⚖️ Chargebacks and disputes around the world

A network rule, not a universal right

A chargeback is an issuer’s right to reverse a card transaction against the acquirer and recover its amount. It is a network rule, grounded in the contract that binds both institutions to the scheme, and it gives the cardholder no legal claim. Visa codifies it in the Visa Core Rules and Visa Product and Service Rules, Mastercard in its Chargeback Guide. The merchant is party to neither document, yet it bears their full effect, which its acquirer passes on by contract.

Each jurisdiction layers its own law on top of this contractual base. In the US, two separate regimes protect the cardholder, depending on whether the purchase was paid by debit or by credit. In the European Economic Area (EEA), PSD2 requires a prompt refund and sets the burden of proof. Elsewhere, the network rulebook is often the only enforceable reference. A merchant that accepts payments in several markets is therefore subject to two layers of rules, and the stricter one governs how each dispute is handled.

The same dispute reason does not carry the same time limit, burden of proof, or arbiter from one card-issuing country to another. The applicable regime therefore follows the issuer, and the merchant’s home country plays only a secondary role. A store based in Singapore that sells to European cardholders faces 13-month time limits that no Singapore rule imposes on it.

The two engines: Visa Claims Resolution and Mastercom

Visa Claims Resolution (VCR) is Visa’s dispute-handling framework, which took effect in April 2018. It consolidated 22 legacy reason codes into four numbered categories and made Visa Resolve Online (VROL) the single channel between issuer, acquirer, and merchant. Since that overhaul, disputes follow one of two paths. Allocation handles categories 10 (fraud) and 11 (authorization), which Visa decides on the basis of data already in its network, with no prior exchange of documents between the parties. Collaboration handles categories 12 (processing errors) and 13 (consumer disputes), where evidence passes between the issuer, the acquirer, and the merchant.

Mastercard carried out the same consolidation in stages between 2018 and 2020, under the name Mastercard Dispute Resolution Initiative. Its platform for exchanges between institutions is called Mastercom. The number of reason codes was cut in favor of four broad families, each divided into sub-reasons. Pre-arbitration is a mandatory step that the parties must complete before any arbitration. One rule of the initiative bars the acquirer, when responding to a 4837 reason code, from introducing data absent from the original authorization message.

• The network deadline is not the PSP deadline: an acquirer with 30 days to respond to Visa commonly gives its merchants 7 to 14, to leave time for review.
• No response means forfeiting the case: the dispute closes in the issuer’s favor, with no further recourse.
• Arbitration fees do not depend on the amount: taking a low-value dispute all the way to arbitration often costs more than the loss it avoids.
• The authorization code must match: at both networks, any discrepancy between the authorization message and the clearing presentment is enough to defeat a representment.

Reason codes and time limits: the mapping table

The reason code is the identifier the issuer uses to classify the grievance behind a dispute, and it determines both the applicable time limit and the evidence required. Each network maintains its own code set, so an international merchant receives the same grievances under different codes. Mapping the taxonomies is a prerequisite for any performance measurement: a representment win rate can only be split between fraud and non-delivery once the codes are grouped into common families. The table below maps these families across the two global networks.

Beyond Visa and Mastercard, every network keeps its own procedure. American Express Company has run a three-party model since 1958, in which issuer and acquirer are the same entity, so disputes are settled internally, with no arbitration between two banks. Three other networks each publish their own reason codes. JCB Co., Ltd. has operated in Japan since 1961, UnionPay (中国银联) in China since 2002, and Discover Network in the US since 1985. Discover came under the control of Capital One Financial Corporation on May 18, 2025.

Domestic schemes add another layer, often invisible from an international PSP’s dashboard. Elo has been operated in Brazil by Elo Serviços S.A. since 2011, RuPay by NPCI in India since 2012, and TROY by BKM in Turkey since its launch in 2016. Then come BC Card in South Korea since 1982, Bancontact in Belgium since 1979, girocard in Germany since 1990, Dankort in Denmark since 1983, and Mir in Russia since 2015. Their dispute rules sit in local rulebooks, separate from those of the global networks, and part of the dispute risk only becomes visible by reading them.

