Mastercard First-Party Trust: Stop Friendly Fraud Early

Most of what Mastercard has shipped recently puts merchants on the back foot. The Excessive Chargeback Program watches your dispute ratio. The Excessive Fraud Merchant program watches your SAFE reports. The Scam Merchant Monitoring Program, in force since July 24, 2026, can put you under a 72-hour investigation if your combined refund and chargeback rate crosses 5%. In all three, you are the one being monitored.

First-Party Trust is the exception. It is the one Mastercard program where the merchant acts before the network does: you share transaction data with the issuer, the issuer sees the purchase was legitimate, and the dispute dies before it becomes a chargeback. It launched in the US in October 2024 and expanded in June 2025 to Canada, Latin America, the Caribbean, and the Asia Pacific region. It is Mastercard's main answer to first-party fraud, the category behind nearly half of reported fraud chargebacks.

The catch: the program only works if you collect the right data before a dispute happens, and most merchants do not.

Why Mastercard Built It

Mastercard's 2025 State of Chargebacks report puts the global cost of chargebacks to merchants on track to reach $42 billion by 2028, with nearly half reported as fraudulent. A large slice of that reported fraud is not fraud at all. It is a cardholder disputing a purchase they made themselves: the subscription they forgot to cancel, or the item that arrived two days after the statement. At the moment of dispute, the issuer only sees a customer claiming they never authorized the charge, with no way to separate them from a real fraudster using a stolen card.

First-Party Trust closes that information gap. Merchants share detailed purchase context with the issuer, either at authorization or when a dispute is raised, so the issuer can tell third-party fraud from first-party fraud before committing to a chargeback.

How the Matching Works

There are two integration paths, and you can run either or both:

• At authorization, through Identity Check Insights. You pass detailed data during the 3DS flow using your own 3DS server or the 3DS Smart Interface API. The issuer gets context at the moment of purchase.
• At dispute time, through the Ethoca Consumer Clarity Merchant Transactions API. When a chargeback lands, Mastercard requests the compelling evidence through the API.

The core mechanism is historical matching. When a transaction is disputed, Mastercard compares it against two prior undisputed transactions from the same cardholder. To establish compelling evidence, one data element from each of three categories must match between the disputed transaction and those historical transactions:

• Device identity: device ID or fingerprint, IP address.
• Delivery factor: shipping address, or proof the customer received or accessed what they bought.
• Additional identity factor: account email, login history, and similar account-level proof.

If the match validates, liability shifts to the issuer. The issuer, not you, eats a dispute that the cardholder's own purchase history contradicts.

That point matters more than it looks. Under every Mastercard monitoring program, a chargeback counts against your ratio the moment it is filed. Winning at representment does not remove it. The only lever that protects your ECP, EFM, and SMMP ratios is stopping the chargeback from existing in the first place, and First-Party Trust is the scheme-level tool built for exactly that.

Where Merchants Fail

The program has real prerequisites, and they trip up three groups in particular.

Digital goods sellers. If you sell subscriptions, courses, credits, or content, you have no shipping address, which weakens the delivery factor category. The fix is to instrument access events: download logs, stream starts, course progress, license activations, support logins after purchase. Mastercard accepts evidence that the customer used what they bought, but only if you record it and can retrieve it per transaction.

Merchants with thin data plumbing. Plenty of shops capture an IP address at checkout and nothing else. No device fingerprint, no login timestamps, no link between the fraud team's records and the payment record. If your evidence lives in three disconnected tools, you cannot produce a matched evidence set inside a dispute window measured in days.

First-transaction businesses. The match requires two prior undisputed transactions from the same cardholder. A customer disputing their first purchase cannot be matched, period. If your first-party fraud skews toward new customers, First-Party Trust will not carry that load. Pre-authorization fraud tools and chargeback alerts stay necessary there.

What Visa's CE 3.0 Already Taught Everyone

Visa ran this experiment first. Compelling Evidence 3.0 went live in April 2023 with the same logic: match disputed transactions against prior undisputed ones and hand merchants a liability shift. Results were real but slower than merchants hoped. The gains concentrated among merchants with repeat customers and disciplined data collection, and Visa kept refining the rules after launch.

Expect the same shape from Mastercard. Mastercard has reported that merchants in the program have seen drops of 15 to 20 percent in first-party fraud chargebacks. That is meaningful, not a cure. Treat First-Party Trust as one layer: it neutralizes the repeat-customer friendly fraud segment, while alerts, refund policy fixes, and clear billing descriptors handle the rest.

A Practical Rollout

If you sell to US, Canadian, Latin American, Caribbean, or Asia Pacific cardholders, work through this sequence:

1. Audit what you capture per transaction today. IP address, device ID or fingerprint, account email, login events, delivery or access confirmation. Anything missing is your first fix.
2. Pick your integration path. If you already run 3DS, Identity Check Insights is the natural start. If dispute volume is the pain point, the Consumer Clarity API moves evidence at dispute time. Many merchants run both.
3. Fix retention and retrieval. Evidence has to be retrievable per transaction for the full dispute window. A data store nobody can query is worth nothing.
4. Instrument digital delivery. Log content access, downloads, and post-purchase logins as first-class evidence.
5. Measure your match rate. Take your last 100 first-party fraud chargebacks and check how many would have produced a two-transaction match. That number tells you what the program is worth to you before you spend integration effort.

The Ratio Payoff

Every dispute that First-Party Trust kills never enters your chargeback-to-transaction ratio, never appears in a SAFE report, and never counts toward SMMP's 5 percent combined refunds and chargebacks trigger. With Visa's VAMP threshold now at 1.5 percent and Mastercard's monitoring stack tightening, prevention is the only metric the networks reward. First-Party Trust is the closest thing merchants have to a structural advantage on that front, provided the data is in place before the dispute arrives, not after.