Chargeback Fraud: What It Is, How It Works, and How to Stop It
Chargeback fraud is when a cardholder buys something, receives it, then tells their bank they didn’t authorize it—getting their money back while keeping what they bought. It can look just like an honest dispute, so it’s hard to catch. Federal law generally doesn’t require a cardholder to contact the merchant before disputing a transaction with their card issuer, so you may not hear about the dispute until the money is out of your account. Banks have also made disputes easier to file, often in a few taps inside an app.
This guide explores how a chargeback fraud dispute starts, how it gets decided, which businesses are hardest hit, what it costs you, and how to prevent and fight it.
What is a chargeback, and what laws protect the customer?
A chargeback is a payment reversal. A customer tells their bank there's a problem with a charge, the bank decides the dispute is valid, and it takes the money back out of the merchant's account.
Federal law gives consumers the right to dispute billing charges:
The Fair Credit Billing Act (FCBA) and Regulation Z establish billing-error protections for credit cards.
The Electronic Fund Transfer Act and Regulation E provide separate error-resolution and unauthorized-transfer protections for debit cards and other electronic fund transfers.
What is chargeback fraud?
Chargeback fraud is chargeback protection used dishonestly. It’s a form of first-party fraud: the person who made the purchase is the person who disputes the charge, even though they know the charge is theirs.
Deliberate chargeback fraud can trigger federal fraud statutes, including wire fraud and access device fraud, but a prosecutor has to prove the customer knew the charge was theirs. Prosecutions are rare. Don't count on the law to get your money back.
That leaves prevention, but not the familiar checkout controls that many merchants rely on. In chargeback fraud, no card is stolen and no account is breached, so traditional tools built to catch stolen-card fraud aren’t designed to catch it. Preventing chargeback fraud starts with a billing descriptor that customers recognize, a cancellation process that's easy to find, and records that are complete enough to win if a dispute happens.
Chargeback fraud vs. friendly fraud vs. true fraud
Chargeback fraud is a type of friendly fraud. True fraud is different: someone other than the cardholder uses the card without permission, and the cardholder disputes the charge.
Types of friendly fraud
Friendly fraud is any dispute filed by a cardholder against their own purchase, whether they’re simply mistaken about the charge or they know it’s legitimate and dispute it anyway.
Honest mistake disputes: A customer may not recognize a charge, think they already stopped a payment, see an unfamiliar business name on their statement, or forget a subscription renewed. They aren't trying to take anything, but the dispute can still end in a chargeback.
Dishonest (deliberate) disputes: This is chargeback fraud, also called first-party misuse, although payment companies don't always use the terms consistently. A customer may use a digital product for a month, then tell their bank they never authorized the charge. Or a shopper receives an order and then reports it as undelivered. Another version involves a household member: a parent knows their teenager made the purchase and disputes it anyway.
Honest and dishonest disputes look the same
When a dispute notice arrives from your processor or the cardholder’s bank, there is no way to tell if it’s honest or dishonest. Both can arrive under the same reason code. The customer's package could have really been stolen off the porch, or they could be lying about it.
How true fraud, friendly fraud, and chargeback fraud compare
TRUE FRAUD | FRIENDLY FRAUD | CHARGEBACK FRAUD | |
|---|---|---|---|
Who uses the card? | Someone other than the cardholder, without permission | The cardholder or someone they allowed to use it | The cardholder or someone they allowed to use it |
Was the purchase made with the cardholder’s permission? | No | Usually, though a household member sometimes uses a stored card | Usually |
Is the dispute honest? | Yes, the charge was not authorized | Sometimes | No |
What’s the intent? | Theft | Mistake or deliberate abuse | Deliberate abuse |
What helps prevent it? | Checkout controls | Clear billing and easy cancellation | Proof the customer made the purchase |
Telling these apart matters because the fix is different for each one. If true fraud is driving your chargebacks, tighten checkout controls. If customers are disputing their own purchases, those controls won't solve the problem.
How chargeback fraud works
A typical chargeback follows this path, although the exact process and terminology vary by card network.
1. Purchase
A cardholder buys something with their own card and the sale clears normally.
2. Dispute
The dispute starts the same way whether the customer is honest or not. They contact the bank that gave them the card (the issuing bank) and say they didn't authorize the charge or never received what they bought. The bank reviews the claim and decides whether to file a chargeback against the merchant, which may happen months after the sale.
