Questionable Merchant Audit Program (QMAP): Complete Guide

On 28 July 2026, Mastercard announced a new strategy for managing risk — including a revision of the Questionable Merchant Audit Program (QMAP).

In this article, you’ll find a detailed yet simplified explanation of the QMAP update and advice on how to respond.

Learn more about the July 2026 update here.

The QMAP is used to “identify merchants engaged in collusive, fraudulent, or otherwise inappropriate transactional activity.”

Mastercard uses this monitoring program to keep questionable merchants out of the payments ecosystem and maintain an environment of cardholder trust.

Bust-Out vs. Non-Bust-Out Fraud

The fraudulent behavior detected with QMAP can be affiliated with either bust-out or non-bust-out activity.

But-Out Scheme

A bust-out scheme is a collusion attempt between a cardholder and a merchant.

A cardholder will use a synthetic or stolen ID to obtain a valid account with a high credit limit. The cardholder will then use the card up to — or even over — the credit limit with no intention of repaying the balance. Thus, the cardholder busts out the account.

The merchant processes the cardholder’s fraudulent transactions. After settling the fraudulent purchases, the merchant pays a portion of the proceeds to the cardholder and then keeps the remaining funds.

Non-Bust-Out Scheme

In a non-bust-out scheme, the merchant intentionally commits fraud — but not in collusion with a cardholder. Instead, the merchant processes transactions using stolen or counterfeit cards.

Mastercard has set acceptable thresholds for merchant behavior. If merchants breach these thresholds, they are classified as a questionable merchant.

A merchant will be identified and enrolled in QMAP if all of the following conditions are met:

CRITERIA #1

The merchant processed at least $10,000 USD in transaction volume in a 30-day period

CRITERIA #2

The merchant processed at least five transactions during the case scope period

CRITERIA #3

One of the following is applicable, depending on whether or not bust-out accounts were involved.

For bust-out related situations, at least 50% of the merchant’s transaction volume involved the use of cardholder bust-out accounts.

For non-bust-out situations, at least two of these three things apply:

• The merchant has a fraud-to-sales ratio of 70% or greater.
• At least 20% of transactions were declined or referred by the issuer.
• Either the count or value of fraudulent transactions, declines, and referrals combined exceeds approved transactions.

What is changing?

QMAP is not a new monitoring program. The latest Mastercard announcement simply updates certain elements of the existing program.

Here’s what is changing.

• Lower transaction volume thresholds – Previously, a merchant would only be considered for QMAP if they processed $50,000 USD during the specified time period. The latest update lowers the threshold from $50,000 to $10,000 USD. Mastercard’s goal is to catch more smaller merchants earlier on.
• Shorter time period for investigation – Previously, the program monitored merchants over 120 days. Now, the scope period has been reduced to 30 days (but may extend to 60 days if Mastercard needs to conduct further analysis). The goal is to catch fraudulent activity earlier — especially schemes that materialise quickly.
• Greater risk for enrollment – Previously, merchants who weren’t involved in bust-out activity were only eligible within the first six months of MID creation. Now, the age requirement has been removed. Mastercard wants more flexibility to evaluate merchants regardless of tenure.

When do updates take effect?

QMAP has been in use for a number of years. But as of 1 April 2027, new standards will take effect.

Mastercard anticipates its technology platform will be updated by October 2026, giving issuers and acquirers time to modify their current risk management strategy before the new standards go live.

Here is a general overview of a QMAP investigation.

If a merchant is classified as questionable, the merchant’s acquirer will be charged a fee and impacted issuers can recover a portion of the lost funds.

Mastercard’s recent announcement has adjusted both the acquirer fee and the issuer recovery process.

As of 1 April 2027, issuers will no longer be charged a 15% administration fee for recovering funds. And the acquirer audit fee will increase from $2,500 USD to $25,000 USD.

QMAP updates will go into effect soon. Make sure you understand what is changing and how your business could be impacted.