Your acquirer knows your fraud ratio to 2 decimal places. You do not. The record that drives it, Visa's TC40, is filed by the cardholder's bank, passed to the network, and delivered to your acquirer, and nobody in that chain is obliged to show it to you. Here is the request that gets a file back, the escalation when the first answer is no, and what to build when the answer stays no.
What a TC40 record actually is
A TC40 is a fraud report. When a Visa cardholder tells their issuing bank a charge was not theirs, the issuer files that claim into Visa's Risk Identification Service, and Visa passes the record down to the acquirer on the other side of the transaction. Mastercard runs the same thing under a different name: SAFE, short for System to Avoid Fraud Effectively, now collected in its Fraud and Loss Database.
No money moves. Qualpay's merchant documentation puts it plainly: a TC40 is not a chargeback, it is a non financial alert, and nothing is withdrawn from you. It is a statement that a cardholder called fraud, filed whether or not a dispute ever follows. What the record carries, according to Verifi and the processor knowledge bases that publish theirs:
- Merchant name, location and merchant category code
- Identifiers for both the issuing bank and the acquiring bank
- Transaction date, amount and card type
- The fraud reason the cardholder gave
- A partial card number. The full number and the cardholder name are not in what reaches a merchant
Why there is no portal you can log into
Neither Visa nor Mastercard runs a merchant facing portal for this. The flow travels in a single direction: issuer to network to acquirer. You are not a party to it. Your acquirer receives the file and decides on its own whether any of it reaches you.
2 reasons get given. Verifi notes the files are typically very large and that many processors cannot supply them on a consistent basis. Chargebacks911 adds that the raw records carry descriptor fields meant for internal bank use, which makes them awkward to hand over without interpretation. Both are true. Neither is a rule.
Be clear about the rule question before you write to anyone. Every source that covers this, including the vendors selling against the problem, says acquiring banks release TC40 and SAFE data at their own discretion and are not required to. I could not find published network language obliging an acquirer to hand a merchant its raw fraud file, and citing a rule you cannot produce will cost you the conversation.
VAMP is why this stopped being optional
Until recently you could ignore TC40, because only chargebacks moved money and only chargebacks counted. That changed. The Visa Acquirer Monitoring Program now calculates a single ratio: TC40 fraud reports plus TC15 disputes, divided by settled card not present transactions. A TC40 with no chargeback behind it still lands in that numerator, and Rapyd's documentation of the program is explicit that a refund does not take the transaction back out. Refunding your way clear is not a strategy, it is just a refund.
The excessive threshold for merchants dropped from 220 basis points to 150 basis points on 1 April 2026, with a fee of $8 per fraudulent or disputed transaction and no warning tier. Published figures for the minimum monthly volume floor sit at around 1,500 combined fraud and dispute events, though sources disagree on what it was before that date, so confirm the current number with your acquirer rather than a vendor blog. The arithmetic is the point either way: a real share of your own numerator is data you have never seen.
If the bottom of the fraction is moving on you as well, why your chargeback rate reports last month's ad spend covers the denominator lag that makes a stable business look like it is coming apart.
The email that gets a file back
Vague requests get vague answers. Do not ask for TC40 data. Ask for a named artifact, on a schedule, in a format, with the fields listed. Send it to your relationship manager and copy whoever handles risk or underwriting, because front line support cannot approve it and will simply say no. Specify all of this:
- Every MID and CAID you run, plus the acquiring BIN. If you run multiple descriptors, name them all, because the file is keyed to the merchant identifier and not to your company
- A date range. The last 90 days is a reasonable opening ask and small enough to be easy to say yes to
- 1 row per fraud report, with transaction date, settled amount, last 4, acquirer reference number, fraud reason code, and the date the report was received
- CSV. Not a PDF summary and not a screenshot of an internal dashboard
- A recurring cadence after the first pull. Monthly is normal, weekly if they will do it
- TC40 and SAFE asked for separately, since they come off different networks and are often held by different teams
- Your VAMP ratio as they calculate it, numerator split into fraud reports and disputes. Ask for this whether or not they send the rows, because they hold it for certain
When the answer is no
Work out first whether it is cannot or will not. If you boarded through an ISO or a reseller rather than the bank itself, your contact may genuinely not hold the file. Ask who the sponsor bank is, then ask your ISO to put the request to that bank's risk team instead of accepting the shrug.
