For years, whether Mastercard penalized you for disputes came down to one number: your chargeback ratio. Fraud and chargebacks were tracked separately, and each program looked backward — at disputes that had already happened.
That model is ending. On April 1, 2027, Mastercard replaces its existing fraud and dispute programs with a single framework: the Global Merchant Audit Program, or GMAP. Instead of counting chargebacks alone, GMAP scores fraud and disputes together, every month. It also counts fraud that never became a chargeback.
What this means in practice: a merchant with a clean chargeback ratio can now be flagged — and once flagged, your payment approval rates can drop, which for a subscription business means lost renewals. Here’s how the new system works, and what to do before enforcement begins.
This article covers what GMAP measures, the thresholds that trigger a flag, what a flag costs you, and the steps subscription and card-not-present businesses should take before enforcement begins.
TL;DR
- Starting April 1, 2027, Mastercard replaces its separate fraud and chargeback programs with GMAP (Global Merchant Audit Program).
- GMAP combines confirmed fraud and non-fraud disputes, measured against last month’s settled transactions.
- Fraud counts even when it never became a chargeback.
- Your payment provider has a much lower threshold than you do (0.5% vs 5%), so it crosses the line first and then tightens controls on your account before your own numbers look risky.
- Issuer alerts drop your approval rate; the top tier makes you liable for fraud chargebacks across a ~9-month window.
What is Mastercard GMAP?
Mastercard GMAP (Global Merchant Audit Program) is a single monitoring framework that scores a merchant’s fraud and disputes together, measured monthly against the prior month’s settled transactions. It takes effect on April 1, 2027.
Mastercard used to run several separate programs — one for chargebacks (ECP), one for fraud (EFM), a stricter chargeback tier (HECM), and acquirer-level monitoring (ACMP) — each judging you after the fact. These old programs were backward-looking — they measured disputes after they happened.
GMAP combines it all into one number, and counts fraud even when it never turned into a chargeback.
If you’re already under an open audit in one of the old programs, that history carries over — GMAP doesn’t reset your count.
GMAP also monitors two levels at once: the merchant and the acquirer — the payment provider that processes your transactions. Acquirers have a much lower threshold than merchants (0.5% vs 5%), so yours can get flagged before you do and then tighten controls or restrict your account to protect itself, even while your own numbers still look fine.
How does GMAP calculate a merchant’s score?
GMAP measures your fraud and disputes as a share of your settled transactions, recalculated every month:
(Confirmed fraud + non-fraud chargebacks) ÷ previous month’s sales
- Confirmed fraud — reported through Mastercard’s fraud database, including fraud that never turned into a chargeback.
- Non-fraud chargebacks — disputes filed for reasons other than fraud, such as product or service complaints.
Because the denominator is last month’s sales, the ratio moves with your volume. A slow sales month raises the ratio even if the raw counts hold steady — worth watching around seasonal dips or after a pullback in ad spend.
What are the GMAP tiers and thresholds?
GMAP sorts both merchants and acquirers into tiers based on the combined score, with much lower thresholds at the acquirer level.
| Level | Tier | Threshold | What it signals |
|---|---|---|---|
| Merchant | High Dispute Merchant (HDM) | 5% | Elevated combined fraud and disputes |
| Merchant | Excessive Dispute Merchant (EDM) | Higher, sustained | Severe levels needing immediate action |
| Acquirer | High Dispute Acquirer (HDA) | 0.5% | Elevated activity across the portfolio |
| Acquirer | Excessive Dispute Acquirer (EDA) | Higher, sustained | Sustained portfolio-wide concern] |
The “High” tiers flag a problem that needs attention. The “Excessive” tiers mean the problem is severe and ongoing, and they carry the heaviest consequences. Assessments also escalate the longer an audit stays open, so the cost of sitting in a tier grows month over month.
Two other changes matter for how you’re measured:
- Aggregators lose their cover. GMAP monitors down to the submerchant ID, so a single problem seller can no longer hide inside an aggregator’s total volume. If you run under a payment facilitator or platform, your numbers are judged on their own.
- The chargeback threshold tightens over time. The legacy ECM chargeback threshold drops in stages, from 1.5% toward 0.9% between 2029 and 2031 — less room than you have today.
What happens if you’re flagged under GMAP?
Being flagged isn’t a single penalty. The consequences build in stages, and the longer you stay in a tier, the worse they get:
- Growing assessments. Fees rise the longer an audit stays open, so an unresolved problem costs more each month.
- Issuer alerts. Once you’re above the merchant threshold, Mastercard can notify banks. They then treat your transactions more cautiously, and your approval rate drops — a revenue hit on top of the fees.
- Fraud liability. In the most severe tier, you become liable for fraud-related chargebacks, including transactions from before you were flagged. Losses you could once have disputed now fall on your books.
Getting out takes time: you have to stay below the threshold for three consecutive months.
Which subscription businesses are most at risk under GMAP?
GMAP applies to every Mastercard merchant, but some profiles carry more risk than others. You’re more exposed if you fit one of these:
- Card-not-present by default. Subscription apps bill without a card present on every renewal, the setup GMAP scrutinizes most closely.
- Free trials and negative-option billing. Trials that convert to paid, and plans that auto-renew unless cancelled, generate more “I didn’t authorize this” disputes — which feed straight into your score.
- New merchant accounts. Newer MIDs (roughly their first six months) sit under tighter scrutiny and have little history to absorb a bad month.
- Multiple PSPs. If you process across several providers, no single dashboard shows your combined fraud and dispute ratio — the exact number GMAP measures. You can be over the line in aggregate while every provider looks fine on its own.
The common thread: high renewal volume, dispute-prone billing models, and fragmented visibility. If two or more of these describe you, GMAP should be on your roadmap now, not in 2027.
How subscription apps can prepare for GMAP
You don’t need to wait for April 2027. Everything that keeps you clear of GMAP lowers disputes and protects revenue today, too. Start here:
- Track your combined fraud and dispute ratio per merchant ID, across all PSPs. This is the number GMAP judges you on. If you can’t see it in one place today, that’s the first gap to close.
- Catch disputes before they post. Prevention alerts let you resolve a cardholder complaint before it turns into a chargeback, keeping it off your score.
- Refund confirmed fraud fast. A quick refund on a transaction you know is fraudulent clears both the fraud report and the chargeback before either hits your record.
- Keep your billing descriptor and terms clear. Many disputes come from customers not recognizing a charge. A clear descriptor and visible cancellation terms prevent them.
- Protect your approval rate. A sudden drop signals trouble to issuers and gets worse once you’re flagged. Stable acceptance keeps you clear.
Protect your revenue with FunnelFox Payments
FunnelFox Payments is a full billing and payments infrastructure for subscription apps — routing, subscription management, revenue recovery, dispute prevention, and more. A few of those capabilities map directly to what GMAP now measures:
- One view across all PSPs. FunnelFox brings chargebacks, refunds, and transactions from every provider together in one place, so the combined ratio GMAP measures is a number you can actually see.
- Prevention alerts. Dispute alerts catch a cardholder complaint before it becomes a chargeback, so you can resolve it and keep it off your score.
- Smart routing across providers. Under GMAP your provider can restrict your account before you’re even flagged yourself. Spreading payments across multiple PSPs means one provider tightening up doesn’t take your billing down with it.
The bottom line
GMAP changes the question Mastercard asks: not “how many chargebacks did you have,” but “how much fraud and dispute activity do you generate.” It’s measured monthly, counts fraud on its own, and your provider sees it before you do.
The date is April 2027, but the work starts now: see your real numbers across every provider, resolve disputes early, and keep acceptance stable.
