a higher rate than chargebacks currently reflect. The lag between fraud reporting and chargeback initiation varies, but it creates a window during which intervention can reduce the eventual chargeback volume. Merchants who receive early notification of elevated TC40 activity can investigate the source, adjust fraud controls, and potentially intercept some disputes before they advance.
This upstream signal is particularly valuable for identifying card testing attacks and credential stuffing campaigns, both of which generate TC40 reports through the fraudulent transactions they produce. A sudden increase in TC40 reports concentrated in a short timeframe, particularly from multiple geographic locations or involving similar transaction amounts, indicates automated attack activity that may be early in its cycle. Acting on this signal early limits the fraud that ultimately reaches chargeback status.
The monitoring gap that undermines this early warning function is straightforward: many merchants don’t track TC40 volume independently from their chargeback data. If a merchant only monitors chargebacks, they have an incomplete picture of their fraud exposure and their VAMP ratio risk. Acquirers who make TC40 data visible to merchants as a distinct metric, separate from chargeback counts, close this gap and give merchants the information they need to respond before their ratio deteriorates.
Limitations & Pitfalls of TC40 Data
Several characteristics of TC40 data limit its usefulness and create operational challenges that merchants and acquirers need to account for.
Merchant notification is not automatic. When a TC40 report is filed against a merchant’s transactions, the merchant is not typically informed directly. The report goes to Visa and to the acquirer; whether it reaches the merchant depends on how proactively the acquirer communicates this information. Merchants who aren’t receiving regular TC40 data from their processors are operating without visibility into a metric that now directly affects their compliance status.
TC40 reports cannot be challenged. Unlike chargebacks, which merchants can contest through the representment process, TC40 reports have no equivalent dispute mechanism. If a TC40 report is filed on a transaction that the merchant believes was legitimate, there is no formal process for removing it from the record. This asymmetry makes prevention more important than response for fraud-driven ratio exposure.
Write-offs generate TC40 reports even without chargebacks. When an issuer absorbs a fraud loss rather than initiating a dispute, the TC40 report still gets filed against the merchant. This means merchants can accumulate TC40 volume from low-value fraud transactions that never produce chargebacks and never appear in conventional dispute monitoring. A merchant processing many small transactions is particularly exposed to this dynamic.
High TC40 volume doesn’t always indicate a single, identifiable problem. TC40 reports can accumulate from multiple sources simultaneously: ongoing fraud campaigns, account takeover activity, friendly fraud misclassified as unauthorized transactions, and legitimate fraud on genuinely compromised cards. Distinguishing between these sources requires analyzing TC40 data at the transaction level rather than treating the aggregate count as a single signal.
What Acquirers & Processors Should Do
The most direct action acquirers can take is making TC40 data visible to merchants as a regular part of risk communication. Merchants who receive their TC40 counts alongside their chargeback data can track both components of their VAMP numerator, understand their true compliance exposure, and respond to changes in either metric promptly. Merchants who only see chargeback data are managing half the picture.
Portfolio-level TC40 monitoring serves the acquirer’s own compliance interests alongside the merchant’s. Acquirers facing VAMP ratio pressure need visibility into which merchants are contributing most significantly to their TC40 count and whether recent changes in TC40 volume indicate emerging problems that will affect chargeback figures in the coming weeks. Building TC40 trend monitoring into standard portfolio oversight workflows creates the visibility needed to respond before ratio deterioration reaches enforcement thresholds.
When TC40 volume spikes for a specific merchant, the appropriate response is a proactive operational review rather than a reactive conversation after thresholds have been breached. The review should examine what fraud types are generating the reports, whether existing fraud controls are appropriately configured for the merchant’s current transaction profile, and whether the spike reflects an active fraud campaign or a gradual increase indicating systemic control gaps. TC40 data alone doesn’t answer these questions, but it provides the trigger to ask them at the right time.
Compelling Evidence 3.0 offers one mechanism for reducing TC40 impact on VAMP ratios in specific circumstances. When a merchant successfully uses CE 3.0 to demonstrate that a disputed transaction was legitimate, Visa removes the associated TC40 report from the fraud count. For merchants with elevated friendly fraud rates where transactions are misclassified as unauthorized, CE 3.0 representment can reduce TC40 volume in addition to recovering revenue. This connection between representment strategy and ratio management represents a practical tool that processors should be discussing with merchants whose TC40 volume includes a significant proportion of misclassified disputes.
TC40 data has always been a component of fraud monitoring, but its role in VAMP ratio calculations means that acquirers and processors who treat it as background information rather than an active management input are leaving their merchants exposed to compliance consequences that earlier intervention could have prevented.
