TC40

TC40 is Visa's internal fraud-reporting data record, submitted by issuing banks to Visa's Visa Risk Identification Service (RIS)|Risk Identification Service (RIS) when a cardholder reports a transaction as fraudulent. It is not a Chargeback|chargeback — no money moves when a TC40 is filed — and it does not initiate the dispute cycle. Instead, TC40 is a fraud signal that flows from the issuer through Visa's Visa Dispute Management System (DMS)|Dispute Management System (DMS) to the merchant's acquirer, and may (at acquirer discretion) be shared with the merchant. The SAFE (Mastercard)|Mastercard equivalent is the SAFE report (System to Avoid Fraud Effectively).

TC40 has taken on outsized compliance significance since June 2025, when the Visa Acquirer Monitoring Program (VAMP) consolidated Visa's legacy fraud and dispute monitoring programs and made TC40 fraud reports a direct numerator in the VAMP ratio.

How TC40 works

The filing chain, as described by Verifi (a Visa-owned subsidiary), runs as follows: a cardholder flags a transaction as fraudulent with their issuing bank → the issuer submits a TC40 to Visa RIS → Visa compiles the data and distributes it to the relevant acquirer → the merchant may review flagged transactions by requesting data through their acquirer. (verifi.com, as-of 2026-07-25)

A TC40 data claim is typically released within days of the initial fraud report, but these claims do not stop a chargeback from being filed separately. (verifi.com, as-of 2026-07-25) TC40s are not limited to confirmed fraud — issuers can file TC40s on transactions they are monitoring without a formal dispute ever being initiated, because low-value disputes are often written off by issuers rather than processed as chargebacks. The TC40 is still filed even when no chargeback follows. (cside.com, 2026-04-21)

Merchants are not automatically notified when a TC40 is filed against one of their transactions. Acquiring banks are not required to share TC40 data, and many do so only monthly or quarterly. (verifi.com; corepay.net, 2026-02-05) With the increased compliance importance of TC40 under VAMP, most acquirers have begun making this data more readily available, though it is not universal. (chargebackgurus.com, 2025-11-13)

TC40 report contents

A standard TC40 data claim report includes, per Chargebacks911 (updated 2026-01-05):

• The issuing bank that reported the fraud and the acquiring bank that processed the transaction
• Merchant ID, name, and location; merchant category code (MCC)
• Date and time of the reported transaction; dollar amount; partial card number and cardholder contact details
• Whether the transaction was card-present or card-not-present
• IP address, device ID, or other digital fingerprints (if available)
• Chargeback reason code (if a dispute has been initiated); authorization details
• Date the issuer submitted the TC40 report

Checkout.com's Reported Fraudulent Transactions Report (sourced from TC40 and SAFE data) additionally captures: Fraud Issue Date, Fraud Type, Fraud Reason (e.g. "Card Not Present Fraud"), ECI value, CVV Check result, AVS Check result, 3DS Version, and Issuing Bank. If the issuer generates a TC40 more than one year after the original transaction date, Visa's Fraud Reporting System cannot include the amount — it displays as 0. (checkout.com docs, 2025-09-10)

TC40 in the VAMP ratio

Since Visa Acquirer Monitoring Program (VAMP) launched on June 1, 2025 (replacing VFMP and VDMP), TC40 fraud reports are the "fraud" numerator in the single combined VAMP ratio. Stripe's live documentation defines this directly: "Fraud is defined as early fraud warning (EFW) data sourced from Visa's TC40 reports." Early fraud warnings are informational messages about suspected fraud — not disputes — but Visa's VAMP program includes them in its calculations. (docs.stripe.com, as-of 2026-07-25)

The VAMP ratio formula, per Checkout.com's official documentation (2026-04-08):

(TC15 non-fraud disputes + TC40 fraud reports − exclusions) ÷ Total settled transactions (TC05)

A critical mechanic: a single transaction that generates both a TC40 fraud report and a TC15 chargeback counts twice in the VAMP numerator. (docs.stripe.com; chargebacks911.com, 2026-05-01)

VAMP thresholds effective April 1, 2026 (as-of 2026-06-12, Checkout.com primary):

Tier	Threshold	Minimum count
Merchant Excessive (global, excl. MENA)	≥1.50%	≥1,500 combined TC40 + TC15
Merchant Excessive (MENA)	—	≥100 events AND ≥$75,000 in value
Acquirer Above Standard (from Jan 2026)	≥0.50% to <0.70%	≥1,500
Acquirer Excessive (from Jan 2026)	≥0.70%	≥1,500

VAMP fees (as-of 2026-06-12, Checkout.com primary):

• Merchant Excessive: $8 per TC40 or TC15 (from April 1, 2025)
• Acquirer Above Standard: $4 per TC40 or TC15 (from January 1, 2026)
• Acquirer Excessive: $8 per TC40 or TC15 (from January 1, 2026)
• In AP and Europe regions, VAMP fees do not apply where a chargeback also incurs an unsecured dispute fee. (checkout.com, 2026-06-12)

TC40 exclusions from the VAMP ratio

The following TC40-related events are excluded from the VAMP numerator, per Checkout.com official documentation (2026-04-08):

• TC40 fraud reports qualifying for Compelling Evidence 3.0 (CE3.0) (excluded from both the TC40 count and the ratio)

The following are not excluded:

• TC40 fraud reports on transactions resolved through Verifi|Rapid Dispute Resolution (RDR). Checkout.com (2026-06-12) confirms: "All disputes (fraud and non-fraud disputes) resolved through Rapid Dispute Resolution will continue to be excluded from the VAMP ratio. However, Visa will include TC40 fraud reports as these are reported fraud and not disputes." RDR resolves TC15 disputes (which are excluded), but TC40s are fraud reports — not disputes — and therefore remain in the ratio regardless of RDR enrollment.

