The Chargeback Machine Behind Every Disputed Payment

Every disputed payment looks the same from the outside: a cardholder tells their bank a charge was wrong, the money moves back, and somewhere a merchant eats the loss. But that simple story sits on top of a genuinely large piece of financial infrastructure, one with its own reason codes, evidence formats, monitoring programs, and appeals process. And because that infrastructure was built to protect cardholders, it’s also become one of the most reliable ways to take something and keep the money used to pay for it.

This is a look at how that machinery actually functions, and how the people defending it try to tell a legitimate dispute from a manufactured one.

The four parties in every card transaction

A card payment always involves four separate entities, even though the cardholder only ever sees two of them. There’s the cardholder, the merchant, the issuing bank (which issued the card and holds the cardholder’s account), and the acquiring bank or payment processor (which holds the merchant’s account and moves funds on the merchant’s behalf). Sitting above all four is the card network, Visa or Mastercard or another scheme, which sets the rules everyone else has to follow.

When a cardholder disputes a charge, they’re not talking to the merchant. They’re talking to their issuing bank, which pulls the funds back through the network before the merchant even knows a dispute exists. This is the detail that makes chargebacks structurally different from a return or a refund: the merchant is not part of the first decision. They only find out after the money has already moved, and then they have a fixed window, usually somewhere in the range of a few weeks, to contest it.

Reason codes are the whole game

Every dispute gets filed under a reason code, and the code determines what evidence can beat it. Visa and Mastercard each maintain their own lists, but they cluster into the same broad categories: fraud (the cardholder says they never authorized the charge), merchandise or service not received, item not as described, duplicate processing, and credit not processed.

This matters because the category shapes the defense. A “not received” dispute can often be beaten with tracking and delivery confirmation. A “not as described” dispute needs the merchant to show accurate listings and the buyer’s own communications. A fraud code, reason 10.4 in Visa’s numbering for example, is the hardest to fight, because the merchant is effectively being asked to prove that the cardholder is lying about their own card being used without permission. That asymmetry, where one category of dispute is nearly impossible to contest on the merits, is exactly the seam that manufactured disputes exploit. Filing a legitimate purchase as “I didn’t authorize this” converts a return into a chargeback with almost none of the merchant’s usual defenses available.

Where “friendly fraud” comes from

The industry term for this is friendly fraud: a cardholder receives the goods or service, then disputes the charge anyway, either by mislabeling a return as fraud or simply gambling that the merchant won’t fight back. It’s called friendly because there’s no stolen card involved, just someone using the dispute system as a free return policy, or worse, as a way to get paid twice.

What makes it durable as a fraud category is that it costs the disputer almost nothing to try. Filing a chargeback takes minutes through a banking app, doesn’t require any technical skill, and if it fails, the cardholder is usually no worse off than if they’d never tried. That asymmetric cost structure is why friendly fraud shows up disproportionately around digital goods, subscriptions, and anything shipped internationally where the merchant’s evidence trail is thinner.

There’s also a more organized layer above individual friendly fraud: communities and forums that trade scripts and templates for what wording gets accepted by which issuing banks, which categories of merchant rarely fight back, and how to time a dispute so it lands after a free trial converts to a paid subscription. None of that is a technical exploit. It’s closer to social engineering aimed at a bank’s dispute intake process, and it works precisely because that process is built to be fast and cardholder-friendly by design.

Representment: the merchant’s one shot back

Merchants aren’t defenseless. When a chargeback lands, they can respond with representment, essentially submitting a packet of evidence back through the acquirer to the network, arguing the charge was legitimate. A representment packet typically includes things like the IP address and device fingerprint at checkout, AVS and CVV match results, delivery confirmation, prior order history from the same account, and any communication with the buyer.

The catch is that representment is expensive relative to the transaction size. Processors often charge per dispute regardless of outcome, and building a real evidence packet takes staff time. For a $30 order, it frequently isn’t worth fighting even a chargeback the merchant is confident is fraudulent, which is exactly the calculation that makes low-value, high-volume disputes an attractive target for repeat offenders.

Why card networks care about the aggregate, not just the case

Individual disputes are a merchant’s problem. But card networks track a merchant’s overall chargeback ratio, disputes as a percentage of total transactions, because a merchant with an abnormally high ratio is either running a bad business, selling something misleading, or attracting fraud they aren’t screening for. Visa and Mastercard both run monitoring programs that flag merchants who cross defined thresholds, and repeated breaches can lead to increased fees, mandatory remediation plans, or in the worst cases the merchant losing card processing entirely.

This is the mechanism that keeps the whole system honest on the merchant side. It’s also why a wave of coordinated friendly fraud against a single merchant, say a burst of “unauthorized” disputes against a subscription business, can do damage far beyond the value of the disputed charges. Enough of them and the merchant’s ratio crosses a threshold the networks watch, and now the business itself is at risk, not just the individual transactions.

The detection layer: catching it before it becomes a dispute

Because chargebacks are so lopsided against merchants once they happen, most of the real defensive work happens before the dispute is ever filed, at the moment of checkout. This is where device fingerprinting, IP reputation, and behavioral signals come in. A checkout flow will typically cross-reference the card’s billing address against the shipping address, run AVS and CVV checks against the issuing bank, and increasingly route the transaction through 3D Secure, which shifts liability for fraud disputes back to the issuer if the cardholder authenticated the purchase in their banking app.

On top of that sits pattern detection: is this device fingerprint associated with other accounts that have filed disputes before, is the same card being used across accounts that share a shipping address, is the purchase velocity consistent with a real customer or a script running through a list of stolen numbers. None of these signals is proof on its own. A shared device fingerprint can mean a household, not fraud. A high dispute rate can mean a bad product, not bad actors. Fraud teams weigh these signals together and set thresholds that trade off false positives, turning away real customers, against false negatives, letting fraud through.

The pre-dispute layer: alerts before the chargeback lands

More recently, networks have leaned into systems that intervene before a dispute officially files. Services like Verifi’s Rapid Dispute Resolution and Ethoca’s alert network let a merchant see that a cardholder is about to dispute a charge and refund it directly, which resolves the cardholder’s complaint without it ever becoming a formal chargeback on the merchant’s ratio. It’s a reasonable compromise: the cardholder still gets their money back quickly, and the merchant avoids the fee and ratio hit of a full dispute cycle. It doesn’t stop friendly fraud, but it changes the economics of it, since a refund issued this way still shows up in the merchant’s records as a real, trackable event rather than an anonymous dispute.

The shape of the arms race

What makes chargeback fraud a genuinely interesting piece of the internet’s adversarial infrastructure is that it doesn’t require any technical sophistication at all. No proxies, no spoofed devices, no stolen credentials. Just a bank’s own dispute form and the knowledge of which reason code is hardest for a merchant to fight. The defense, correspondingly, isn’t really about blocking an attacker. It’s about building enough of an evidence trail at the moment of sale that a false claim doesn’t hold up later, and enough aggregate visibility that a merchant getting targeted repeatedly gets flagged before it costs them their ability to accept cards at all.

Want more of how the internet’s payment, identity, and detection systems actually work under the hood? Head back to the Hidden Internet home page for the rest of the series.

Get new guides and videos first — join the Telegram channel.