TL;DR
- A TC40 is the fraud report a Visa card-issuing bank files when a customer says a charge was not theirs. No money moves, but Visa counts it.
- Visa's VAMP ratio adds fraud reports and disputes together, so one fraud claim that also becomes a chargeback counts twice.
- A refund, including an alert refund, clears the dispute but not the fraud report. For disputes filed as fraud, alerts cut the count in half, not to zero.
- Three things keep a fraud report off your count: stopping the confused call, qualifying under Compelling Evidence 3.0, and canceling a suspicious charge before you collect it.
Who this helps: you turned on chargeback alerts, your disputes fell, and your VAMP ratio fell less than you expected. This is the part of the number alerts cannot reach.
Chargeback alerts are the closest thing this industry has to an undo button: refund inside the window and the chargeback never exists. But a second record is filed the moment a customer tells their bank a charge was not theirs, and no refund reaches it. It is called a TC40, and on some of your disputes it is half of what Visa counts.
What is a TC40?
A TC40 is the fraud report a Visa card-issuing bank sends to Visa when a cardholder says a transaction was not theirs, or when the bank's own systems flag it as fraud. The name comes from Visa's transaction codes: TC40 is a fraud report, TC15 is a dispute, and TC05 is a settled sale. Mastercard keeps the same kind of record under the name SAFE (System to Avoid Fraud Effectively).
The easiest way to hold the difference: a dispute takes your money back, and a fraud report takes nothing but still counts. The two run on separate tracks. Card networks require banks to report fraud, and that requirement has nothing to do with whether the bank also files a dispute, so a fraud report can exist with no chargeback at all.
How does a TC40 count toward VAMP?
As one full event, the same weight as a chargeback. Visa's fact sheet defines the VAMP ratio as the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled card-not-present sales (TC05). Since April 1, 2026, the Excessive line for merchants in the US, Canada, Europe and Asia Pacific has been 1.5%, once the combined count reaches 1,500 a month.
The part most merchants miss is the addition sign. When a customer claims fraud and the bank also files a chargeback, the same transaction appears in both reports, and Stripe's documentation is blunt about the result: it is "counted twice." Run the VAMP calculator and the fraud reports are already in the number; the question is how much of the number they are.
Why can't an alert refund clear a TC40?
Because the fraud report is filed at the claim, and the refund comes after it. By the time an alert reaches you, the customer has already told their bank the charge was not theirs, and the bank has already reported it. Stripe's documentation puts it plainly: refunding a flagged payment "doesn't affect the fraud warning." The alert still does real work, because it stops the chargeback, the fee and the dispute half of the count. It just cannot reach the other half.
For a subscription business, this is not an edge case. The dispute you get most is the unrecognized rebill: a customer sees a charge they do not remember, calls the bank, and says it was not them. The bank records fraud under Visa reason code 10.4, the code for fraud on a purchase made without the card present, which means a fraud report and, if nothing stops it, a dispute. Stripe reports how often the second follows the first: when a merchant does nothing, 80% of fraud warnings turn into fraud disputes. The exception is a payment where 3D Secure, the extra verification step some banks run at checkout, moved the fraud liability to the bank.
Run it on a compact case. Lumen, a $19-a-month meditation app, settles 150,000 Visa charges a month and receives 1,500 disputes, 900 of them filed as fraud. Assuming each of those 900 also produced a fraud report, Lumen's VAMP count is 2,400, a ratio of 1.6%, over the line. Alerts that resolve 89% of the disputes take the count to 1,065 and the ratio to 0.71%, under Visa's line, though still above the 0.3% to 0.5% where many acquirers start asking questions. And look at what is left: 900 of the 1,065 are fraud reports that no refund could reach.
What else can alerts not stop?
Four kinds of chargebacks get past alerts by design, which is why we publish "up to 89%" and not "all." First, banks outside the alert networks: if the customer's bank is not enrolled, no alert fires and the dispute goes straight to a chargeback. Second, payments alerts barely reach: disputes opened inside PayPal go through PayPal's own system, and American Express and Discover disputes are covered only where the customer's bank takes part in Verifi's CDRN or Ethoca's network. Third, disputes with no customer in the loop, such as Visa 11.3 processing errors, which the bank files from its own records. Last, the clock: an alert refund only works inside its 24 to 72 hour window, and a missed alert becomes an ordinary chargeback.
Where can I see my TC40 data?