How long a customer has to dispute depends on the network, the reason, and when the goods were due. Many network chargebacks have a 120-day filing window, but that clock doesn't always start on the transaction date. For an order that never arrived, the filing window may run from the expected delivery date, subject in some cases to an outer limit of 540 days from the transaction. On a pre-order or a service booked months ahead, you could be defending that sale more than a year later.
3. Reversal
If the bank decides to file the chargeback, the disputed amount is pulled from the merchant's account through the payment processor and acquiring bank (the bank that holds the merchant account). The processor may also charge a dispute fee.
4. Representment
The merchant contests the claim by submitting evidence that the purchase was legitimate—Mastercard calls this a second presentment. Without evidence that answers the specific claim, the reversal stands. That’s why merchants need to keep proof of a sale for as long as the customer can dispute it (as seen in step 2).
5. Pre-arbitration, second chargeback, and arbitration
If the issuer doesn't accept the merchant's evidence, the dispute can continue into pre-arbitration. If the merchant concedes, the disputed amount is taken back again in a second chargeback. If neither side gives way, the case goes to arbitration, where the card network decides who's liable.
What types of businesses are most at risk for chargeback fraud?
Any business that takes cards is subject to chargeback fraud. What varies is how hard the dispute is to answer. Can you prove the customer got what they paid for and recognizes the charge?
Digital goods and software-as-a-service (SaaS) have no carrier scan or other third-party delivery record, so your own records have to show the customer received and used what they bought. Keep: access and usage logs, IP and login data, prior undisputed transactions.
Subscriptions and streaming services may face disputes months after the sale, when a customer disputes recurring charges as unauthorized. Keep: sign-up consent, renewal notices, usage history.
Travel and hospitality customers may dispute a booking because they don't recognize the hotel name on their statement. Keep: booking confirmation, check-in or arrival records, agreed cancellation policy.
Ecommerce and card-not-present sales can't prove the physical card was present, making an unauthorized-purchase claim harder to disprove. Keep: address and security code match, device and login data.
Marketplaces don't have all the evidence. The platform has the payment record and the seller has the shipping proof, so neither one can answer a dispute without the other. Keep: transaction records, buyer-seller communications.
WHAT TO WATCH FOR
Return fraud: A customer claims they returned an item and never got their refund, or sends back an empty box and disputes the charge. Keep: return authorization, return tracking, notes or photos on condition.
The double refund: A customer receives a refund, then disputes the original charge before the refund posts to their statement. The merchant pays twice for the same order. Keep: refund date and confirmation, filed with the original transaction.
Merchant-error chargebacks: These aren't fraud. If a customer is billed twice, charged the wrong amount, or billed for a cancelled subscription, the chargeback is doing what it's meant to do—giving the customer their money back. There’s nothing to contest. But you may still pay a dispute fee, and the chargeback can count toward network monitoring ratios, so track these separately from fraud.
How common is chargeback fraud?
There isn't a definitive industry-wide figure for how common chargeback fraud is. What separates it from an honest dispute is whether the customer knew the charge was theirs, and that can’t be measured reliably at scale. Published estimates generally come from dispute-service companies and card networks.
The cost of chargeback fraud
Chargeback fraud costs more than the disputed amount.
The payment is reversed out of your account.
If the customer keeps the product, you lose the product, too.
Your processor may charge a dispute fee, and whether you get it back if you win depends on your agreement with them.
You have to pay staff to pull records and respond.
Those costs come with every dispute.
The card networks
Visa and Mastercard both watch the chargeback rate, but they don't calculate it the same way.
Mastercard flags you as an Excessive Chargeback Merchant when you hit 100 chargebacks in a month at a rate of 1.5% or higher. You need both, not one or the other. And Mastercard measures this month's chargebacks against last month's sales, so a slow month can push your rate up without a single extra dispute.
Visa counts differently. Under the Visa Acquirer Monitoring Program (VAMP), the U.S. threshold is 1.5%, with a minimum of 1,500 disputes and fraud reports in a month before a merchant enters the program. Visa includes both disputes and transactions reported as fraud when it calculates your rate—even if a reported fraud transaction never becomes a chargeback. It compares that total with the number of card-not-present transactions you processed.
Your processor
If your chargeback rate climbs, your processor can move you to higher-risk pricing, hold back a percentage of your sales as a reserve against future disputes, or close your account—and the next processor will want to know why the last one dropped you. In some cases, a closure ends up in Mastercard's MATCH system, a record other processors check. It stays there for five years.
