Visa VAMP 2026: Why Card Testing Costs More

Short answer: VAMP, the Visa Acquirer Monitoring Program, is Visa's single program for watching fraud, disputes and card testing on online card payments. Its headline change for 2026 came on 1 April 2026, when the excessive-merchant threshold in the US, Canada, the EU and Asia Pacific fell from 2.2% to 1.5% of settled card-not-present sales, according to Visa's own fact sheet. VAMP also measures enumeration, Visa's word for card testing at scale. For a WooCommerce store, the practical message is simple: card testing is no longer just an annoyance in your order list. It is measured by Visa, and your payment provider is under pressure to act on it.

Dated update: this article reflects Visa's fact sheet as checked on 24 October 2026. We will update it if Visa publishes new thresholds or dates.

What is VAMP?#

Visa's article introducing the program says the evolved VAMP took effect on 1 April 2025 and "consolidates five existing fraud and dispute programs into a single acquirer program". Visa's fact sheet adds that updated thresholds took effect on 1 June 2025, and that the advisory period ended on 30 September 2025.

Three terms come up again and again:

• Acquirer: the bank or provider that processes card payments for a merchant. VAMP watches acquirers first, then their merchants.
• TC40 and TC15: Visa's reports for fraud (TC40, filed by the card issuer) and disputes (TC15).
• Enumeration: in Visa's words, "a rapid, brute force card testing attack at scale". Visa says it "leads to $1.1 billion annually in fraud losses".

How is the VAMP ratio worked out?#

Visa's fact sheet gives one count-based ratio for card-not-present Visa transactions, domestic and cross-border:

VAMP ratio = count of fraud reports (TC40) + count of disputes (TC15), divided by the count of settled transactions (TC05)

Two things are taken out, subject to the timing of Visa's data extract: disputes resolved through pre-dispute tools, and TC40 fraud that qualifies for Compelling Evidence 3.0.

A worked example: a store settles 4,000 Visa online sales in a month and receives 30 fraud reports and 30 disputes. Its ratio is 60 ÷ 4,000 = 1.5%. That equals the new excessive level. But the store is below the minimum count of 1,500 reports, so on the merchant thresholds alone it would not be identified.

What are the thresholds?#

Visa's fact sheet says the merchant thresholds apply when the acquirer itself is not Above Standard or Excessive.

Where does card testing come in?#

VAMP has separate enumeration criteria. Visa requires acquirers "to take proactive steps to prevent merchants from exceeding enumeration thresholds":

Card testing hurts twice:

1. The attack itself is counted as enumeration by Visa.
2. The cards that pass can be used for fraud, and the fraud reports and disputes that follow count toward the main VAMP ratio.

An attack of tens of thousands of attempts on a small store would not reach 300,000 on its own. But it can still trigger action from your acquirer or payment provider, who is measured on its whole portfolio.

Why WooCommerce stores are exposed#

Two facts from WooCommerce itself:

• WooCommerce's developer blog reported on 18 December 2024 "card attacks specifically targeting the Store API alone, even without the use of the Checkout block". The Store API checkout endpoint exists on every store with WooCommerce active.
• WooCommerce's own Store API rate limiter is "optional and disabled by default", and its newer "Rate limit Checkout" setting allows 3 place-order requests per 60 seconds. It counts requests, not failed payments, and does not cover the classic checkout.

So a store that has done nothing beyond installing a gateway is relying entirely on the gateway's own defences.

Timeline of the dates that matter#

Visa also says programs for Brazil, Chile and India "will be announced later".

A monthly check you can run in ten minutes#

You cannot see your official VAMP figures, but you can watch the same signals in your own store:

1. Count failed card payments for the month and compare them with successful ones. A sudden jump is enumeration.
2. Count fraud warnings and disputes in your gateway dashboard, and divide by your number of card sales. That is a rough view of your own ratio.
3. List the orders you refunded because of fraud and note how they got through: new account, mismatched country, many cards tried.
4. Check your limits are still on after any plugin or theme update.
5. Write down what you changed and why. If your provider asks how you control card testing, this record is your answer.

What does it cost to do nothing?#

VAMP does not send bills to merchants directly. Visa's fact sheet says identified entities "are required to implement risk mitigation control measures" and tells merchants to contact their acquirer for details. In practice the costs a store sees are:

• failed authorizations and the gateway fees and support time they create;
• fraud reports and disputes on cards that passed a test, which also feed your VAMP ratio;
• stricter rules from your provider, which may include holds, reserves or extra checks, set by them, not by you.

The lower 1.5% threshold since 1 April 2026 leaves less room before a high-dispute merchant is identified.

What to do now, step by step#

1. Turn on WooCommerce's limiter. Settings, Advanced, Features, "Rate limit Checkout". It is free.
2. Turn on your gateway's fraud tools. Stripe lists Radar Lite, with card-testing prevention, at no additional charge on standard pricing. WooPayments has Basic and Advanced fraud protection levels.
3. Count failed payments, not just requests, per IP network, email, browser and card, on the classic checkout and the Store API.
4. Challenge only risky shoppers with a captcha that validates Store API requests, so real customers are not slowed down.
5. Hold risky high-value orders for review instead of shipping them straight away. Each prevented fraud report is one fewer TC40.
6. Answer disputes with evidence, and ask your provider whether pre-dispute tools or Compelling Evidence 3.0 are available, since Visa excludes both from the ratio.
7. Ask your acquirer for your monthly VAMP ratio and enumeration figures. Only they and Visa can tell you where you stand.

How ChargeWarden helps#

ChargeWarden is built for the enumeration side of the problem. It counts attempts and failed payments six ways, per IP address, /24 or /64 network, email, browser, card BIN and last four, and session, on the classic checkout, the Store API, the pay for order page and the add payment method form, and blocks repeat failures before they reach your gateway. When failures spike store-wide, attack mode tightens every limit and can ask every shopper for a Turnstile or hCaptcha check. For the dispute side, every order gets a risk score with written reasons, so risky orders wait in a review queue instead of shipping.

ChargeWarden does not calculate your VAMP ratio; your acquirer does. What it gives you is fewer test attempts, fewer bad orders and a record of the controls you run. See blocked attacks on the live demo, compare it with other tools in WooCommerce anti-fraud plugins compared, or buy ChargeWarden.

This guide is general information, not legal or payments advice. Visa programs change; confirm current figures with your acquirer. Visa is a trademark of Visa Inc.; PluginLoom is not affiliated with Visa.