TC40
What is TC40?
TC40 is the report that issuing banks send to Visa to flag as part of its Risk Identification Service (RIS). These help assess the fraud and risk tied to a specific merchant. Because fraud and chargebacks are closely correlated, data that helps identify fraud also helps merchants manage chargebacks.
Merchants don't receive TC40 reports directly. Accessing them requires coordination with their .
Key facts
A TC40 report gives card issuers a structured record of a transaction a flagged as suspicious. It typically includes:
- Merchant details, including name, location, and
- Bank details for the parties involved in the transaction
- Transaction details, such as when and where it occurred
TC40s aren't limited to confirmed fraud. They let issuers monitor merchants for suspicious activity, whether or not a case turns into a formal dispute. Merchants use these fields to match a TC40 back to the original order and judge whether it reflects real fraud.
How TC40 reporting works
The report moves through a fixed chain before it reaches the merchant:
- A cardholder flags a transaction as fraudulent or suspicious with their issuing bank.
- The issuer records the case and submits it to Visa's Risk Identification Service.
- Visa compiles the TC40 data and distributes it to the relevant acquirers and card networks.
- The merchant reviews the flagged transactions by requesting the data through their acquirer.
Why TC40 matters
TC40 data surfaces fraud signals early, often before a formal chargeback is filed. That early view lets merchants spot patterns in flagged transactions and check whether their fraud controls are catching real abuse.
Issuers also use TC40 volume to judge how risky a merchant looks. A high count can push a merchant into a card-scheme fraud monitoring program, which brings added scrutiny and fees.
A TC40 is only a notification, not a financial reversal. No money moves when one is filed, unlike a chargeback that debits the merchant. That difference is why TC40s function as an early-warning signal rather than a booked loss.
Common issues with TC40 data
- False positives: a TC40 can be triggered by a legitimate purchase dispute, a forgotten subscription, or a policy that restricts minor transactions, not just genuine fraud.
- No direct access: merchants can't pull TC40s themselves and depend on their acquirer to share the data.
- Over-refunding: acting on early TC40 alerts instead of direct chargeback monitoring often leads to refunding legitimate transactions. This overlaps with , where a real cardholder disputes a valid charge.
For those reasons, TC40s work best as a supplement to layered chargeback prevention rather than a standalone trigger for refunds.
