Questionable Merchant Audit Program (QMAP): Affects on Issuers and Acquirers

The Questionable Merchant Audit Program (QMAP) was developed by Mastercard to identify and manage merchants who might be involved in fraudulent or dishonest activities. It sets standards for merchant behaviour and flags those who don’t meet these standards, helping issuers (banks that issue credit cards) recover some of their losses from fraudulent transactions linked to these merchants.

QMAP identifies questionable merchants by spotting suspicious activities, such as unusual transaction patterns or high chargeback rates. If Mastercard suspects a merchant, it starts an investigation and informs the acquirer, who must provide more information. If fraud is confirmed, the acquirer must end their relationship with the merchant, and issuers are allowed to recover their losses through a chargeback.

What is a Questionable Merchant?

A questionable merchant refers to a business that engages in activities raising red flags leading to disputes or chargebacks from customers. These merchants might sell counterfeit or unauthorised products or engage in deceptive marketing practices that mislead consumers.

Mastercard’s QMAP has clear rules to spot potentially fraudulent merchants, using different criteria for those involved in bust-out accounts compared to those that aren’t.

QMAP Criteria Involving Bust-Out Accounts

For a merchant to be classified as engaging in bust-out fraud under QMAP, the following criteria must be met:

• Transaction Volume: The merchant submitted at least USD 50,000 in transaction volume during the case scope period (the 120-calendar-day period before Mastercard starts an investigation).
• Transaction Count: The merchant submitted a minimum of five transactions to one or more acquirers during the case scope period.
• Bust-Out Accounts: At least 50% of the merchant’s total transaction volume involved cardholder bust-out accounts.

Alternatively, at least three of the following four conditions must apply:

1. High Fraud Ratio: The fraud-to-sales transaction ratio was 70% or higher.
2. Declined Transactions: At least 20% of the merchant’s transactions were declined by the issuer or received a “01-Refer to issuer” response.
3. New Merchant: The merchant has been submitting transactions for less than six months.
4. Fraud Exceeds Approvals: The total number or dollar amount of fraudulent transactions, declines, and issuer referrals exceeded the total number or dollar amount of approved transactions.

This criteria helps Mastercard isolate merchants who are processing a high volume of transactions related to fraudulent accounts, indicating their involvement in bust-out schemes.

QMAP Criteria Not Involving Bust-Out Accounts

In cases where non-bust-out accounts are involved, QMAP uses a different set of criteria to assess questionable merchant activity:

• Transaction Volume: At least USD 50,000 in transaction volume during the case scope period.
• Transaction Count: At least five transactions were submitted to one or more acquirers during the case scope period.

In addition, at least three of the following four conditions must be met:

1. High Fraud Ratio: A fraud-to-sales ratio of 70% or higher during the case scope period.
2. Declined Transactions: At least 20% of all transactions were declined by the issuer or received a “01-Refer to issuer” response.
3. New Merchant: The merchant has been submitting Mastercard transactions for fewer than six months.

While bust-out accounts may not be involved, this level of activity can still indicate fraudulent practices, such as transaction laundering or processing unauthorised charges.

Safeguarding Acquirers and Issuers from Fraud

Mastercard employs a proactive approach to monitor transaction activity for signs of collusion or fraud, focusing on identifying suspicious patterns. These patterns may include high-risk behaviours such as multiple transactions from a single cardholder made within a short period of time, sudden spikes in transaction volume, or an unusually high number of transactions associated with bust-out accounts—those created with the intent to default. When such patterns are detected, Mastercard may initiate an investigation.

Additionally, if a bank notices a recurring pattern of disputes with a particular merchant, it can report this to Mastercard through an online form, prompting further investigation at Mastercard’s discretion. The findings from this investigation will determine whether issuers can recover losses related to fraud.

Here’s how QMAP impacts acquirers and issuers:

Impact on Acquirers

• Investigation Notifications: Acquirers are notified when a merchant they process for is under investigation. If Mastercard determines that the merchant is questionable, acquirers are informed through Mastercard’s Company Contact Management system.
• Challenging Findings: Acquirers have 15 days to contest Mastercard’s preliminary findings. If they disagree with the questionable merchant designation, they must submit additional information to support their case.
• Audit Rights: Mastercard has the authority to audit the acquirer’s records to further investigate the merchant’s activities. Acquirers are required to cooperate and provide the necessary documentation.
• Chargeback Responsibility: If a merchant is flagged as questionable, acquirers may face extended chargeback responsibilities. Mastercard will specify a chargeback period (typically lasting at least one year) for fraudulent transactions involving the merchant. If the acquirer continues to work with the merchant after they’ve been declared questionable, they assume responsibility for chargebacks using reason code 4849 “Questionable Merchant Activity”.
• Financial Penalties: Acquirers may face penalties if a merchant is declared questionable. Mastercard can charge up to $2,500 in audit fees, and if the acquirer terminates the relationship, the merchant is added to the MATCH system, which flags them as high risk.

Impact on Issuers

• Recovering Fraud Losses: If the merchant is confirmed to be engaged in fraudulent activities, issuers can recover a portion of their fraud losses during the defined “case scope period,” which is set by Mastercard.
• Notifications from Mastercard: When a QMAP investigation has taken place and the merchant has been confirmed as a questionable merchant, Mastercard alerts the issuers by listing them in a Mastercard announcement.
• Filing Fee: Issuers must pay a $500 filing fee when reporting a questionable merchant to Mastercard, with the potential to have this deducted at the end of the investigation.
• Administrative Fee: After investigating, Mastercard may charge an administrative fee equal to 15% of the amount recovered from the questionable merchant.
• Fee Deductions: If the administrative fee (15% of recovery) is equal to or greater than the $500 filing fee, Mastercard will deduct the filing fee from the administrative fee. If the administrative fee is less than the filing fee, the issuer will not be charged the administrative fee.

Why QMAP Is Important

QMAP provides a clear framework for identifying and managing merchants who engage in fraudulent behaviour, ensuring that both issuers and acquirers play their part in maintaining the integrity of the payment system. By setting clear rules, QMAP helps protect financial institutions from significant losses and fosters trust across the industry.

One of the key features of the QMAP program is its ability to balance the financial burden of fraud between issuers and acquirers. Under QMAP, acquirers (who process transactions for merchants) are debited 50% of the actual fraud losses tied to questionable merchant activity. These debited amounts are then paid out as partial fraud recovery to the issuers that were impacted by the fraudulent activity.

QMAP encourages banks that work with merchants (acquirers) to be more careful when checking out new businesses. It also helps banks that give out credit cards (issuers) get back some money they lost because of fraud. This way, both sides have to work together to spot and stop fraud.

Everyone involved needs to take QMAP seriously. They should answer questions quickly when there’s an investigation, report any fraud they see right away, and be careful about which merchants they work with. If they don’t do these things, they might get in trouble or have to pay fines.

Final Thoughts on QMAP’s Impact on Fraud Mitigation

QMAP plays a vital role in Mastercard’s ongoing efforts to combat fraud and safeguard both consumers and the financial system from unethical merchants.

By monitoring merchant behaviour, QMAP helps create a safer, more transparent payment environment, ensuring swift action against questionable merchants and minimising fraud. The program identifies questionable merchants involved in various fraudulent activities, including bust-out schemes, addressing these issues quickly and distributing fraud losses more equitably between issuers and acquirers.

As fraudsters employ increasingly sophisticated tactics, initiatives like QMAP become essential in maintaining the security and integrity of global payments. Mastercard’s ability to adapt and respond to evolving threats through QMAP contributes significantly to the overall stability and trustworthiness of the payment ecosystem.