Reason code · Mastercard

Mastercard 4849: questionable merchant activity

4849 isn’t a normal customer complaint. Banks can only use it when Mastercard has named the merchant in its Questionable Merchant Audit Program or confirmed a coercion claim in writing. If you see one, your processor relationship needs attention right away.

What 4849 means

4849, Questionable Merchant Activity, is different from every other code on this list. It isn’t triggered by one unhappy customer. A bank can only use it in two situations:

  • Questionable Merchant Audit Program (QMAP). Mastercard has published an announcement listing the merchant’s name, location and acquirer.
  • Coercion. Mastercard has confirmed in writing that the merchant pressured cardholders into transactions.

The transaction also has to be a fraud the bank properly reported to Mastercard. If Mastercard never substantiated a coercion claim, or the bank never got Mastercard’s written notice, the bank can’t use 4849.

What the customer told their bank

Usually that the charge was fraud. The difference is what happens next: because Mastercard has already flagged the merchant, the bank has a route to send that fraud loss back.

Time limit

  • Audit program: within 120 calendar days of the Mastercard announcement that first listed the merchant location, or within 120 days of the transaction.
  • Coercion: within 30 calendar days of the date in Mastercard’s written notice.

Your own response date is the one your processor gives you, and it’s shorter.

What proof matters

Whether the merchant location and dates really fall inside the Mastercard announcement, and whether the bank reported the fraud properly and on time. That evidence lives mostly with your acquirer, the bank that processes your cards.

Winning once may not end it

Mastercard’s Guide lets a bank file a QMAP chargeback even after an earlier chargeback on the same sale, under a different reason, failed. So a dispute you already won can come back as a 4849. Keep the records from the first round.

The common mistake

Treating it like an ordinary dispute and answering only on the facts of one sale. A 4849 means Mastercard has your business on its radar. Call your processor the day it arrives and find out what was announced, for which locations and dates.

Dispute Daddy builds this for you

For the everyday disputes, Dispute Daddy builds the response from your notice and records and keeps the deadline in view. A 4849 starts with a call to your processor. See pricing.

Questions

What does Mastercard 4849 mean?

Mastercard has listed the merchant location in a Questionable Merchant Audit Program announcement, or confirmed in writing that the merchant coerced cardholders. Banks can then charge back eligible fraud transactions.

How long does a bank have to file a 4849?

Under the audit program, within 120 days of the announcement that first listed the merchant, or of the transaction. For coercion, within 30 days of the date in Mastercard’s written notice.

Can a customer file a 4849 on their own?

Not really. The customer reports fraud to their bank, but the bank can only use 4849 when Mastercard has already flagged the merchant.

Sources

  1. Mastercard Chargeback Guide, Merchant Edition, 19 May 2026 edition, Chapter 2, Questionable Merchant Activity (4849): QMAP and coercion conditions, ineligible transactions and time frames; obtain the current edition from your acquirer.
  2. Stripe: Dispute reason code categories, Stripe groups Mastercard 4849 under Fraudulent; read October 25, 2026.

General information, not legal advice. Network and processor rules change; the due date on your own dispute notice always governs.

You earned it.
Defend it.

Dispute Daddy builds the case and keeps the deadline in view. A flat $99 a month.

About this site

This site uses examples made for illustration. They are not real customer records.

Early-access signup stores your email and, if provided, company name for your request. We count page visits with Cloudflare Web Analytics, which uses no cookies and doesn’t identify you. No advertising trackers are used. Read the Privacy Policy.