Mastering disputes and chargebacks. 7 chapters and a final quiz.

Chapter 1. Anatomy of a chargeback: players and life cycle.

A chargeback is the mechanism an issuing bank uses to claw back from the merchant the amount of a transaction the cardholder has disputed. It runs through the network, which debits the acquirer before the acquirer debits its merchant. Chargebacks originated in the US with the Fair Credit Billing Act of 1974. The schemes’ operating rules then extended them far beyond that original legal framework: Visa Core Rules, Mastercard Chargeback Guide, and the CB rulebook. A chargeback is not a court proceeding. It is private, contractual, and arbitrated by the network, with its own reasons, its own deadlines, and its own list of admissible evidence. Anything outside that list carries no weight.

The cycle always swings back and forth the same way. Money leaves the merchant’s account as soon as the chargeback is raised, under the debit first principle, so the merchant carries the cash cost of the dispute for as long as it lasts. Each side can then return the ball until arbitration, each time bringing something the other side had not produced. At every stage, whoever fails to respond in time loses by default, and the merits of the case are never examined.

Chapter 2. Visa, Mastercard, and CB reason codes.

The reason code drives the entire dispute. It determines the admissible evidence, the applicable deadlines, and the odds of winning a representment, so much so that a defense built on the wrong code is lost before anyone reads it. Both major networks group their codes into four families: fraud, authorization, processing errors, and commercial disputes (consumer disputes). The family sets the spirit of the defense; the code sets the letter.

Mastercard has heavily consolidated its codes. The former 4841, 4854, 4855, 4859, and 4860 were folded into 4853, and processing errors into 4834, so the code alone no longer tells you what the cardholder is complaining about. The specific reason now sits in a subfield (the dispute condition), which you must read in Mastercom to choose the right defense and to know which documents the network will accept.

The domestic CB network uses its own set of reason codes, aligned with the same broad families (fraud, commercial dispute, processing error), and its messages run through the systems of GIE CB (the consortium that runs the scheme) and STET. For a co-badged CB/Visa or CB/Mastercard card, the dispute follows the rules of the network the transaction actually went through. A single merchant can therefore receive disputes under three different rulebooks. In practice, the acquirer presents them in one format in its back office, but the deadlines and required evidence remain those of the original network, which you must identify before opening the case.

Chapter 3. The customer side: rights, deadlines, and fraud vs. commercial disputes.

In Europe, cardholders have two layers of protection, which differ in both source and strength. Law covers unauthorized transactions under PSD2, transposed in France as Articles L. 133-18 et seq. of the French Monetary and Financial Code. Scheme rules cover commercial disputes, which no law anywhere requires the bank to pursue. The two regimes are often confused, even by bank advisers, and that confusion causes a large share of misclassified chargebacks.

• Unauthorized transaction (fraud): the bank must refund immediately, and no later than the end of the first business day after the report (Art. L. 133-18), unless it has documented grounds to suspect fraud by the customer. The cardholder has 13 months from the debit date to report it (70 days if the payer’s PSP is outside the EEA).
• €50 liability cap: when a lost or stolen instrument is used with the personalized security credentials, the cardholder bears losses incurred before reporting the card lost or stolen, up to €50 (Art. L. 133-19), unless the bank did not require strong authentication.
• Gross negligence: if the bank proves the customer was grossly negligent (deliberately sharing their codes, approving in 3DS a fraudulent transaction whose details were spelled out), it can refuse the refund. The burden of proof is on the bank.
• Commercial dispute (item not received, not as described, disputed subscription): no legal right to a refund from the bank. The cardholder goes through the merchant’s customer service, then possibly the network chargeback, which the bank initiates at its discretion under scheme rules.

For the merchant, the consequence is operational. When a bank refunds a customer for fraud, it almost always raises a chargeback to recover the money from the merchant. The fight is therefore not against the customer but against the classification. Proving the transaction was authorized (authentication, history) turns an indefensible 10.4 into a winnable case, provided you have kept those records since the transaction was accepted.

Chapter 4. The merchant side: representment, evidence, and arbitration.

When a chargeback arrives, the merchant has three options: accept it (the debit stands), refund up front if the dispute has not yet been formalized, or represent it (representment / dispute response). The decision is economic. Representment takes staff time (30 to 60 minutes per case with good tooling) for an average win rate of 30 to 45%, which mechanically sets an amount below which the effort never pays for itself. Below a certain amount, accepting is rational; above it, a standardized case built from a single template per reason code is the way to go.

The evidence file, reason by reason

• CNP fraud (10.4 / 4837): proof of 3DS authentication (CAVV, ECI), AVS/CVV matches, IP address and device fingerprint, customer account history, and above all Compelling Evidence 3.0 (see below).
• Not received (13.1 / 4853): carrier tracking number showing delivery to the address provided, signed proof of delivery, or for digital goods, time-stamped download/login logs with IP address.
• Not as described (13.3 / 4853): product description as displayed at the time of order, photos, customer service exchanges, proof that the offered return was refused or not used.
• Canceled recurring (13.2 / 4853): sign-up page with terms of sale and a time-stamped consent checkbox, renewal notices sent, no cancellation request before the billing date.
• Credit not processed (13.6): proof the refund was already issued (the credit’s ARN), the simplest defense and the most often forgotten.

