Imagine waking up to an urgent notice from your payment processor: your account has been flagged as a “High Excessive Chargeback Merchant” (HECM). In an instant, you’re facing hefty fines and the very real threat of losing your ability to accept payments. This scenario is a nightmare for any SaaS or online business.
Unfortunately, it’s a reality for merchants caught in Mastercard’s Excessive Chargeback Program (ECP), and understanding how it works is vital to avoiding costly fees and protecting your revenue.
What is Mastercard’s Excessive Chargeback Program?
Mastercard ECP is a compliance framework designed to identify and rehabilitate merchants with abnormally high chargebacks. In simple terms, it’s Mastercard’s way of saying, “Your dispute levels are too high, fix it or face penalties.”
The ECP has two tiers of severity: the Excessive Chargeback Merchant (ECM) tier and the High Excessive Chargeback Merchant (HECM) tier. Merchants are placed into one of these tiers when they exceed specific monthly chargeback thresholds:
- Excessive Chargeback Merchant: 100 to 299 chargebacks in a single month and a chargeback rate between 1.5% and 2.99%.
- High Excessive Chargeback Merchant: 300 or more chargebacks in a month and a chargeback rate of 3.00% or higher.
Importantly, both the chargeback count and the percentage must be met to trigger enrollment. For example, 250 chargebacks at a 4% rate would not qualify as HECM (because the count is below 300, even though the percentage is high). Conversely, 500 chargebacks at a 2% rate would also not trigger HECM (because the percentage is below 3%). You have to exceed both metrics in the same calendar month to be flagged.
This dual trigger ensures that only merchants with a high volume of disputes and a high ratio are targeted, filtering out anomalies like a small merchant with a couple of chargebacks that happen to make a high percentage.
How Are HECM Thresholds Calculated?
Mastercard calculates your chargeback rate using a simple formula: The number of chargebacks in the current month divided by the number of transactions in the previous month.
The result is your chargeback-to-transaction ratio, often expressed as a percentage (Mastercard may also refer to it in “basis points,” where 100 basis points = 1%). For instance, if you had 10,000 Mastercard transactions in May and 320 chargebacks in June, your June chargeback rate would be 3.2%. Since 320 chargebacks and 3.2% both exceed HECM thresholds (300 and 3.0%, respectively), your business would be tagged as a HECM for June.
To put it another way, 300 chargebacks out of 10,000 transactions is 3%, which is the exact HECM cutoff. Any combination of volume and disputes that pushes you at or above 300 monthly chargebacks and a 3.00% rate (300 basis points) will land you in the HECM program.
ECM vs HECM: What’s the Difference?
Both ECM and HECM are part of Mastercard’s overall Excessive Chargeback Program, but they indicate different levels of severity. The ECM tier is essentially the “warning” stage: Your chargebacks are above acceptable levels (over 100 in a month and >1.5% ratio) but haven’t hit the extreme high mark yet. The HECM tier is the escalation: A red flag that chargebacks are critically high (300+ in a month and ≥3% ratio).
From a merchant’s perspective, being in HECM is far more serious. Fines and penalties are higher for HECM status than for standard ECM (we’ll detail those next), and it sends a clear signal that your business is on very thin ice with both your acquiring bank and Mastercard. If you’re initially flagged as ECM and then in a later month your dispute levels worsen, Mastercard will upgrade your status to HECM for that month, bringing heavier fines.
What Causes HECM Flags?
Knowing why merchants get into chargeback trouble is half the battle. In our experience, merchants who end up in the HECM tier usually have one or more of these issues driving their high dispute rates:
- Friendly Fraud — A significant chunk of chargebacks aren’t “true” fraud – they come from your customers. Friendly fraud is when a customer initiates a chargeback on a legitimate purchase, often due to forgetfulness or buyer’s remorse.
