Mastercard First Party Trust Program Explained

Any merchant that processes card-not-present (CNP) transactions needs to be aware of Mastercard’s First Party Trust Program. It’s crucial for ecommerce businesses, subscription providers, and merchants handling online payments. 

The program is Mastercard’s solution to one of the most expensive problems in digital payments: friendly fraud. 

Key Takeaways:

• First-party fraud accounts for 75% of all fraud claims for online businesses. 
• Mastercard’s First Party Trust program gives merchants a way to share transaction data in a way that prevents fraudulent chargebacks before they happen.
• Participating businesses get liability protection when disputes are wrongfully filed against legitimate transactions.
• Once enrolled, you just need to capture and submit three qualifying data points.

What Exactly is First-Party Fraud?

First-party fraud, more commonly referred to as “friendly fraud,” occurs when a cardholder disputes a transaction that was legitimately authorized. 

It’s the opposite of third-party fraud, where a cybercriminal steals someone’s card information to make unauthorized purchases. 

With first-party fraud:

• The cardholder (or an authorized household/family member) makes a purchase.
• They receive the goods or services.
• Then they dispute the charge claiming fraud or goods/services not delivered/rendered. 

This is a harder problem to solve than traditional fraud because nothing looks suspicious at the time of the purchase. Cardholders use their own card and own device, and the red flags only show up after the dispute is filed.

What is Mastercard’s First Party Trust Program?

The First Party Trust Program is Mastercard’s way of giving merchants a secure, structured channel to share transaction data with Mastercard and card issuers. 

Data can be shared either at the time of purchase or after a dispute is filed, so fraudulent chargebacks can be identified and stopped before they’re processed. 

Merchants participating in the First Party Trust program essentially get two things in return:

1. Liability protection on qualifying transactions.
2. Stronger position during the dispute process. 

The program first rolled out as a pilot program in 2023, and after a successful launch, expanded to new regions globally in 2025. 

How the Program Works

Mastercard’s First Party Trust Program gives merchants two windows to submit transaction data. And you only need to do one of them to qualify for protection.

Submitting Data During Authorization

The first option involves sharing transaction data with Mastercard during every transaction, before any potential dispute is raised. 

When submitted at checkout, Mastercard’s AI and risk models use the data in real-time to assess whether the transaction looks legitimate. Additionally, it builds a timestamped record that can strengthen the merchant’s position if a dispute gets filed down the road. 

Submitting Data at the Time of a Dispute

Alternatively, you can wait to submit your data until a cardholder initiates the dispute process. 

This reactive approach is less ideal than the pre-authorization submission because it requires an extra step, instead of everything happening automatically. But it still qualifies for the liability protections defined by the program. 

Transaction Data Requirements

Regardless of whether you submit data during the initial authorization or after the dispute, Mastercard requires merchants to submit one data element from each of the following three categories:

• Device: IP address, device ID, or device fingerprint
• Delivery: Shipping address, email address, or telephone number
• Identity: Account ID, login info, phone number, device location, device name, or billing address. 

All you need is three total data points. 

Most merchants already collect this information at the time of checkout. So participation in the program is largely just a matter of ensuring it’s being passed to Mastercard through the right channel. 

What Merchants Get Out of the Program

I’ve already mentioned that the two primary benefits are liability protection and a stronger dispute resolution position. But it’s worth unpacking these a bit more to understand what they actually mean in practice.

When a merchant submits qualifying data, and a dispute is filed, Mastercard’s rules still require the issuing bank to evaluate the data before a chargeback gets filed. So the merchant isn’t automatically off the hook.

The data gets reviewed, and if it points to first-party misuse, the issuer can present their findings to the cardholder and give them a chance to drop the claim. This all happens before it becomes a formal chargeback.

I think that the pre-chargeback intervention is the most underappreciated part of the program. 

By resolving disputes before they escalate to a chargeback, it saves the merchant costs associated with chargeback fees, lost merchandise, and time spent fighting things. 

When cases do proceed to the chargeback stage, the program still gives merchants the ability to present their case with a timestamped record of the transaction data that’s already recorded in Mastercard’s system. 

It’s also worth noting that your approval rates can benefit from this program. When issuers see that your transactions consistently come with strong identity signals, they are less likely to decline borderline authorizations. 

Mastercard First Party Trust vs. Visa Compelling Evidence 3.0

The logic behind Mastercard FPT and Visa CE3.0 is very similar. Both programs are designed to give issuers better data for chargeback decisions while giving merchants a more defined path to prove their transactions are legitimate.

But the key difference is in the approach.

Visa’s Compelling Evidence 3.0 program is built around retroactive evidence. Once the dispute process starts, the merchant can submit data from two prior undisputed transactions to establish a pattern of legitimate cardholder behavior. 

Mastercard’s First Party Trust program is more proactive. Data can be shared at the time of transaction to build a record before any dispute is raised. It also relies more heavily on Mastercard’s network-level AI to connect the dots between merchants, acquirers, and issuers. 

With Visa CE3.0, you need to prove that the cardholder transacted with your business in the past using strict data elements. Mastercard’s First-Party Trust program doesn’t require prior history with a cardholder to prove transactions were legitimately authorized, but it does require three qualifying data points.

Meaning a brand new customer can still qualify for commercial transactions with First-Party Trust, which isn’t possible with CE3.0. 

How Merchants Can Actually Participate in the First Party Trust Program From Mastercard

The good news for most merchants is that the technical lift for participation is minimal. Data can be submitted through your existing payment stack (processor, gateway, fraud management platform, etc.) without having to build a new integration from scratch. 

If your processor or gateway provider already supports First Party Trust, your participation may be as simple as enabling the feature and confirming that the right data fields are being captured and passed at checkout. 

The practical checklist is fairly short:

• Confirm your processor or gateway supports First Party Trust data submission.
• Verify that your checkout flow captures the three required data elements (device, delivery, identity).
• Ensure that the data is being passed to Mastercard through the correct channel (authorization, dispute, or both).

That’s basically it. 

If you’re not sure whether your current setup supports the program, it’s worth asking your processor directly. Just don’t let your processor take advantage of you and try to charge you a fortune for participation. If you’re unsure whether the fees you’re being charged are fair, just reach out to our team at MCC for a free audit, and we’ll let you know if it’s worth negotiating a better rate with your provider.