Mastercard reason code 4849: what it means and how to respond
Mastercard code 4849 covers merchants listed in QMAP or coercion confirmed by Mastercard. Learn the requirements, defense, and deadlines.
What code 4849 means and when it applies
Mastercard code 4849, “Questionable Merchant Activity,” is filed when Mastercard itself has already identified a problem connected to the merchant. It does not cover a general suspicion by the cardholder’s bank or every purchase the cardholder does not recognize. For a case to qualify under 4849, at least one of these two situations must exist:
- The merchant was included in the audit program. The name and identifier of the acquirerThis is the institution that signs up the merchant and represents it in the Mastercard system during the dispute., together with the merchant’s name and location, appear in a Mastercard AnnouncementThis is an official Mastercard notice that identifies the acquirer and merchant and states the period in which transactions may receive a 4849 chargeback. for violating QMAPQMAP stands for Questionable Merchant Audit Program. It is Mastercard’s program for investigating and identifying merchants involved in collusive, fraudulent, or otherwise improper activity..
- Mastercard confirmed that the transaction was forced. The card scheme concluded that the merchant conducted a transaction through coercionThis occurs when the cardholder completes a transaction because they or an immediate family member suffered or was threatened with physical harm, or because their property was threatened or unlawfully taken. and identified in writing which transactions qualify for a chargeback.
Source for the two situations: Mastercard Chargeback Guide, Dual Message System Chargebacks, “Questionable Merchant Activity,” p. 637. Program definitions: Mastercard Security Rules and Procedures — Merchant Edition, §§8.4 and 8.6, pp. 82–90.
The two situations are alternatives, but each has its own requirements, and all of these requirements must be met for the selected path. Under the QMAP route, the announcement must identify the acquirer and merchant, the transaction must have occurred during the published period, and the issuerThis is the bank or institution that issued the card to the cardholder and files the chargeback with Mastercard. must have properly reported it to the Fraud and Loss DatabaseThis is Mastercard’s database where the issuer records fraudulent transactions. For 4849, proper reporting under an eligible fraud type is a chargeback requirement..
Under the coercion route, Mastercard must have confirmed the complaint and sent a written notice identifying the eligible transaction. The issuer must attach that notice, properly report the fraud, and file the chargeback within the stated timeframe. The cardholder’s complaint alone does not replace Mastercard’s decision.
Source for the cumulative requirements: Mastercard Chargeback Guide, “Questionable Merchant Audit Program (QMAP),” pp. 641–642, and “Coercion Program,” pp. 663–664.
The issuer cannot use 4849 if the fraud report does not follow the rule or uses an ineligible fraud type. Transactions involving Mastercard Commercial Payments Accounts, which are virtual business payment accounts, are also excluded. A refund tied to the same purchase must also be considered before the chargeback is filed.
Source for the exclusions and refund review: Mastercard Chargeback Guide, “Transactions ineligible for chargeback” and “Additional considerations,” pp. 637–638.
When neither situation applies, 4849 is not the correct code. A standalone claim of an unauthorized purchase may proceed under 4837, while card-present fraud subject to the chip liability shift may fall under 4870 or 4871, depending on the circumstances.
Deadlines for each party under Mastercard 4849
1 block represents 10 calendar days.
- IssuerFile the 4849 QMAP chargeback using the announcement dateThe clock starts when the merchant first appears in the publication.Up to 120 calendar days
- IssuerFile the 4849 QMAP chargeback using the transaction dateThe clock starts when Mastercard processes the transaction.Up to 120 calendar days
- IssuerFile the 4849 coercion chargebackThe clock starts when the date stated in Mastercard’s written notice occurs.Up to 30 calendar days
- AcquirerFile the second presentment with the merchant’s defenseThe clock starts when Mastercard settles or processes the chargeback.Up to 45 calendar days
- AcquirerUpload the required second-presentment documentsThe clock starts when the second presentment requiring documents is generated.Up to 8 calendar days
- IssuerFile pre-arbitrationThe clock starts when Mastercard settles or processes the second presentment.Up to 30 calendar days
- AcquirerRespond to pre-arbitrationThe clock starts when the pre-arbitration case is filed in Mastercom.Up to 30 calendar days
- IssuerAsk Mastercard to decide the caseThe clock starts when the acquirer rejects pre-arbitration in Mastercom.Up to 15 calendar days
Who files the dispute and what happens next
The issuer files 4849, but Mastercard supplies the basis for the case. For QMAP, the issuer uses the number of the Mastercard Announcement that listed the merchant. For coercion, it attaches the card scheme’s written notice and uses the case number stated in that notice. Mastercard permits 4849 even when an earlier chargeback under another reason code was unsuccessful. That does not remove any requirement of the new route.