- Refund Policy Failures — If you fail to deliver on customer expectations, chargebacks follow. Merchants that ship products late or not at all, run out of stock without issuing quick refunds, or otherwise drop the ball on fulfillment will face “Product not received” disputes. Similarly, a strict or poorly communicated refund policy can backfire.
- Poor Customer Service — Sometimes the problem isn’t the product, but the support (or lack thereof) afterward. If customers can’t reach you for help, or your support staff is unhelpful, a dispute can seem like the only way for a frustrated customer to get attention.
What Happens When You’re in the HECM Program?
Being identified as a HECM triggers a series of immediate and long-term consequences for a merchant. First, Mastercard will notify your acquiring bank that your merchant ID is in violation. In turn, your acquirer will inform you and typically require you to submit a remediation plan explaining why your chargebacks are so high and how you plan to fix them.
From a financial perspective, Mastercard gives a brief grace period and then starts assessing hefty fines. In the first month that you’re flagged (Month 1), there are no fines yet; it’s effectively a warning month. But if you remain above the thresholds in the following months, the costs add up quickly.
Fines aren’t the only cost. From month four, Mastercard also applies an Issuer Recovery Assessment fee on top of the above fines. This is a charge of $5 for every chargeback above 300 in each month. For example, if you had 500 chargebacks in a HECM month, that’s 200 chargebacks over the 300 threshold, resulting in an extra $1,000 fee (200 × $5).
Beyond fines, there are legal and reputational implications. Mastercard’s goal with ECP is partly to rehabilitate merchants, but also to identify bad actors. If a merchant continually flouts the rules or doesn’t improve, Mastercard can pressure the acquiring bank to take action. Acquirers themselves face scrutiny and even penalties if they keep processing for a merchant who remains non-compliant for too long.
In fact, after about 6 months of continuous HECM status, Mastercard may demand that the acquirer create a plan (at their own expense) to fix the issue, and after 12 months, Mastercard can start fining the acquirer as well. Most banks won’t let it get that far – they will typically terminate a high-risk merchant account rather than risk their standing with Mastercard.
If your account is terminated by the bank due to excessive chargebacks, you’ll likely be added to the MATCH list. This is effectively a blacklist status across the payments industry that makes it very difficult to get approved for a new merchant account.
Exiting the HECM Program
Exiting Mastercard’s chargeback monitoring program is not instantaneous. You’ve got to prove that your business has recovered and can sustain lower dispute levels. The primary requirement is staying below the program thresholds for three consecutive months. In practice, this means bringing your chargebacks under 100 per month and under a 1.5% rate (the ECM threshold) and keeping them there for three months in a row.
Only after achieving three compliant months back-to-back will Mastercard consider you back in good standing and formally close the “audit” on your account. There is no partial credit for dipping below HECM level but still above ECM – you must get under the ECM thresholds to start the clock on those three months.
- For example, if you were HECM in June, and in July you drop to 2% with 120 chargebacks (which is ECM territory), you haven’t exited yet. You’d need August, September, and October all below 100 chargebacks and 1.5% to be out of the program by the end of October.
While working toward that goal, Mastercard (via your acquirer) will expect a remediation or “chargeback reduction” plan from you. This plan is basically your playbook for how you will fix the problem, and it requires careful thought.
What a Remediation Plan Looks Like
Mastercard doesn’t provide a public template for a remediation plan, but guidance from acquirers and experts suggests including the following components:
- Business Context — Begin by briefly describing your business model, products, and any unique circumstances. Then explain the events leading to the increased chargebacks. Was there a product launch that went awry? A supply chain delay? A spike in fraud attacks? Be honest and specific about why your chargeback rate shot up.
- Actions Taken — Outline the specific steps you’ve already implemented to fix the issue. For example, you might list changes like “Updated our billing descriptor on July 1 to reflect our brand,” or “Implemented a new address verification (AVS) filter in our checkout on August 15.”
