What is a TC40 report? How merchants manage payment fraud reports

TC40 reports sit in the background of every card transaction your business processes. Issuer fraud systems generate them automatically, often without the cardholder's involvement, which means most UK and EEA merchants only notice them once their fraud-to-sales ratio has already attracted scheme attention.

A fraud report counts against that ratio whether or not it ever becomes a chargeback, so you can be in good standing on cash flow and disputes while quietly failing on a metric you cannot see.

This article explains what a TC40 report is, how it differs from a chargeback, what causes one to be issued, and what established merchants can do to reduce them.

The insights in this blog are partially based on Episode 11 of our Pay Attention Podcast, hosted by Fibonatix CEO Tal Miller. In this episode, Tal explores payments fraud reports and how to manage fraudulent transactions.

What is a TC40 report, and what is a Mastercard SAFE report?

A TC40 report is a fraud notification that a Visa-issuing bank submits when a cardholder reports a transaction as fraudulent, or when the issuer's fraud systems flag the transaction as suspicious. Visa routes the report to the merchant's acquirer, which surfaces it to the merchant. No funds change hands at the point a TC40 is issued.

TC40 reports capture fraud claims regardless of whether the transaction is subsequently disputed through the chargeback process. A cardholder may report a transaction as fraudulent to their bank without raising a formal chargeback, in which case a TC40 is generated but no recovery action follows. Both scenarios contribute to the merchant's fraud monitoring profile with Visa and feed Visa's Acquirer Monitoring Programme (VAMP).

The Mastercard equivalent is the SAFE report, named after Mastercard's System to Avoid Fraud Effectively database. SAFE reports work the same way as TC40s: issuers submit fraud notifications to Mastercard, which routes them to acquirers and feeds the data into Mastercard's fraud monitoring programmes, including the Excessive Fraud Merchant programme. The reported data typically includes the transaction amount, fraud type, and merchant identifier.

How TC40 reports differ from chargebacks

Although chargebacks often cite fraud, they are not the same mechanism as TC40 reports. The two flow from different processes and have different consequences for the merchant.

» Learn more about reducing chargeback risks

What happens if you receive too many TC40 reports?

A single TC40 report has no immediate consequence. The risk lies in accumulation. Card schemes monitor merchant fraud volumes continuously, and once a merchant's fraud-to-sales ratio crosses defined thresholds, the scheme will enforce remediation through the acquirer.

Visa's VAMP counts both TC40 fraud records and TC15 chargeback records against the merchant's monthly transaction volume. Once a merchant crosses VAMP's enforcement threshold, Visa requires the acquirer to act, with escalating penalties for sustained breach.

When a merchant breaches programme thresholds, the consequences can include:

• Rolling reserve. The acquirer continuously withholds a percentage of each transaction settlement (typically 5–10%, or up to 20% for merchants in specialist categories), to cover potential chargeback or fraud liability. This ties up working capital that would otherwise fund operations.
• Fines. Per-transaction or monthly fines that scale with the size and duration of the breach.
• Account termination. The acquirer ends the merchant agreement.

For merchants in specialist categories, these consequences are particularly serious. Acquirer options are already narrower, and a MATCH listing can leave a business unable to accept card payments at all.

How to calculate your fraud-to-sales ratio

Your fraud-to-sales ratio (F2S) is the total value of fraud reported against your account in a month, divided by your total transaction value for that month, expressed as a percentage. It is the metric card schemes use to judge whether your fraud exposure sits within acceptable limits.

Track your F2S monthly rather than reactively. A ratio trending upward gives you time to act before it crosses an enforcement threshold; a ratio you only check after a warning leaves you with far fewer options.

PSD2, SCA, and your fraud obligations

For merchants processing payments in the UK or EEA, fraud prevention is a regulatory obligation as well as a commercial priority. Strong Customer Authentication (SCA), introduced under PSD2 and the UK Payment Services Regulations, mandates two-factor authentication for most online card payments.

SCA is enforced through 3D Secure 2 (3DS2) at the checkout. When a transaction is authenticated under SCA, liability for any resulting fraud shifts from the merchant to the card issuer. Transactions that bypass SCA leave the merchant exposed to both fraud losses and the TC40 reports that follow.

Several exemptions apply, including low-value transactions, recurring payments, and merchant-initiated transactions. Applying these exemptions correctly reduces checkout friction without sacrificing the liability protection SCA provides.

How to reduce TC40 reports and manage payment fraud

You cannot eliminate fraud reports entirely, but you can keep your fraud-to-sales ratio well below scheme thresholds. The following five steps form a practical programme for established merchants.

1. Benchmark your fraud-to-sales ratio

Calculate your current F2S ratio and compare it against the benchmark for your merchant category, not against a generic 1% figure. Specialist categories carry different baseline expectations, so your acquirer or PSP is the most reliable source for a realistic benchmark.

2. Identify why the reports are being triggered

Most fraud reports follow patterns, so review your reported transactions for common factors:

• Transaction value. If reports cluster above a certain amount, review your pricing and consider whether higher-value orders need additional verification.
• Billing timing. If your billing runs at unusual hours, issuer systems may flag it as anomalous. Adjust your processing schedule or set customer expectations in advance.
• Geography and product type. Cross-border transactions and certain product categories attract closer issuer scrutiny.

3. Use 3D Secure 2

3DS2 authenticates the cardholder at checkout with far less friction than its predecessor, and authenticated transactions shift fraud liability to the issuer, as outlined above. It is also mandatory for most UK and EEA transactions under SCA.

Merchants often resist 3D Secure over conversion concerns, but on cross-border transactions and in categories issuers scrutinise more closely, the improved approval rates typically offset any added friction.

4. Communicate clearly with customers

If specific transactions are flagged repeatedly, tell affected customers what to expect so they recognise the charge and can confirm it with their bank if queried. Clear billing descriptors and pre-emptive communication reduce both fraud reports and the friendly fraud that masquerades as them.

5. Deploy chargeback alerts

Tools such as Ethoca (Mastercard) and Verifi (Visa) notify merchants of disputes and confirmed fraud before they escalate into chargebacks. Acting on an alert lets you refund or resolve the transaction early, preventing it from compounding your fraud and dispute ratios. For merchants near a scheme threshold, alert coverage is one of the fastest ways to pull a ratio back into range.

How a payment service provider helps you manage fraud

For established merchants in specialist categories, your payment service provider (PSP) is often the most practical line of defence against fraud reports. Acquirer options are narrower in these categories, and a PSP that understands your sector can interpret your fraud data in context rather than against generic benchmarks.

A capable PSP helps you identify what triggers your TC40 reports and works with you to reduce the chargebacks and disputes that push your ratio toward scheme thresholds. Because PSPs are themselves monitored and penalised by the schemes for merchant fraud, reducing your reports is firmly in their interest too.

Manage your TC40 reports with Fibonatix

Account termination rarely comes from a single bad month. It comes from a fraud-to-sales ratio that climbed unnoticed until the scheme stepped in.

Fibonatix works with established merchants in specialist categories, including CBD, online trading, and dating services, where fraud reports carry more weight and acquirer options are narrow. Our risk and compliance team monitors your exposure with you from onboarding onward, helps you reduce chargebacks and disputes, and supports you through every dispute from a single console, so a rising fraud profile gets caught and managed instead of building unseen.

If your fraud reports are climbing, the worst move is to wait and hope they settle.

Fibonatix (UK) Limited, company number 09738892, is authorised and regulated by the UK Financial Conduct Authority (FCA) as a Payment Institution (FRN 768776).