The case proceeds in MastercomThis is Mastercard’s system where the issuer and acquirer submit dispute stages, messages, and documents.. The merchant gives its records to the company that processes its payments. The acquirer, not the merchant, responds to Mastercard through the second presentmentThis is the acquirer’s formal response to the chargeback. The acquirer returns the transaction to the issuer using one of the grounds and records Mastercard permits..
The acquirer has 45 calendar days from the chargeback’s Settlement Date or Central Site Business DateThis is the processing date Mastercard records for the transaction or dispute stage. It starts several 4849 deadlines.. The response must use at least one of the grounds Mastercard lists. A difference between the card number in the documents and the processing record is not, by itself, enough to challenge the chargeback.
If the issuer continues the dispute, pre-arbitrationThis is the stage where the issuer explains why the second presentment did not resolve the case before asking Mastercard for a decision. is required for transactions other than ATM withdrawals or Maestro transactions. The issuer has 30 calendar days after the second presentment. The acquirer has 30 calendar days to accept or reject; if it takes no action, Mastercom accepts the case automatically. After a rejection, the issuer has 15 calendar days to ask Mastercard for arbitration.
Source for the flow and deadlines: Mastercard Chargeback Guide, QMAP second presentment and escalation, pp. 642–663, and coercion, pp. 664–685.
Mastercard also permits a change to reason code 4849 at pre-arbitration when the second presentment resolved the original chargeback but revealed a valid QMAP or coercion case. The original chargeback must have been valid, and the new route must meet all 4849 requirements.
Source for changing the reason code: Mastercard Chargeback Guide, “Change of Reason Code to a Questionable Merchant Audit Program Chargeback,” pp. 657–660, and “Change of Reason Code to a Coercion Program Chargeback,” pp. 679–682.
Before building a defense, check whether this dispute is invalidProving any one condition is enough to challenge the dispute's validity.
- Under the QMAP route, the acquirer or merchant is not listed in the Mastercard Announcement, or the transaction occurred outside the published chargeback period.
- Under the coercion route, Mastercard did not confirm the complaint, the issuer did not receive written confirmation, or the issuer filed the chargeback more than 30 days after the date stated in that notice.
- The issuer did not properly report the transaction to the Fraud and Loss Database within the applicable timeframe, or used a fraud type that is ineligible for the program.
- The transaction belongs to a Mastercard Commercial Payments Account, a virtual account for business payments identified as MAP in PDS 0002.
Source:Mastercard Chargeback Guide, Dual Message System Chargebacks, “Questionable Merchant Activity”, pp. 637, 641–643 e 663–666
How to reduce the risk of this reason code
Reason code 4849 does not arise from an ordinary authorization, chip, or delivery failure. Under QMAP, it follows a Mastercard conclusion about the merchant’s conduct. The program sets minimum standards and looks for collusive, fraudulent, or otherwise improper activity. That is why standalone proof that the cardholder made the purchase does not resolve the reason for this code.
To reduce the risk, the merchant must prevent employees, representatives, or third parties from using threats, physical harm, or the unlawful taking of property to obtain a transaction. It should also keep its identification and location information accurate with the acquirer and preserve records for every transaction and refund. These records help establish whether the listed merchant is the same one involved in the case, whether the purchase fell within the published period, and whether a refund has already resolved the disputed amount.
If Mastercard opens a coercion investigation, the acquirer must direct the merchant to stop the activity immediately and provide information and a remediation plan within 10 calendar days. In a QMAP investigation, the acquirer may challenge Mastercard’s preliminary finding within 15 calendar days and must provide the requested records. The merchant should treat these requests as a priority and provide complete information to the acquirer.
