Chargeback Management and Dispute Guide

A chargeback reverses a card payment after the sale, takes the money and the goods, adds a fee, and counts against a merchant's standing with the card networks, so a business with poor dispute handling can lose its ability to take cards at all. Chargebacks come from genuine fraud on stolen cards, from merchant errors, from real customer complaints and from customers who disputed a purchase they made themselves. Each needs a different response. This guide covers the full dispute lifecycle on the Visa and Mastercard networks, how reason codes group disputes, what counts as compelling evidence (including Visa Compelling Evidence 3.0), how to decide which disputes to fight, pre-dispute alerts and resolution tools, and the monitoring ratios that decide whether a merchant ends up in a network programme. It is for payments, fraud, customer service and finance teams in ecommerce and subscription businesses. The motives behind friendly fraud are covered in the First-Party Fraud Guide; this page is about running disputes. Networks are listed alphabetically.

Key takeaways

Know the reason code before you respond. The code defines what evidence can win. Fraud, authorisation, processing error and consumer dispute categories each need different proof.
Prevention beats representment. Clear descriptors, refund policies shown at checkout, fast refunds and shipping before charging stop most disputes that merchants would otherwise lose anyway.
Compelling Evidence 3.0 changes the economics of card-absent fraud disputes on Visa. Matching data from two earlier undisputed transactions can defeat a reason code 10.4 dispute and keep it out of the monitoring ratio.
The ratio is what threatens the business. Visa's Acquirer Monitoring Program counts fraud reports and disputes against card-not-present sales; from 1 April 2026 the merchant "Excessive" threshold in the US, Canada, Europe and Asia Pacific is 150 basis points.
Measure win rate by reason code, not overall. A high overall win rate can hide a growing category the business never fights.

How the dispute lifecycle works

Visa defines a dispute as a reversal of the value, or part of the value, of a transaction by the card issuer to the acquirer, which usually passes it on to the merchant. The merchant never deals with the cardholder's bank directly: everything flows through the acquirer or payment processor, and each stage has strict deadlines that the acquirer can confirm.

Stage	Visa term	Mastercard term	What happens
Before a dispute	Pre-dispute tools (Verifi Order Insight, Rapid Dispute Resolution)	Pre-dispute alerts and data sharing	Issuer or cardholder query is answered with order details, or a refund is issued, before a formal dispute is raised
Dispute raised	Dispute	Issuer chargeback	Issuer reverses funds under a reason code; acquirer debits the merchant and asks for a response
Merchant response	Dispute response	Acquirer second presentment	Merchant submits evidence through the acquirer, or accepts the loss
Escalation	Pre-arbitration	Pre-arbitration case	Issuer challenges the response with new information; merchant can accept or respond
Final ruling	Arbitration	Arbitration case	Network decides; losing party pays the network fee

The cardholder's right to dispute usually starts from consumer protection law as well as network rules. In the US, Regulation Z (12 CFR 1026.13) gives credit card holders 60 days from the first statement showing a billing error to notify the creditor in writing, requires acknowledgement within 30 days, and requires resolution within two complete billing cycles and no more than 90 days. Billing errors include unauthorised charges and goods or services not delivered or accepted as agreed.

Reason codes and what each needs

Both networks group reason codes into four broad families. Visa's merchant dispute management guidelines (October 2026 edition, based on the Visa Rules) use numbered categories; Mastercard's Chargeback Guide Merchant Edition uses four-digit message reason codes.

Family	Visa examples	Mastercard examples	Typical winning evidence
Fraud	10.4 Other Fraud: Card-Absent Environment; 10.1 and 10.2 EMV liability shift; 10.5 Visa Monitoring Programs	4837 No Cardholder Authorization; 4870 and 4871 Chip Liability Shift	Proof the cardholder made or benefited from the purchase: matching device, IP, login and address history; authentication records
Authorisation	Category 11 (11.1 to 11.3)	4808 Authorization-related Chargeback	Valid authorisation obtained for the amount and date
Processing error	Category 12, including 12.6 Duplicate Processing or Paid by Other Means	4834 Point-of-Interaction Error	Proof transactions are distinct, amounts correct, presented on time
Consumer dispute	13.1 Merchandise/Services Not Received; 13.2 Cancelled Recurring Transaction; 13.3 Not as Described or Defective; 13.6 Credit Not Processed; 13.7 Cancelled Merchandise or Services	4853 Cardholder Dispute	Delivery proof, disclosed terms, cancellation and refund records

13.1 not received: Visa's guidelines point to proof of delivery to an address matching the invoice with courier status (a signature or delivery photo strengthens it), service logs, and for digital goods such as crypto-assets, the destination wallet address and a public blockchain transaction hash. The cardholder is not required to accept an alternative date or replacement.
13.3 not as described: screenshots of the product description, images and terms shown before purchase, and records of any remedy offered. Visa notes that a statement that "the item is as described" is not sufficient on its own, and internal notes do not replace customer-facing disclosures.
13.6 credit not processed: proof the refund was issued with date, amount and method, or evidence that no credit was due under the disclosed policy.
13.2 cancelled recurring: proof the cancellation request did not happen, or happened after the charge, plus the subscription terms the customer accepted.

