From chargeback management to fraud monitoring, cross-border enterprises need to re-examine transaction quality.
Payment Risk Management Amid Transaction Growth: Understanding Mastercard ECP and EFM
For cross-border enterprises, transaction growth has always been a core objective of business development.
More orders mean:
• Higher sales;
• More overseas users;
• Greater market share.
But as transaction scale continues to expand, more and more enterprises are encountering a new problem: as orders grow, payment risk grows in tandem.
For example:
• The number of chargebacks continues to increase;
• The proportion of fraudulent transactions rises;
• Acquirers begin to tighten reviews;
• Payment costs keep rising;
• Some users experience a decline in payment experience.
Many enterprises do not realize until they receive a risk alert from their payment provider that payment risk is not a post-sale issue after a transaction is completed, but an important metric affecting a company's long-term growth capability.
In the past, enterprises focused more on "whether an order was successfully paid."
Now, international card networks are focusing more on: "whether these transactions are healthy."
Mastercard monitors chargeback risk and fraud risk respectively through ECP (Excessive Chargeback Program) and EFM (Excessive Fraud Merchant Compliance Program).
For cross-border enterprises expanding globally, understanding these mechanisms has become an important part of payment operations.
I. What Is Mastercard ECP? Why Should Cross-Border Enterprises Pay Attention?
ECP stands for Excessive Chargeback Program.
Simply put, it is a monitoring mechanism established by Mastercard for merchants with high chargeback risk. It focuses not on a single transaction, but on whether a merchant generates transaction disputes beyond a normal range over the long term.
In the past, payment risk management focused more on individual points: a user pays, the system assesses risk, and the transaction is approved or declined.
But as online payment scale expands, the logic that payment networks care about has changed—for Mastercard, whether a single transaction is risky is only the first layer.
More importantly: if an enterprise generates chargebacks on a large scale over a long period, what does that mean?
It may indicate:
• Problems with the product or service experience;
• Insufficient transaction process transparency;
• Inadequate customer after-sales handling;
• Insufficient risk control capabilities;
• Or even the existence of a large number of fraudulent transactions.
Therefore, ECP focuses not just on a single chargeback, but on the enterprise's overall transaction quality.
II. ECP Core Metric: How Is the Chargeback Rate Calculated?
One of ECP's most core metrics is the Chargeback Rate. It is usually calculated as:
Chargeback Rate = Number of Chargeback Transactions in the Current Month ÷ Number of Successful Transactions in the Previous Month
Note: the denominator is usually not the current month's transactions, but the transactions completed in the previous month.
For example, if a cross-border enterprise successfully completed 1 million credit card transactions in January and generated 12,000 chargebacks in February, then the chargeback rate for February is 12,000 ÷ 1,000,000 = 1.2%.
This means that the risk performance shown in February actually evaluates the transaction volume completed in January.
This time lag is crucial—when many enterprises discover an increase in chargebacks, the risk has actually been accumulating in earlier months.
It is also worth adding that in actual monitoring, Mastercard typically sets an absolute chargeback count threshold (e.g., at least 100 chargebacks) and examines whether the threshold is exceeded for consecutive months, to avoid misjudging small-volume merchants due to occasional fluctuations. This is particularly critical for cross-border enterprises experiencing rapid business growth.
III. ECP Looks Not Only at Ratios but Also at Chargeback Volume and Risk Scale
Many enterprises mistakenly believe that as long as the chargeback rate is low, there is no risk. In reality, card networks and payment institutions tend to make comprehensive judgments: chargeback ratio, absolute chargeback volume, risk duration, and business scale.
For example:
• Enterprise A has 10,000 monthly transactions and 200 chargebacks, with a chargeback rate of 2%;
• Enterprise B has 1 million monthly transactions and 20,000 chargebacks, also with a chargeback rate of 2%.
Although the surface ratios are the same, for the payment ecosystem, the risk scale generated by Enterprise B is significantly larger.
Therefore, large-scale cross-border enterprises especially need to be vigilant: as transaction volume grows, are risk metrics expanding in tandem?
IV. What Will Merchants Face After Entering ECP Monitoring?
Many enterprises think the cost of a chargeback is merely compensating the order amount, but the impact goes far beyond that.
Acquirers Strengthen Risk Management
Acquirers are responsible for the overall risk of their merchants. Once a merchant enters the risk monitoring scope, the acquirer may require business information, request improvement plans, increase transaction reviews, or even adjust the cooperation strategy.
Payment Costs Increase
Chargebacks trigger dispute handling costs, risk management costs, and additional operational costs. High-risk merchants may also face higher transaction fees, stricter settlement cycles, and more complex review processes.
Impact on Payment Experience and Conversion Rate
To reduce risk, payment institutions may increase risk control intensity, such as adding verification steps, lowering the approval rate for some transactions, and restricting high-risk payment scenarios. Ultimately, the payment experience of normal users is also affected.
V. ECP Risk Levels: What Do ECM and HECM Stand For?
Mastercard classifies merchants by risk level:
ECM (Excessive Chargeback Merchant)
The chargeback level has exceeded the normal range, and improvement measures must be formulated and implemented.
HECM (High Excessive Chargeback Merchant)
Persistent, high-proportion chargeback risk will face stricter monitoring and significantly higher risk costs.
