Chargeback fraud happens when a customer who made a purchase, and received what they paid for, tells their bank the charge was unauthorized or the order never came. The bank reverses the payment, and the merchant loses the sale, the goods and usually a fee.
It is also called friendly fraud, and Visa's term is first-party misuse. The names cover a range of behavior, from honest confusion over a line on a statement to deliberate abuse. For the merchant, the response is the same in each case: records that show who bought, what was delivered and what was agreed.
Quick answer: Chargeback fraud (friendly fraud) is a dispute filed by the real cardholder against a legitimate charge. It differs from true fraud, where a stranger used stolen card details, and from merchant error, where the business got something wrong. Merchants respond by sending evidence that the cardholder took part in the transaction, within the deadline their processor sets.
What chargeback fraud is
The clearest official definition comes from Visa. Its merchant FAQ on compelling evidence rules says first-party misuse occurs when cardholders report fraud on transactions that were authorized. In everyday use, the term also covers disputes filed under other reasons, such as a claim that goods never arrived when they did.
Not every case is deliberate. Three situations look identical when the dispute lands:
- Confusion. The customer doesn't recognize the merchant name on the statement. Visa's dispute guide for merchants lists an unclear merchant name among the common causes of card-absent fraud disputes.
- Household use. Someone in the cardholder's family made the purchase. Visa's evidence rules include proof that a member of the cardholder's household completed the transaction.
- Deliberate misuse. The customer knows the charge is valid and disputes it anyway.
You usually can't tell which one you're facing, and you don't need to. The card rules ask whether the cardholder took part in the transaction, not what they intended.
Why the loss lands on the merchant
Dispute rights exist to protect consumers, and they do. In the United States, Regulation Z lets a credit cardholder report a billing error, including a charge they didn't make or goods not delivered as agreed, and bars the issuer from collecting the disputed amount while it investigates. Other countries have their own rules, and the card networks add protections of their own.
A Federal Reserve Bank of Kansas City working paper describes the result: cardholders are rarely liable, so the loss lands on the issuer or the merchant. For card-not-present sales, the paper notes, issuers can charge fraud back to merchants more easily, because a merchant has a harder time authenticating a remote buyer.
None of the primary sources used here measures how common chargeback fraud is. The Kansas City Fed study found that fraud accounted for about 50% of Visa and Mastercard chargebacks in its data, which runs from October 2013 to September 2014, but that figure reflects what cardholders reported as unauthorized. It can't separate true fraud from mistaken or false claims.
Chargeback fraud vs. true fraud vs. merchant error
Nearly every dispute falls into one of three groups, and the middle one is the main case for contesting.
| True fraud | Chargeback fraud (friendly fraud) | Merchant error | |
|---|---|---|---|
| Who made the purchase | A stranger using stolen card details | The cardholder, or someone in their household | The cardholder |
| What went wrong | The card was used without permission | Nothing, or a misunderstanding | The merchant's process: a double charge, a missed cancellation, a late refund, the wrong item |
| Is the claim accurate? | Yes | No | Yes |
| Usual dispute category | Fraud | Fraud or consumer dispute | Processing error or consumer dispute |
| Sensible response | Accept it, unless the payment was authenticated with 3-D Secure, and tighten fraud checks | Respond with evidence | Accept or refund, then fix the process |
Sort first, because contesting a valid dispute wastes time. Visa's guide repeats one instruction in many of its dispute conditions: when the cardholder's claim is valid, accept the dispute.
Warning signs in your own records
A dispute coded as fraud deserves a second look when your records tie the purchase to the cardholder. The checks below come from the kinds of evidence Visa's rules recognize.
- The order was delivered to an address that matched the card's billing address in the AVS check.
- The purchase came from the same account login, device or IP address as earlier purchases that were never disputed.
- A digital product was downloaded, or the service was used, after the purchase date from the customer's usual device or account.
- The customer kept using a subscription after the charge they're disputing.
- Earlier payments for the same product or subscription went through without complaint.
- For travel and hospitality sales, loyalty points tied to the booking were earned or redeemed.
None of these proves bad intent. They show participation, which is what the rules test.
If your records show no link to the cardholder at all, treat the case as true fraud. Accept the dispute and review your fraud checks.
The dispute timeline from the merchant's side
Three dates matter to a merchant: when the dispute opens, when your evidence is due and when the issuer decides.
1. The dispute opens. The customer contacts the issuer. If the issuer decides a dispute right applies, it sends the case through the card network to your acquirer, which debits the disputed amount from your account and notifies you. Many providers add a chargeback fee at this point. Stripe's documentation on how disputes work says card networks typically allow disputes within 120 days of the payment, and longer in some situations.
2. Your evidence is due. Visa's guide says each step in the cycle has a defined time limit and that the response window may vary by acquirer. Stripe says businesses usually have 7 to 21 days, depending on the card network. Square's disputes walkthrough gives its sellers seven days from the notification email (both checked October 2026). Visa warns that a late response can lead to an unfavorable outcome, so treat the date as fixed.