Compelling evidence and Compelling Evidence 3.0

Visa's guidance is that evidence should clearly link the transaction to the cardholder, show that they took part or benefited, or confirm the transaction was fulfilled and billed as agreed, and that relevant and concise evidence beats volume. A short rebuttal letter that addresses the reason code directly, with labelled exhibits, outperforms a large unstructured bundle.

Compelling Evidence 3.0 (CE3.0) is a specific Visa mechanism for reason code 10.4, where a cardholder claims they did not make a card-absent purchase. According to Visa's dispute management guidelines:

History required: the disputed transaction plus at least two earlier undisputed transactions on the same card.
Timing: the earlier transactions must have been processed within the 365 days before the disputed transaction, generally more than 120 calendar days before it, and must not have been reported as fraud by the issuer before the disputed transaction was processed.
Matching identifiers: the transactions must be linked through qualifying data elements such as device ID or fingerprint, IP address, customer login ID, delivery address, email address and phone number. Confirm the exact number and combination of matches required with your acquirer, because the rule text sets it precisely.
Ratio benefit: Visa's VAMP fact sheet states that fraud reports (TC40) qualifying for CE3.0 are excluded from the VAMP ratio.

CE3.0 only works if the data was captured and stored at the time of each order. Log device ID, IP address, account login and delivery address for every order, keep them for at least the full lookback window, and make them retrievable by card. This is the single most valuable data engineering task in a dispute programme for a business with returning customers.

Pre-dispute tools and alerts

Pre-dispute tools let a merchant answer or refund a complaint before it becomes a formal dispute, which avoids the fee and, in many cases, keeps it out of monitoring counts.

Tool type	What it does	Best use	Trade-off
Order data sharing (Visa Order Insight)	Gives the issuer order details (items, delivery, account history) when a cardholder queries a charge, so the query can be resolved without a dispute	Unrecognised charges and "I don't remember this" calls	Needs clean order data feeds
Automated rules-based refunds (Visa Rapid Dispute Resolution)	Merchant-defined rules decide automatically whether to refund a pending dispute before it is raised	Low-value disputes the merchant would not fight	Refunding still loses the sale; rules must be reviewed
Fraud and dispute alerts (for example Mastercard's Ethoca)	Issuer notifies the merchant of a confirmed fraud or dispute so it can refund and stop fulfilment	Physical goods not yet shipped, subscriptions to cancel	Alert coverage depends on issuer participation; a per-alert fee applies
Descriptor and receipt clarity	Recognisable merchant name and contact on statements and receipts	Every merchant	None; cheapest control available

Visa's dispute management guidelines list Verifi Order Insight and Rapid Dispute Resolution as early resolution tools. The VAMP fact sheet states that disputes resolved through pre-dispute solutions are excluded from the ratio, subject to data extract timing. Check with the acquirer which tools are enabled and how resolved cases are reported.

Chargeback ratios and network monitoring

Visa consolidated its Acquirer Monitoring Program with the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program into a single global Visa Acquirer Monitoring Program (VAMP), with updated thresholds effective 1 June 2025 and an advisory period that ended on 30 September 2025, according to Visa's 2025 fact sheet.

Item	VAMP rule (Visa fact sheet, 2025)
Ratio	Fraud reports (TC40) plus disputes (TC15), divided by settled transactions (TC05), for card-not-present transactions
Merchant Excessive: US, Canada, Europe, Asia Pacific	220 basis points or more, reduced to 150 basis points or more from 1 April 2026, with at least 1,500 fraud and dispute counts in the month
Merchant Excessive: Latin America and Caribbean	150 basis points or more, with at least 1,500 counts
Merchant Excessive: CEMEA	220 basis points or more, with at least 150 counts and at least USD 75,000
Acquirer levels	Above Standard at 50 basis points, Excessive at 70 basis points
Exclusions	TC40 fraud qualifying for CE3.0; disputes resolved through pre-dispute solutions
Enumeration	Separate thresholds for card testing style enumerated authorisations (2,000 basis points or 300,000 transactions)

Two points matter for strategy. First, the VAMP ratio counts fraud reports as well as disputes, so stolen card fraud the merchant refunded can still count. Second, acquirer thresholds are much lower than merchant ones, so an acquirer may impose its own limits, reserves or pricing on a merchant well before the merchant reaches a network threshold. Mastercard runs its own monitoring programmes; confirm the current thresholds with the acquirer. Card testing feeds both the enumeration measure and later fraud reports: see the Payment Fraud Guide.

Deciding which disputes to fight

Not every dispute is worth representing. A simple decision rule saves analyst time and improves win rates.