- Tools Being Used — Highlight any tools or services you are leveraging to prevent future chargebacks. This can include things like fraud detection systems, 3-D Secure for authentication, or pre-chargeback alert services like Ethoca.
- Policy Improvements — It’s wise to also mention internal process improvements. For instance, if you’ve revised your refund policy to be more generous or made your terms clearer, note that. If you’ve bolstered your customer support (extended hours, more channels, faster response commitments), explain those changes.
A well-constructed remediation plan will essentially convince Mastercard and your bank that you have a handle on the situation: You understand why chargebacks spiked, you’re actively addressing each cause, and you have the tools and strategies to prevent it from recurring. Once that plan is submitted, the focus shifts to execution.
Preventing HECM: Best Practices for Merchants
The ideal scenario is to never let your chargebacks reach ECM or HECM territory. While some disputes are inevitable in any business, a proactive approach can keep them to a minimum so that you stay well below Mastercard’s thresholds.
Use Pre-Chargeback Alerts
One of the most effective tools to reduce chargebacks is to catch disputes before they become chargebacks. Services like Ethoca Alerts (for Mastercard/Visa) and Verifi Rapid Dispute Resolution (for Visa) empower merchants with early warnings or automatic resolutions for incoming disputes.
For example, with Ethoca, when an issuing bank receives a dispute from a customer, they can send an alert to the merchant within minutes, allowing you to refund the transaction or resolve the issue before it turns into a formal chargeback. Verifi’s RDR takes it a step further by automatically resolving certain disputes based on preset rules, essentially auto-refunding qualifying transactions immediately so that Visa never counts it as a chargeback.
Improve Billing Transparency
A clear, customer-friendly billing process can preempt a lot of unnecessary chargebacks. Start with your billing descriptor – make sure the text that appears on cardholder statements is recognizable.
Ideally, it should include your brand name (or website) and maybe a customer service phone number. If you’re a SaaS company with a platform name that differs from your legal business name, ensure the descriptor reflects what the customer knows. This prevents the “I didn’t recognize the charge, so I disputed it” scenario. You can often add a short descriptor or city/phone number to give additional clarity.
Optimize Refunds and Customer Support
Think of customer support as your “dispute prevention team.” If a customer has a problem, the goal is to solve it before they feel the need to involve their bank. That means offering responsive, empathetic, and flexible support. Ensure your support channels (phone, email, live chat) are easy to find and operational during convenient hours.
It’s often wise to adopt a “refund when in doubt” policy for low-value or easily resellable items. The cost of a small refund is usually far less than the cost of a chargeback once you factor in fees, penalties, and the risk to your standing. If a customer is unhappy or claims they never got the product, consider offering a refund or reshipment with minimal hassle. Many chargebacks happen simply because the customer felt ignored or stonewalled.
Monitor Trends and Fraud Indicators
Finally, vigilance is key. Continuously monitor your chargeback and fraud metrics so you’re never caught off guard by a compliance program notification. Smart merchants track their monthly chargeback ratio like a KPI, reviewing how many disputes came in and what that translates to as a percentage of last month’s sales.
It’s also crucial to analyze your chargeback reasons. Is a large portion “fraud”? Then maybe you have a fraud gap, so consider adding tools like 3-D Secure, CVV checks, or tightening your fraud filters. Are many disputes “product not received” or “refund not processed”? That points to operational fixes — shipping and refund processes need improvement.
Stay Compliant and Avoid HECM with ChargebackStop
Avoiding Mastercard’s HECM penalties starts with stopping disputes early. With ChargebackStop, you get built-in access to Verifi Rapid Dispute Resolution (RDR) and Ethoca Alerts, helping you resolve disputes automatically before they ever become chargebacks.
No more manual monitoring, missed alerts, or compliance guesswork—just faster resolutions, lower dispute ratios, and stronger protection for your merchant account.
Schedule a free demo to see how ChargebackStop’s automated platform puts chargeback prevention on autopilot.