Stopping a dispute before it becomes a chargeback
Not every complaint has to become a chargeback. Visa's Verifi and Mastercard's Ethoca send you an alert before it does, so you can refund or fix the problem first, before the dispute fee and the paperwork.
A few things to know before you buy the solutions:
You pay per alert, including the ones where the customer was never going to follow through.
For Visa, resolving a dispute through an alert can keep it out of your rate—but only if you get to it before Visa pulls the month's numbers.
Even then, a fraud report already filed on that transaction can still count toward your Visa rate.
How to fight a chargeback (representment)
You fight a chargeback by sending the issuing bank evidence that the purchase was legitimate and asking them to reverse their decision. That’s called representment, and it's the only way to get the money back once a chargeback is filed.
Start with the reason code
Every chargeback arrives with a reason code that identifies what the customer told their bank and determines what you'll need to prove. Visa and Mastercard use different codes.
Visa gives each claim its own number:
Code 10.4: Fraud in a card-not-present (CNP) transaction. The customer is saying they didn't authorize the purchase.
Code 13.1: Merchandise or services not received.
Mastercard uses one fraud code and one catch-all:
Code 4837: No cardholder authorization. This is Mastercard's version of Visa's 10.4.
Code 4853: Cardholder dispute. This is the catch-all, with sub-reasons underneath for goods or services not provided, not as described, and several others. If you've seen code 4855 somewhere, Mastercard retired it and folded it into 4853.
The code tells you what the customer claimed, but it won't tell you if they're telling the truth. A customer who didn't recognize your billing descriptor and a customer who's lying about the same purchase both come in under the same code.
Since the code won't tell you, check the claim against your own records. If someone says they didn't authorize a purchase made from their own device, on their home network, shipped to the address they always use, you may have a strong case.
Build the evidence package
What you send as evidence depends on what the customer claims. Delivery confirmation answers a not-received claim. But with an unauthorized-transaction claim, the question isn't whether the package arrived but who placed the order.
DISPUTE CLAIM | EVIDENCE TO SUBMIT |
|---|---|
Unauthorized transaction | Device and login match, authentication record, account order history |
Merchandise not received | Carrier tracking, delivery or signature confirmation, prior order history |
Digital goods dispute | Access and usage logs, IP and login data |
Subscription dispute | Sign-up consent, renewal and cancellation records, usage logs, customer communications |
What Visa and Mastercard offer for first-party disputes
Both networks wrote rules for exactly this situation—a dispute where the cardholder really did make the purchase.
Visa's Compelling Evidence 3.0 (CE3.0) lets you submit two earlier undisputed orders from the same customer, each between 120 and 365 days old at the time of the dispute. The orders must match the disputed order on at least two data points—user ID, IP address, shipping address, or device ID—and one must be the IP address or device ID. If it qualifies, liability moves to the issuing bank. Visa also qualifies some transactions automatically through Visa Secure and Visa Data Only.
Mastercard First-Party Trust works from enhanced transaction data you share at the time of the transaction or dispute. To qualify for liability protection, you send one data point from the device category (IP address, device ID, or fingerprint), one from the delivery category (shipping address, email, or telephone number), and a third that's either an identity factor or an unused element from the first two.
When to fight and when to accept
Representment isn't automatic. Weigh the transaction value, strength of your evidence, and whether the customer has disputed before. Because the dispute fee may not come back even if you win, fighting a small charge can cost more than accepting it. A large charge with delivery confirmation and a matching device record may be worth fighting for.
How CSG Forte can help
CSG Forte's Dex platform reviews your evidence before it goes to the network, checks it against the reason-code requirements, and returns it if the documentation is incomplete or doesn't meet those requirements. That gives you time to fix the submission before the deadline.
Once Forte notifies you of a dispute, most merchants have 10 calendar days to either accept the chargeback or submit evidence to fight it. Government merchants have 20 days. The shorter deadline gives your processor time to review and submit the evidence before the card network’s deadline. If you miss the due date, you lose the dispute automatically.
Dex notifies you when a dispute arrives, shows which documents are needed, lets you respond and upload evidence online, and tracks the case through the decision. It handles full and partial disputes on Visa, Mastercard, Discover, and American Express, plus eCheck chargebacks.
Take control of chargeback disputes with Dex: When a dispute arrives, the response window is already running. Dex gives you one place to review the claim, see what documentation is required, submit evidence, and track the dispute through the final decision.
On the prevention side,PaymentsProtection.ai monitors card, ACH, and wallet activity in one place, so you're watching every payment method in the same system rather than three.