REPRESENTMENT FILE -- Visa Dispute 10.4 (Other Fraud, CNP)
==================================================================
Case ID           : 7712345678901
Disputed amount   : EUR 89.90 -- transaction of 2026-06-14
Notification      : 2026-06-28 -- response due: 2026-07-28 (30 days)

1. FACT SUMMARY (one page maximum)
   Known customer (account created 2025-08-03), 4th order,
   delivered to usual address, no prior disputes.

2. COMPELLING EVIDENCE 3.0 QUALIFYING TRANSACTIONS
   - ORD-71201 of 2025-09-12 (289 days): same device ID + same address
   - ORD-74830 of 2025-12-20 (190 days): same device ID + same account
   Two undisputed transactions within the 120-365 day window,
   two matching elements including device ID -> shift to issuer.

3. SUPPORTING EVIDENCE
   - 3DS2 frictionless, TRA exemption (hence no 3DS shift)
   - CVV match, IP geolocated 3 km from billing address
   - Colissimo delivery 6A12345678901: status DELIVERED on 2026-06-17

4. ATTACHMENTS
   Invoice, terms acceptance log (timestamp + IP),
   export of prior orders, proof of delivery.

Arbitration is the last resort, used when pre-arbitration has not brought the two sides any closer. The scheme decides, and the losing party pays the case fee, around $500 at both Visa and Mastercard, plus any additional fees. Only escalate to arbitration if the amount at stake clearly exceeds the fees and the case brings something the issuer could not ignore. Statistically, the vast majority of disputes are resolved before this stage, through acceptance, a successful representment, or agreement at pre-arbitration.

Chapter 5. Scheme monitoring programs and thresholds.

Beyond the cost of each case, chargebacks expose merchants to monitoring programs that look at ratios, not amounts. The schemes track each merchant’s dispute-to-transaction ratios monthly through its acquirer and impose fines, remediation plans, or even exclusion. The acquirer, which is financially liable to the network for its merchants’ failures, passes everything on. It terminates the merchant agreement before the scheme has to.

A merchant terminated for excessive disputes is added by its acquirer to the MATCH list (Mastercard Alert To Control High-risk Merchants), which every acquirer checks during onboarding. Listings last five years and make it extremely hard to get a new merchant account, since the listed merchant must find an acquirer willing to take on its history. It is the harshest penalty in the ecosystem, far worse than fines, because it puts the merchant’s very ability to accept cards at stake.

• Monitor two separate ratios: disputes to transactions (schemes) and reported fraud to volume (TC40, SAFE). They often diverge.
• Ask your acquirer every month where you stand against the thresholds: merchants have no direct access to scheme counters.
• Plan ahead: a seasonal sales peak in December produces a dispute peak in January–February, and the ratio worsens as the denominator drops back.

Chapter 6. Friendly fraud, prevention, and deflection.

Friendly fraud, which Visa has renamed first-party misuse, is a dispute filed by the legitimate cardholder over a transaction they actually made or authorized. Visa estimates that up to 75% of e-commerce fraud disputes actually fall into this category. Traditional anti-fraud tools don’t catch it, because the transaction is genuine and shows no risk signal at authorization. The problem shifts to post-sale.

• Failure to recognize the charge: a cryptic billing descriptor (legal name ≠ trade name), a debit posted several days late.
• Family sharing: a purchase made with the card by a child or spouse, denied in good faith (in-app purchases, gaming).
• Forgotten subscription: a free trial that converted, an unexpected annual renewal.
• Buyer’s remorse or opportunism: disputing is easier than requesting a refund, and it can be deliberate abuse (digital shoplifting).

Upstream prevention remains the most cost-effective approach. It starts with a clear billing descriptor showing the trade name the customer will recognize on their statement, plus customer service contact details. Next comes 3DS2 authentication, applied across the board or based on risk, and the pre-renewal reminders Visa and Mastercard require for trials and subscriptions. Add a smooth refund policy, which makes a chargeback less attractive than contacting customer service, and blocking of card testing (rate limiting, CAPTCHA at checkout, BIN checks).

Industry studies (LexisNexis True Cost of Fraud) converge on the same order of magnitude. Every euro of fraud costs the merchant about three euros once fees, goods, and handling are included. That multiplier justifies investing in deflection: the subscription pays for itself once it avoids a few dozen disputes a month, including internal handling costs.

Chapter 7. KPIs and running the disputes function.

A disputes team is managed like a reverse profit center, where performance is measured in losses avoided rather than revenue generated. Every point of ratio avoided and every point of win rate gained translates into euros. Four families of metrics are enough, provided you segment them by reason code, network, issuing country, product, and acquisition channel. Otherwise, the average hides the segment that is bleeding.

• Close the loop with the product team: a spike in 13.3 (“not as described”) is a product page or quality problem, not a payments problem.
• Automate evidence collection (order, delivery, 3DS, history): it accounts for 80% of the time spent on a case.
• Set a representment threshold by amount and by reason code, reviewed quarterly against the observed win rate.
• Track identified friendly fraud separately (disputes won with proof of use) to document repeat offenders and feed your RDR rules.