• Measure win rates by reason code, not in aggregate: an overall rate of 30% can hide 60% on non-delivery and 5% on unauthenticated fraud.
• Normalize codes into an internal taxonomy: without a mapping table, comparisons across networks and countries are meaningless.
• Check when the clock started before treating a dispute as time-barred: the expected delivery date takes precedence over the purchase date.
• Handle domestic schemes separately: their time limits and evidence requirements differ, and their volume is concentrated in a few markets.

US: Regulation E and Regulation Z

US federal law splits disputes between two separate regimes, depending on the payment method used. Regulation E (12 CFR Part 1005) implements the Electronic Fund Transfer Act and covers debit cards, prepaid cards, and consumer electronic fund transfers. Regulation Z (12 CFR Part 1026) implements the Truth in Lending Act and the Fair Credit Billing Act. It covers credit, including credit cards. The same purchase from the same merchant therefore carries a different liability cap for the cardholder, and a different investigation deadline for the institution, depending on whether the card is debit or credit.

One whole category falls outside both regimes: scams in which the account holder authorizes the payment. In December 2024, the CFPB sued Early Warning Services, LLC, which has operated Zelle since 2017, along with Bank of America, JPMorgan Chase, and Wells Fargo. The case was dismissed with prejudice on March 5, 2025. No federal rule currently requires reimbursement of authorized-payment scams in the US. The UK and Singapore took the opposite approach: the UK with mandatory, capped reimbursement, Singapore with compensation when the financial institution or the telecom operator falls short.

Europe: PSD2 and what replaces it

Directive (EU) 2015/2366, known as PSD2, governs disputes over payment transactions across the European Economic Area. It deals with the relationship between the payer and its payment service provider, whatever the rail, and never uses the concept of a chargeback. Its sequence is the reverse of the one network rules follow: the provider refunds first, then investigates.

• Article 71. The user must report the transaction without undue delay, and no later than 13 months after the debit date. After that, the claim is inadmissible.
• Article 72. The burden of proof lies with the provider. A record of the instrument’s use is not enough to prove that the transaction was authorized.
• Article 73. The provider refunds immediately, and no later than the end of the following business day after noting or being notified of the transaction, restoring the account to its prior state.
• Article 74. The payer may bear up to €50 of losses from a lost, stolen, or misappropriated instrument. The payer bears nothing if they acted without fraud or gross negligence.
• Article 76. An authorized direct debit in euros carries an unconditional right to a refund for 8 weeks after the debit.
• Article 77. The provider has 10 business days to refund the direct debit or justify its refusal.

Strong customer authentication shifts the financial burden of fraud from one party to another. When the payer’s provider does not require it, the payer bears no financial consequences unless they acted fraudulently. When the payee or its provider does not support it, that party must compensate the payer’s provider. A European merchant that skips 3DS to protect its conversion rate therefore keeps the cost of the fraudulent transactions it accepts.

The Instant Payments Regulation, Regulation (EU) 2024/886, added another piece. It requires verification of payee before a euro credit transfer is executed. The provider compares the name given by the payer with the name linked to the IBAN and flags any mismatch before the order goes out. If it fails to run this check, it is liable for misdirected funds. Receiving instant payments has been mandatory in the euro area since January 9, 2025, and sending them since October 9, 2025.

The package made up of PSD3 and the Payment Services Regulation builds on this framework. A provisional political agreement was reached in November 2025. The Council of the European Union circulated the final compromise texts in April 2026, with formal adoption expected within the year. Two additions bear directly on dispute handling. Victims gain a right to a refund when fraudsters impersonate their payment service provider, provided they file a police report and notify the provider without delay. A liability regime also attaches to name-IBAN verification. The compromise texts provide for transposition and application 21 months after entry into force, and 27 months for name-IBAN verification.

India, Brazil, UK, Singapore: recourse without cards

Markets where instant transfers have overtaken cards have built their own recourse channels without copying the chargeback. Three models stand out. The first grants automatic compensation when a transaction fails for technical reasons. The second sets up a fund recall process overseen by the central bank. The third requires reimbursement for victims of authorized-payment scams.