Fight: 10.4 card-absent fraud where CE3.0 data exists; not-received claims with carrier proof of delivery; recurring cancellation claims where the cancellation was never made; duplicate claims where the charges were distinct.
Accept or refund early: genuine stolen card fraud (the cardholder is right); disputes where the merchant cannot show the policy was disclosed; amounts below the cost of preparing a response.
Escalate with care: pre-arbitration and arbitration carry network fees that the losing side pays. Only escalate when the evidence directly answers the issuer's new information.
Treat the customer: a customer who disputed a valid charge may be confused rather than dishonest. Contact them, and block or flag repeat disputers. See the Refund and Returns Fraud Guide for related abuse.

Small versus large merchants: a small merchant can run disputes from the processor dashboard with templates per reason code, a clear descriptor and an alert service if dispute volume justifies the fee. A large merchant automates evidence assembly from order, delivery and account systems, uses rules-based pre-dispute refunds for low values, and reports dispute rates by product, channel and acquirer weekly.

How to implement

Baseline: export 12 months of disputes with reason code, amount, outcome and product. Calculate dispute and fraud ratios against card-not-present sales by month and by acquirer.
Fix the cheap causes first: statement descriptor, refund and cancellation terms shown at checkout and on receipts, shipping before charging, prompt submission of transactions (Visa suggests within one to five days), and notification of delivery delays.
Capture evidence data: store device ID, IP address, login ID, email, phone and delivery address with every order for at least 13 months, and delivery confirmation from carriers.
Build reason code playbooks: one template and evidence checklist per common code, reviewed by someone who reads the network rules.
Enable pre-dispute tools: order data sharing and alerts first, then rules-based refunds for low values. Pilot rules on one product line and compare refunds against dispute outcomes for a month before widening.
Set alerting on ratios: warn internally at half the network threshold so there is time to act, and agree an escalation path with the acquirer.
Feed fraud controls: send confirmed fraud disputes back to checkout fraud rules so the same pattern is declined next time.
Review and roll back: if automated refund rules raise refund cost without lowering disputes, narrow or switch them off; keep rule versions documented.

Detection and measurement

VAMP ratio and dispute ratio: by month, acquirer and region, against both network and acquirer thresholds.
Win rate by reason code: share of represented disputes won, per code.
Representment rate: share of eligible disputes the business actually responded to before the deadline.
Pre-dispute deflection rate: queries or alerts resolved before a formal dispute.
Net dispute cost: lost revenue, goods, fees and staff time, minus amounts recovered.
CE3.0 eligibility rate: share of 10.4 disputes where qualifying history and data existed.

See the Fraud Metrics and KPIs Guide for metric definitions.

Where identity fits

Most CE3.0 matching data is identity data: a customer login ID, a known device and a stable delivery address tie a purchase to a returning customer. Strong customer accounts, with passkeys or other phishing-resistant sign-in and authentication on risky payments, make it far harder for a cardholder to claim they did not make a purchase, and far harder for an attacker who stole an account to use it. EMV 3-D Secure, the EMVCo specification for authenticating cardholders in card-not-present payments, sends the issuer transaction, payment method and device data, then approves low-risk payments without friction and challenges higher-risk ones with a one-time passcode or biometric. Under network rules, fraud disputes on properly authenticated transactions are generally the issuer's liability rather than the merchant's; confirm the exact conditions with the acquirer. Account takeover also generates fraud disputes when stolen accounts are used with saved cards. See the Account Takeover Prevention Guide.

Common failure patterns

Missed deadlines: disputes expire unanswered because notifications go to an unmonitored inbox or processor portal.
Generic responses: the same evidence pack is sent for every code, so a not-received dispute gets a fraud rebuttal and loses.
No stored order data: device, IP and login data was never kept, so CE3.0 cannot be used even for loyal repeat customers.
Unrecognisable descriptor: the statement shows a legal entity or processor name the customer does not recognise, producing "unrecognised" fraud claims.
Cancellation friction: subscriptions that are hard to cancel generate 13.2 disputes and regulatory attention. Make cancellation as easy as sign-up.
Watching only disputes: fraud reports count in the VAMP ratio even when no dispute follows, so a merchant tracking only chargebacks underestimates its position.

Practitioner checklist

Calculate the current VAMP ratio and compare it with the 150 basis point merchant threshold that applies from 1 April 2026 in the main regions.
Confirm with the acquirer every dispute deadline and who receives notifications.
Fix the statement descriptor and show refund and cancellation terms at checkout and on receipts.
Store device ID, IP, login, email, phone and delivery address per order for the CE3.0 lookback.
Write evidence templates for the five most common reason codes.
Enable order data sharing and alerts, then pilot rules-based pre-dispute refunds.
Set internal alerts at half of the network and acquirer thresholds.
Report win rate and dispute cost by reason code monthly.
Feed confirmed fraud disputes back into checkout fraud rules.

Chargeback Management and Dispute Guide: Win Disputes and Cut Chargeback Ratios