Then change the framing. A merchant claiming an entitlement loses. A merchant trying to pull down a number the acquirer is being measured on wins more often, because it is true. Acquirer portfolio thresholds under the same program sit at 0.5% above standard and 0.7% excessive. Your fraud is their problem before it is yours. 3 moves beat repeating the ask:
- Downgrade it. If raw rows are too much, ask for monthly counts broken out by fraud reason code. That is a query rather than a file transfer, and it carries most of the diagnostic value
- Move it to a commercial conversation. Fraud reporting is a term you can negotiate at renewal, or while you are boarding a second MID and they want the volume
- Ask what they can share, in writing, and hold them to it. A written no from a named person beats 6 weeks of unanswered emails, because it tells you the route is closed
- Do not go over their head. There is no appeal above your acquirer and no Visa or Mastercard support line that hands a merchant its own fraud file
The fallback when nobody hands it over
Check first whether you already have the feed and never switched it on. Payment facilitators sit in the acquirer's seat, receive the fraud file themselves, and several surface it under a different name. Failing that, the alert networks sell speed rather than the file. Verifi on the Visa side and Ethoca on the Mastercard side run a pre dispute alert feed, Verifi's Rapid Dispute Resolution will auto refund by rule before a dispute is filed, enrollment runs against your BIN and CAID through your acquirer, and a reseller publishes per alert pricing in the $30 to $40 range. Those alerts are not TC40 records.
- Stripe calls them Early Fraud Warnings, and its documentation states they are sourced from Visa TC40 and Mastercard SAFE reports. They appear in the dashboard and at the API endpoint GET /v1/radar/early_fraud_warnings, with a radar.early_fraud_warning.created event you can subscribe to
- Adyen calls them Notifications of Fraud and sends a NOTIFICATION_OF_FRAUD webhook carrying the scheme code, the fraud reason code, the transaction reference and the amount
- If you are on a small ISO with no developer documentation and no risk portal, that absence is your answer, and the request above is the only route you have
Build your own floor and read the gap
The free fallback lives on your side of the transaction, so nobody can withhold it. Tag every dispute that arrives under a fraud reason code and key it to the original transaction date, not the date the dispute landed. Hold your own monthly count of settled card not present transactions, taken from your gateway rather than a report someone sends you. Divide.
That floor will always sit under the acquirer's number, because it is missing every TC40 that never became a dispute. The size of the gap is the thing you were trying to measure. When their number and yours diverge badly you have a specific question to put to them instead of a general complaint, and specific questions get answered.
Set your expectations on the data itself either way. TC40 is late: an alert vendor reports that Mastercard issuers can file a SAFE record as long as 60 days after the chargeback. It will not stop a chargeback, and refunding a flagged transaction on the strength of a report costs twice, because the cardholder is still free to file. It only ever shows cardholder declared fraud, so disputes driven by a delivery problem, a forgotten subscription or an unrecognised descriptor are absent from it. Use it as a diagnostic on which offers, descriptors, traffic sources and price points generate fraud claims. It is not a control, and if the processor relationship is deteriorating while you chase it, what to do in the first 14 days of a Stripe freeze is the more urgent clock.
The same problem on the other side of the business
None of this touches a disabled Meta ad account. Different network, different counterparty, no shared file. Better said plainly than dressed up.
What connects is the shape of the problem: a number you are judged on, computed by someone else, out of inputs nobody has to show you. On the payments side you can at least send the email and escalate it. On the Meta side there is no file to request, and what decides whether an account delivers is spend volume and payment history on the account itself. That is also why a disputed charge sits among the billing signals that disable an ad account, and it is not something you rebuild in a week after a payments problem has already cost you the account you had.
Which is the honest trade off with an agency account. You are not accumulating that history yourself, and you pay a monthly rate for access to someone else's. What the money buys is an account issued off a portfolio spending about $50 million a month, handed over in 1 to 2 hours, at a flat rate with no cut of spend. When payments are the fire this month, that is the version of the ad side that does not also need you to start from zero. The questions operators ask before moving spend across covers what handover does and does not include.