Pix, operated by the Banco Central do Brasil since 2020 through the SPI infrastructure, has the most developed mechanism. The Mecanismo Especial de Devolução gives fraud victims 80 days to report the facts to their institution. The payer’s and payee’s institutions then investigate the case together. The refund is made within 96 hours of the fraud being confirmed, up to the funds still in the receiving account. The mechanism is therefore a fund recall process overseen by the central bank, and the merchant bears no liability under it.

Instant payment rails have no chargeback

An instant transfer is irrevocable by design: settlement becomes final within seconds, in central bank money or on a dedicated settlement account. There is therefore no unilateral reversal right equivalent to the card chargeback. All that remains is the recall request. The sending bank submits it to the receiving bank, which is free to refuse if its customer does not consent or if the funds have already left the account.

Interac e-Transfer, operated by Interac Corp. in Canada since 2002, is a special case. The service feels almost instant, yet settlement runs through a deferred clearing system. Finality therefore comes later than the interface suggests. For a disputes team, this gap between perceived speed and actual settlement changes the practical recall window, and no customer screen reveals it.

Monitoring thresholds: VAMP and ECM

A monitoring program is how a network tracks the frequency of fraud and disputes at its acquirers and their merchants. It penalizes those that exceed the published thresholds. Visa merged three such programs into a single global framework, the Visa Acquirer Monitoring Program, which absorbs the former VAMP, the Visa Fraud Monitoring Program, and the Visa Dispute Monitoring Program. Its thresholds have applied since June 1, 2025. The advisory period ended on September 30, 2025.

The program uses a single ratio, calculated by transaction count, not value. The numerator combines reported fraud and disputes, on VisaNet card-not-present transactions only, both domestic and cross-border. Two exclusions make a real difference for an active merchant. Disputes resolved through a pre-dispute solution drop out of the numerator, as does reported fraud that meets the Compelling Evidence 3.0 criteria. A merchant that invests in deflection and data logging therefore sees its ratio fall even when the number of disputes stays the same.

VAMP ratio = [ Fraud (TC40) + Disputes (TC15) ] / Settled transactions (TC05)

scope        : VisaNet card-not-present transactions, domestic and cross-border
unit         : basis points (bps), counted by number of transactions
exclusions   : disputes resolved through a pre-dispute solution
               TC40 fraud eligible for Compelling Evidence 3.0
denominator  : in effect since June 1, 2025

Mastercard uses a different design. Its Excessive Chargeback Merchant program flags a merchant that reaches, in a single month, at least 100 chargebacks and 150 basis points. The higher tier, High Excessive Chargeback Merchant, is triggered at 300 chargebacks and 300 basis points. The ratio is lagged: chargebacks in the current month are divided by the previous month’s transactions. Strong volume growth therefore lowers the ratio, while a decline raises it, without a single additional dispute.

Geographic coverage of these thresholds is still incomplete. Visa says the programs for Brazil, Chile, and India will be announced separately. These three markets are among the fastest-growing, and merchants should have their acquirer confirm the local rules that apply there before any flows go live.

Running disputes across multiple rails

A dispute operation designed for one market does not carry over as is. Time limits, evidence requirements, and the competent arbiter change from country to country. Three principles hold across all markets. The first is to stop disputes before they arise, through deflection and a clear billing descriptor. The second is to build the evidence before a case is opened. The third is to measure performance by reason code and by country, not in aggregate.

• Dispute ratio by network and by region, expressed in the unit of the applicable program: bps of settled transactions at Visa, bps of the previous month’s transactions at Mastercard.
• Representment win rate by reason code, not overall: it is the only metric that points to the process that needs fixing.
• Fully loaded cost per dispute: amount, chargeback fee, representment fee, any arbitration fee, agent time, lost merchandise.
• Share of disputes avoided at the pre-dispute stage, tracked separately. These drop out of the VAMP numerator, so they count twice.
• The actual response window set by the PSP, contract by contract: this, not the network deadline, is what drives the team’s organization.