One merchant. Two views of risk.

The exercise acquirer supplies a reconciled October extract: 1,260 included fraud-report events and 1,080 included dispute events against 180,000 settled card-absent transactions. The result is 2,340 / 180,000 = 1.30%. Comparable prior extracts were 0.80% and 1.05%. The acquirer’s fictional internal escalation level is 1.50%; its review considers the trend before that level is reached. These are event counts, not necessarily distinct fraudulent purchases.

Visa’s public VAMP fact sheet describes a count-based TC40-plus-TC15 ratio over TC05 and exclusions dependent on extraction timing. For this exercise the acquirer has already reconciled the included events. A monitoring ratio is not the same as a fraud loss rate or a count of unique harmed customers.

Of the 1,080 included dispute events, 380 concern service not provided and relate to a cancelled festival with customer refunds still queued. Another 410 are fraud disputes concentrated in orders above €150 without recorded 3DS authentication; 290 concern other reasons. Fraud-report events also concentrate in the higher-value segment. The merchant has not yet assessed a pre-dispute resolution service with its acquirer.

The evidence suggests separate operational and fraud-control workstreams. It does not prove that authentication would have stopped every disputed payment, or that adding a resolution service would remove disputes already filed.

The fictional portfolio extract contains 24,800 included events on 6,200,000 settled transactions: 0.40%. Brightwater contributes 9.4% of included events and 2.9% of transaction volume. The contract permits a negotiated remediation plan. Reserve changes require contractual and credit approval; termination is a separate decision. The acquirer will confirm applicable scheme rules, exclusions and any consequences rather than relying on a fee summary.

Merchant and portfolio views answer different questions. The public programme framework is a reference, not a substitute for current account-specific confirmation. Removing an event from a monitoring count, where permitted, also does not undo an underlying loss or service failure.