3. The issuer decides. The issuer reviews what you sent and may go back to the cardholder. Stripe says issuers usually take 60 to 75 days to evaluate evidence. Square says the bank can take up to 90 days from the start of the dispute. If you win, the debited amount is returned. If you lose, nothing more moves, because the money already left your account in step 1.
Some cases go further, to pre-arbitration and arbitration under the card network's rules. Not every processor supports those stages: Stripe's documentation, for example, says it doesn't support arbitration.
| Stage | Typical timing | Example date |
|---|---|---|
| Purchase | Day of sale | January 12, 2026 |
| Dispute opens, amount and fee debited | Usually within 120 days of purchase | March 3, 2026 |
| Evidence deadline | 7 to 21 days after the dispute opens | March 10 to March 24, 2026 |
| Issuer decision | Up to about 90 days after the dispute opens | By June 1, 2026 |
A typical card dispute timeline from the merchant's side. Your processor sets the exact evidence deadline.
Note: The legal clock for the customer's bank is separate. Under Regulation Z in the US, a credit card issuer must resolve a billing-error claim within two complete billing cycles, and no later than 90 days after receiving it. Debit cards fall under Regulation E, which has different time limits, and other countries set their own periods.
What evidence typically helps
Good evidence answers the specific claim. Visa defines compelling evidence as information that attempts to prove the cardholder participated in the transaction, received the goods or services, or benefited from them.
| The customer's claim | Evidence that addresses it |
|---|---|
| "I didn't make this purchase" (physical goods) | Proof of delivery to an address that matched in the AVS check. Photos or emails linking the recipient to the cardholder |
| "I didn't make this purchase" (digital goods or software) | What was downloaded and when, plus at least two supporting details such as the buyer's IP address, the device ID, the name and email on the customer profile, or a record that the account was accessed |
| "I didn't make this purchase" (repeat customer) | Earlier undisputed purchases that share the same IP address or device and another identifier with the disputed one |
| "I cancelled the subscription" | Proof the service was used after the claimed cancellation, the terms the customer accepted and your cancellation log |
| "It never arrived" | The carrier's confirmation of delivery to the agreed address |
| "I'm owed a refund" | The refund policy accepted at checkout, or proof that the credit was already issued |
The repeat-customer row has had its own rule since April 2023. Visa's FAQ says that for a card-not-present fraud dispute, two earlier undisputed transactions between 120 and 365 days old can overturn the claim when they share at least two identifiers with the disputed one. The identifiers are the customer account or login ID, the delivery address, the device ID or fingerprint, and the IP address, and one of the two must be the device or the IP address. When the criteria are met, liability moves to the issuer.
Three practical points from Visa's guide:
- Send everything at the first response. Evidence must be legible and in English, or come with an English translation.
- Address each point the cardholder made.
- Know the limit. Compelling evidence doesn't oblige the issuer or Visa to decide in your favor.
How to reduce chargeback fraud
You can't screen for intent at checkout. You can remove the confusion that causes innocent disputes and build the record that defeats false ones.
- Use a statement name customers recognize, and repeat it in receipts.
- Send a receipt and a renewal reminder for every charge. They create a dated record.
- Log account activity. Logins, IP addresses, device IDs, downloads and usage are the evidence the rules ask for.
- Keep delivery confirmation for shipped goods.
- Make support easy to reach. The FTC advises US consumers with a purchase problem to contact the seller first.
- Use 3-D Secure where it fits. Visa's guide says a successfully authenticated transaction protects the merchant from fraud-related disputes, with rules that vary by region.
The wider set of measures, including refunds and cancellation, is in the guide to chargeback prevention.
Frequently asked questions
Is friendly fraud the same as chargeback fraud?
In practice, yes. Both describe a dispute from the real cardholder over a legitimate charge. Visa's rules use a third term, first-party misuse.
Can a merchant win a chargeback fraud dispute?
Yes, when the records link the cardholder to the purchase. The Kansas City Fed study found that merchants successfully disputed 20% to 30% of the Visa and Mastercard chargebacks of all types that they received between October 2013 and September 2014. Your own odds depend on the claim and on what you logged at the time of sale.
Does 3-D Secure stop chargeback fraud?
It helps with one kind. Visa's guide says successful authentication protects the merchant from fraud-related disputes. A customer can still dispute the same payment as not received, not as described or cancelled, and those claims need other evidence.
Should I contact the customer after a dispute is filed?
It can help, because some cases are plain confusion. If the customer agrees the charge is valid, Visa's guide lists a letter or email from the cardholder saying they no longer dispute the transaction as a valid response. Send it as evidence. Stripe's documentation notes that a dispute is only closed in your favor once you respond, even when the customer says they've withdrawn it.