This can be simply understood as:
• ECM means "your chargebacks already require focused attention"
• HECM means "your chargeback risk has clearly affected the payment ecosystem"
VI. Beyond Chargebacks, Why Did Mastercard Also Launch EFM?
Many enterprises believe that reducing the chargeback rate will solve payment risk, but in reality, chargebacks are only the result of risk. The underlying cause may well be fraud.
For example, card theft, underground industry card testing, automated attacks, account takeover, etc.
Therefore, Mastercard further launched EFM (Excessive Fraud Merchant Compliance Program), which mainly focuses on whether fraud-related transactions exceed a reasonable range.
VII. How Does EFM Determine Whether an Enterprise Has Fraud Risk?
Compared with ECP's focus on "user disputes," EFM focuses on "whether the transaction itself carries fraud risk," primarily based on several dimensions:
Number of Fraud-Related Chargebacks
For example, if an enterprise has 1 million transactions in a month, and 3,000 are explicitly identified as fraud chargebacks, this indicates that the enterprise is facing a relatively high level of fraud attacks. Common fraud chargebacks include:
No Cardholder Authorization: the card number was stolen, and the cardholder did not authorize the transaction;
Questionable Merchant Activity: the merchant has questionable business practices;
Cardholder Does Not Recognize: the cardholder sees an unrecognized transaction on their statement.
Fraud Chargeback Rate
The calculation logic is "Number of Fraud-Related Chargebacks ÷ Number of E-commerce Transactions in the Previous Month."
Assume there were 500,000 online transactions last month and 5,000 fraud chargebacks this month. The fraud chargeback rate is 5,000 ÷ 500,000 = 1%.
This ratio far exceeds normal levels and is highly likely to directly trigger EFM monitoring.
3DS Verification Status
3D Secure is an important identity verification method for online card transactions. Mastercard also monitors whether enterprises have adopted effective authentication measures to reduce fraud, such as whether 3DS verification is enabled for high-risk transactions.
But 3DS is not "the more, the better." 3DS verification adds an extra authentication step to the payment process (such as SMS verification codes, biometric identification, etc.). If 3DS is forcibly enabled for all transactions, some users may abandon payment due to the extra step.
To summarize simply:
• ECP addresses "why users keep filing disputes"
• EFM addresses "why more and more fraudulent transactions are occurring"
ECP and EFM are not mutually exclusive; a merchant can be included in both programs at the same time. Their connection lies in the fact that fraud chargebacks (counted in EFM) are also a subset of all chargebacks (counted in ECP).
VIII. Why Are Cross-Border Enterprises More Likely to Trigger ECP and EFM?
Complex Global Market Transaction Environment
Payment habits, risk levels, and consumer protection rules vary greatly across countries, making it difficult for a unified risk control strategy to cover all markets.
Growth Speed Exceeds Risk Management Capability
Many enterprises in the rapid expansion phase see orders and markets expanding, but their risk control systems do not upgrade in sync, ultimately creating a situation where "revenue is rising, and risk is rising too."
Lack of Transaction Quality Analysis Capabilities
Many enterprises focus only on GMV, order volume, and revenue, while ignoring payment success rate, chargeback rate, fraud rate, and risk performance across different countries and payment methods.
Faced with these structural challenges, what enterprises need is not piecemeal fixes, but a systematic tool that can track transaction quality in real time and automatically adjust risk control strategies.
IX. How Does STAR SAAS Help Enterprises Reduce Payment Risk?
As mechanisms such as Visa VAMP, Mastercard ECP, and EFM continue to improve, what enterprises need is no longer just a payment channel, but a complete set of payment operational capabilities that can improve transaction quality.
STAR SAAS, focusing on cross-border enterprise payment scenarios, helps enterprises transform risk control from a "cost center" into a "competitiveness engine" through payment gateway, risk control, and intelligent routing capabilities.
1. Multi-Dimensional Transaction Analysis That Makes Risk Sources Clear at a Glance
The platform can break down transaction results by country/region, payment method, user behavior, and other dimensions, helping you discover in advance: which markets and channels are quietly seeing rising chargeback rates, giving you the opportunity to proactively optimize before truly hitting card network red lines.
2. Flexible Risk Strategies: No False Positives Against Good Users, No Passing of Bad Transactions
Enterprises can flexibly configure country risk, user risk, amount ranges, and abnormal behavior strategies according to their business characteristics. While precisely intercepting card theft and underground industry card testing, effectively reducing fraud chargeback rates, it avoids simple rules causing false positives against normal users and reduces unnecessary disputes.
3. Deep Integration of Risk Control and Payment Routing
Risk assessment is no longer just "declining transactions," but becomes part of the payment strategy.
• Low-risk users: fast approval
• Medium-risk transactions: dynamically strengthen 3DS verification, directly reducing fraud chargeback rates and staying away from EFM monitoring
• High-risk transactions: intercept fraud and protect overall metrics
Combined with intelligent routing to select the optimal payment channel, it can actually improve the overall payment success rate while reducing risk.
Conclusion
The emergence of Mastercard ECP and EFM represents an important change in the global payment industry:
In the past, enterprises focused on "whether the transaction was completed";
In the future, enterprises must focus on:
"Whether the transaction is healthy"
For cross-border enterprises, payment capability is no longer just a tool for connecting funds, but critical infrastructure affecting growth, security, and user experience.
Order growth is only the first step. What truly determines long-term competitiveness is maintaining stable, secure, and efficient payment capabilities while expanding business scale.
Through data analysis, intelligent risk control, and payment chain optimization, enterprises can achieve sustainable growth in the global market.