It depends on who processes your payments. Stripe shows them as early fraud warnings, in the Dashboard and through its API, and it offers a VAMP dashboard that splits the count into fraud reports and disputes. Shopify's help center confirms that VAMP counts fraud reports but documents only a chargeback rate in the admin, with no view of fraud reports or the VAMP ratio. With most other processors and gateways, the data sits with your acquirer, and you get it by asking for it.
What actually keeps a fraud report off your count?
Three things, and two of them work before the report exists. First, stop the call. A customer who recognizes the charge never calls the bank, so no fraud report is ever filed. That is statement descriptor work and a reminder before every rebill, and it is the only complete fix, because it is the only one that works on every fraud claim. The prevention playbook covers both.
Second, Compelling Evidence 3.0 (CE 3.0), Visa's rule for fraud claims under that same code, 10.4. You qualify when you can show two earlier purchases on the same card that were never disputed, made at least 120 days and less than a year before the disputed charge, and matching it on at least two data points, one of which must be the IP address or the device (per Stripe's CE 3.0 documentation). Visa's fact sheet says VAMP leaves qualifying fraud reports out of the count, "contingent on the timing of the data extract," which in plain terms means the qualification has to be on record before Visa pulls the month's numbers.
The route that works before a dispute exists is Verifi's Order Insight, which sends your order data to Visa before a dispute is filed. What is still settling: since April 18, 2026, Visa has reportedly let CE 3.0 apply to fraud reports that never became chargebacks, and has indicated a fee for successful qualifications. Confirm both with your processor before you plan around them.
Last, cancel before you collect. Most card payments happen in two steps: the bank approves the charge, then you collect the money, which the industry calls capture. Banks must report fraud on a payment you collected, even after a refund, but not on one that was only approved. So when your fraud screening flags a first charge or a trial conversion, hold it at the approval step, review it, and cancel the bad ones before you collect. Stripe notes that a refund can also stop the report when it is processed as a reversal, which usually means within about 2 hours of collecting. This works on new customers, not on the rebills of customers you already have.
A TC40 is the fraud report a Visa bank files when a customer says a charge was not theirs, and Visa's VAMP ratio counts it alongside disputes, twice when a fraud claim also becomes a chargeback. Refunds, including alert refunds, do not remove it. Three things keep it off the count: preventing the call, qualifying under Compelling Evidence 3.0, and canceling a suspicious charge before you collect it.
FAQ
What is a TC40 report?
A TC40 is the fraud report a Visa card-issuing bank sends to Visa when a cardholder says a transaction was not theirs, or when the bank's systems flag it as fraud. No money moves, but Visa counts it toward the merchant's VAMP ratio. Mastercard's equivalent is called SAFE, and Stripe shows both as early fraud warnings.
Is an early fraud warning the same as a TC40?
Mostly. An early fraud warning is Stripe's name for the fraud reports card networks send, and each one comes from a Visa TC40 or a Mastercard SAFE report. The difference is timing: a warning can arrive after the dispute it relates to, because the networks process fraud reports and disputes separately.
Does a refund remove a TC40?
No. The fraud report is filed when the customer makes the claim, and a later refund, including one made through a chargeback alert, does not change it. The only refund that can prevent a fraud report is a reversal, which usually has to happen within about 2 hours of the payment being collected.
Do TC40s count toward VAMP?
Yes. Visa's VAMP ratio is the count of fraud reports (TC40) plus disputes (TC15), divided by settled card-not-present sales (TC05). A transaction that has both a fraud report and a dispute counts twice. Since April 1, 2026, the Excessive merchant line is 1.5% in the US, Canada, Europe and Asia Pacific.
Can merchants see their TC40s?
It depends on the processor. Stripe shows them as early fraud warnings in the Dashboard and API, and offers a VAMP dashboard. Shopify's admin documents a chargeback rate but no fraud-report view. With most other processors, merchants request the data from their acquirer.
How do I get a TC40 excluded from VAMP?
Visa excludes fraud reports that qualify under Compelling Evidence 3.0: two earlier undisputed purchases on the same card, made 120 days to a year before the disputed charge, matching on at least two data points including the IP address or device. The pre-dispute route runs through Verifi's Order Insight. Preventing the fraud claim in the first place, with a recognizable statement descriptor and rebill reminders, avoids the report entirely.
Facts checked against Visa's public VAMP fact sheet, Stripe's documentation on monitoring programs, disputes and Compelling Evidence 3.0, and Verifi's Order Insight materials. Last reviewed September 11, 2026.