Merchant compliance risk: the silent TC40 accumulation problem

A merchant can maintain a clean chargeback record and still breach the VAMP Excessive threshold through TC40 volume alone, because issuers routinely file TC40s on low-value disputes they choose not to escalate to a formal chargeback. Only 26.8% of merchants actively monitor their TC40 fraud records to track their VAMP ratio, even though one in five merchants reports that VAMP changes have directly affected their business. (Chargebacks911 2026 Chargeback Field Report, as-of 2026)

Adyen terminology note

Adyen's dispute and fraud monitoring documentation does not use the term "TC40" — it uses "Notifications of Fraud (NOF)" to describe the fraud-reporting component of the VAMP ratio. Per Adyen docs (as-of 2026-07-25): "The VAMP ratio metric combines Visa Notifications of Fraud and chargebacks with reason codes 10 (except 10.5), 11, 12 and 13." NOFs from fraud chargebacks resolved through RDR are explicitly not excluded from the VAMP ratio in Adyen's documentation.

TC40 and Compelling Evidence 3.0

Compelling Evidence 3.0 (CE3.0) (effective April 15, 2023; updated April 18, 2026) is the only Visa-sanctioned mechanism for removing TC40 fraud reports from the VAMP ratio. When a CE3.0 representment on a Visa reason code 10.4 dispute is won, both the chargeback and the linked TC40 are removed from the VAMP fraud count. (cside.com, 2026-04-21)

April 2026 CE3.0 expansion: Effective April 18, 2026, Visa expanded CE3.0 to cover "non-disputed fraud" — situations where an issuer files a TC40 fraud report but a chargeback is never raised. This update extends CE3.0 coverage to standalone TC40s, giving merchants a path to challenge fraud reports even when no formal dispute was filed. (Chargebacks911, 2026, citing Visa Acceptance Solutions)

CE3.0 applies exclusively to Visa reason code 10.4 (Other Fraud: Card-Absent Environment). TC40s linked to reason code 10.5, service disputes, or processing disputes do not qualify. (cside.com, 2026-04-21)

CE3.0 does not remove TC40s from SAFE (Mastercard)|Mastercard SAFE reports. Mastercard operates a separate Mastercard First-Party Trust programme with different eligibility and evidence requirements. (cside.com, 2026-04-21)

Merchant access to TC40 data

Direct TC40 data access for merchants remains inconsistent across the ecosystem:

• Standard route: Merchant requests TC40 data from their acquirer. Banks are not required to provide it and are not obligated to notify merchants when their transactions appear in TC40 reports. (verifi.com, as-of 2026-07-25)
• Verifi INFORM: Verifi's dedicated product for direct TC40 data access, delivered via authorised third-party partners independently of the merchant's PSP or acquirer. Enables merchants to predict fraud hotspots and adjust internal scoring models before a VAMP threshold is breached. (PayShield, 2025-07-16)
• Checkout.com Reported Fraudulent Transactions Report: Available as hourly (last 183 days) or daily (9:00 PM UTC) report, aggregating Visa TC40 and Mastercard SAFE data in a structured report format. (checkout.com docs, 2025-09-10)

TC40 and the Visa Secure Excessive Fraud Program (US-only)

A separate US-only program, the VSEFP|Visa Secure Excessive Fraud Program (VSEFP), also uses TC40-sourced data (termed EFW — Early Fraud Warnings in Stripe's documentation). VSEFP thresholds: fraud volume ≥$75,000 USD AND fraud rate ≥0.9% (EFW volume on 3DS-authenticated Visa payments ÷ total captured 3DS-authenticated Visa payment volume). Consequence: loss of liability shift on domestic 3DS transactions until exit. An EFW belongs to the month in which the TC40 was reported, not the month the payment was captured. (docs.stripe.com, as-of 2026-07-25)

Key terms

Term	Meaning
TC40	Visa fraud-reporting record filed by issuers via Risk Identification Service (RIS)
TC15	Visa dispute/chargeback notification
TC05	Settled transactions — the VAMP denominator
EFW	Early Fraud Warning — Stripe's label for TC40-sourced data
NOF	Notification of Fraud — Adyen's label for TC40-equivalent data
RIS	Visa Risk Identification Service — the system through which TC40s are filed
SAFE	System to Avoid Fraud Effectively — Mastercard's TC40 equivalent
VAMP ratio	(TC40 count + TC15 count − exclusions) ÷ TC05 settled transactions
Verifi INFORM	Visa product providing merchants direct access to TC40 data
VSEFP	Visa Secure Excessive Fraud Program — US-only program using EFW/TC40 data

What practitioners report

No Reddit practitioner signal was retrieved for this topic in this run (reddit-research MCP not connected). Web companion content indicates merchants are largely unaware of TC40 accumulation as a distinct risk from chargebacks — Chargebacks911's 2026 Chargeback Field Report documents only 26.8% of merchants actively monitoring TC40 records for VAMP ratio management.