Source for the programs and post-investigation measures: Mastercard Security Rules and Procedures — Merchant Edition, §§8.4.4–8.4.7, pp. 85–87, and §§8.6.3–8.6.5, pp. 89–90.
QMAP is one piece of Mastercard’s merchant monitoring, alongside the ECP, the EFM, and the suspended Global Merchant Audit Program (GMAP). We explain what remains in force in 2026 in our article on GMAP and Mastercard monitoring.
Evidence the merchant and acquirer need to gather
First identify the route the issuer used. Under QMAP, the defense may establish one of two independent conclusions: the merchant is not listed in the cited Mastercard Announcement, or the transaction occurred outside the published period. Compare the name, location, and acquirer in the announcement with the actual sale data.
For coercion, one condition that invalidates the case is also enough: Mastercard did not confirm the complaint; the issuer did not attach the written notice that would confirm it; or the chargeback was filed more than 30 calendar days after the date stated in that notice. When Mastercard declared that the complaint was not confirmed, that declaration is the required evidence for the first condition.
Both routes also allow common grounds. The acquirer may establish that the issuer did not properly report the transaction to the Fraud and Loss Database, used an ineligible fraud type, already received a refund for the purchase, or filed an invalid chargeback. Invalidity includes late filing, duplication, a reference that does not match the first record, missing documentation, an illegible or incomplete file, and a missing required message.
If a refund was issued, provide its date, amount, reference, and connection to the original purchase. When the credit was sent to the cardholder’s Mastercard account, the rule does not require an additional document in the second presentment. When the refund was issued by another method, the acquirer must prove that it reached the cardholder. A partial refund resolves only the refunded portion.
Documents required for the chargeback or second presentment must reach Mastercom within eight calendar days after the relevant stage is generated. The full card number must not appear; show only the last four digits.
Source for the defense paths and documents: Mastercard Chargeback Guide, QMAP second presentment, pp. 642–653, coercion second presentment, pp. 664–676, and documentation rules, pp. 638–640.
Frequently asked questions
When does Mastercard use reason code 4849?
There are two alternative situations. The first is when the acquirer and merchant appear in a Mastercard Announcement issued under the Questionable Merchant Audit Program (QMAP). The second is when Mastercard itself confirms in writing that the merchant conducted transactions through coercion. An issuer’s suspicion or a standalone complaint is not enough.
What makes a QMAP-based 4849 chargeback valid?
All of these requirements must be present: the Mastercard Announcement lists the acquirer’s name and identifier and the merchant’s name and location; the transaction occurred during the published chargeback period; and the issuer properly reported the transaction to the Fraud and Loss Database. Mastercard permits 4849 even after an unsuccessful dispute under another reason code, but that does not remove any of these requirements.
What does Mastercard consider coercion under code 4849?
It means a transaction was completed because the cardholder or an immediate family member suffered or was threatened with physical harm, or because their property was threatened or unlawfully taken. An allegation alone does not support a 4849 chargeback: Mastercard must confirm the complaint and identify the eligible transaction in writing.
How can the acquirer challenge reason code 4849?
In the second presentment, the acquirer needs to establish at least one ground Mastercard accepts. These include: the merchant was not named in the announcement; the transaction occurred outside the published period; coercion was not confirmed or the written notice was missing; fraud reporting was improper; the fraud type was ineligible; a refund was already issued; or the chargeback had a timing, duplication, documentation, or message defect.
What are the main deadlines for reason code 4849?
For QMAP, the issuer uses one of two routes: up to 120 calendar days from the first publication naming the merchant, or up to 120 calendar days from the transaction’s Central Site Business Date. For coercion, the issuer has 30 calendar days from the date stated in Mastercard’s written notice. The acquirer has 45 calendar days for the second presentment; generally, the issuer then has 30 calendar days for pre-arbitration, the acquirer has 30 calendar days to respond, and the issuer has 15 calendar days after rejection to take the case to arbitration.
View all Mastercard chargeback reason codes or return to Knowledge.