Mastercard Scam Merchant Monitoring: The 72-Hour Clock

Mastercard's 72-hour scam-monitoring clock starts in eight days. That's not enough time to redesign your monitoring process. It's enough to find out whether your response chain actually holds.

These standards are less a new merchant-risk threshold and more a test of whether the acquiring chain can investigate, document, escalate, and act inside 72 hours. For sponsor banks of payment facilitators, delegating that to the PayFac by contract doesn't, on its own, discharge the sponsor's accountability. It requires enough visibility into the investigation, the decision, and the action taken to show the standard was met.

The triggers come from a mix of inbound Mastercard signals and monitoring you run yourself. A GRIP letter from Mastercard arrives at your door. Authorization-rate deterioration and certain new-merchant thresholds depend on your own systems catching them. Either way, detection only starts the clock. Investigation, escalation, decision, documentation, and action determine whether you meet the standard. Source: Mastercard Security Rules & Procedures, effective July 24, 2026.

The response chain worth stress-testing before the date:

1. A threshold breach or an inbound alert flags a potential scam merchant.
2. It reaches the right PayFac or acquirer team, not a shared inbox no one owns.
3. The PayFac pulls the sub-merchant data and investigates.
4. The sponsor bank gets visibility into status and evidence, not a monthly summary after the fact.
5. The right party blocks Mastercard and Maestro acceptance if activity is confirmed.
6. Every step is documented inside the window.

If the handoff at step 2 or the visibility at step 4 isn't solid, the clock can run out while everyone waits on someone else.

CardTraq view: the exposure that's easy to underestimate sits with the sponsor bank. When Mastercard flags a sponsored merchant, the question isn't whether the PayFac is contractually responsible. It's whether the PayFac can produce the investigation record and evidence fast enough for the sponsor to show it met the standard. Some sponsors already have real-time visibility into sub-merchant investigations. For them, the operational gap is much smaller. Where it lives only in the PayFac's systems, the sponsor can carry an exposure it can't easily see. The point is knowing which one describes your setup.

One question worth answering before July 24: if a sponsored merchant trips a trigger tomorrow, who owns the first hour, and can you prove the full response cycle inside 72 hours?