How to prevent chargeback fraud: causes and strategies

On 1 April 2026 Visa cut the line at which the Visa Acquirer Monitoring Program (VAMP) flags an excessive merchant from 220 to 150 basis points in Asia Pacific, Canada, the EU and the US. The ratio adds fraud reports to disputes. It leaves out any dispute resolved before it is filed, so under the lower line a question answered at the issuer inquiry counts for more.

Chargeback fraud is a cardholder disputing a purchase they made, so the bank reverses a real payment. Merchants and payment providers can block it at six stages of a payment, the card end of fraud detection and prevention.

How do you prevent chargeback fraud at each stage of a payment?

Put one control at each of six stages and tie it to the card rule that rewards it. Table 1 follows the Visa Rules edition of 24 October 2026.

Table 1. Chargeback fraud controls by stage and the card rule behind each (October 2026)

Most best practices for merchants sit in rows 2, 3 and 5. Rows 4 and 6 are the easiest to miss. At the inquiry, order details shared through Order Insight can close the question before a dispute exists, and Rapid Dispute Resolution (RDR), an automated option, settles eligible cases by rules set with the acquirer (Visa Dispute Management Guide for Merchants, October 2026, pp. 81 and 99). After a fraud dispute, the Visa Rules require the acquirer to make sure its merchant tries to revoke the goods or service and has a process that stops the same cardholder doing it again (section 10.4.4.3).

What causes chargeback fraud, and which control answers each cause?

The common causes are gaps a merchant can close, and Visa names the first: "Customer confusion is one of the most common triggers for friendly fraud." (Visa, friendly fraud). Each cause has a chargeback avoidance technique:

1. Clear communication with customers. A billing descriptor the customer recognizes, renewal and delivery notices, and refund and cancellation terms that are easy to find.
2. Accurate and thorough documentation. In Visa's example a customer canceled a movie subscription on 22 April 2026 and was told it would work until 30 April, so 30 April is the valid cancellation date; the file must show the request date, the effective date and the usage (guide, p. 60).
3. Enhanced payment verification and security. CVV2, AVS and 3D Secure, the basic anti fraud checks, tie a card absent payment to the cardholder, and full authentication closes the fraud dispute route (Table 1, row 2). A claim that the goods never came still needs delivery records.
4. Proactive response to chargeback requests. Answer the issuer's inquiry first. After accepting an RDR request, "you should not issue a separate refund" unless the acquirer advises it (p. 99).
5. Monitoring chargeback and refund rates. Track disputes by condition code, as a percentage of sales, by outcome and by channel (p. 98); the lines that matter are in the next section.
6. Continuous review of payment processes, with staff training. Visa advises training service and dispute teams on CE3.0 and revoking access quickly after a confirmed chargeback.
7. AML procedures. These sit with the payment provider and the acquirer, covered below.

Which chargeback ratio puts a merchant in a card network program?

Two card brand initiatives set the lines: Visa's VAMP and Mastercard's Excessive Chargeback Program (ECP). The cost reality: merchants in Visa Acceptance Solutions' 2026 Global eCommerce Payments & Fraud Report put the average cost of resolving one first party misuse dispute at $82 (p. 33), before any program fine.

Table 2. Visa VAMP and Mastercard ECP (as of October 2026)

What is the Visa VAMP threshold in 2026?

Since 1 June 2025 the VAMP ratio has divided fraud reports (TC40) plus disputes (TC15) by settled transactions (TC05), on card not present payments. Two items stay out of it: disputes resolved through pre dispute solutions, and fraud reports that qualified for Compelling Evidence 3.0. VAMP merged five older fraud and dispute programs (Visa, 30 August 2024).

Picture a merchant (illustrative numbers) that settles 120,000 card not present sales in a month and receives 1,800 fraud reports and disputes. That is exactly 150 basis points, which meets the line, and the count passes 1,500. Had 400 of those disputes been resolved through Order Insight before filing, the ratio would be 1,400 over 120,000, about 1.17 percent, with the count under 1,500.

How does Mastercard's Excessive Chargeback Program work?

Mastercard divides a month's chargebacks by the previous month's sales and flags a merchant ID only when both the count and the ratio are met (Mastercard's program guide, J.P. Morgan copy). Since April 2020 it no longer flags merchants at 100 chargebacks and 1.0 percent (Braintree's summary of the program). Fines start at USD or EUR 1,000 in the second month and reach 100,000 a month for an excessive merchant (ECM) and 200,000 for a high excessive one (HECM) from month 19, plus, from month 4, an issuer recovery assessment of 5 per chargeback over 300. Three consecutive months below the ECM thresholds end it.

Prevention lowers both: a dispute stopped before filing leaves the Visa ratio, and a chargeback avoided this month shrinks next month's Mastercard count.

How do Compelling Evidence 3.0 and First-Party Trust answer a false fraud claim?

In Visa's guide, an online order picked up in store has no cardholder delivery address, and "A merchant location is not treated as a delivery address for CE3.0 evaluation." (guide, p. 82). The match then has to come from the device ID, fingerprint or IP address plus another element such as the login ID.

Compelling Evidence 3.0 (CE3.0) answers only card absent fraud disputes. Under the Visa Rules (pp. 706 to 712), a dispute is invalid when the card was used in two earlier transactions the issuer did not report as fraud, more than 120 days before the dispute and within 365 days, with a description of the goods and a match on the device ID, fingerprint or IP address plus one more element such as the login ID or delivery address. It "does not guarantee" an outcome (guide, p. 77).

Mastercard's First-Party Trust works on the same idea, and adds insights at authorization, powered by Mastercard fraud models, that help issuers separate third party fraud from first party fraud. Its release of 22 October 2026 describes two paths for the merchant's evidence, inside the transaction at authorization or later in the dispute, covering the purchase, the delivery and the authentication, with chargeback protection for disputes that meet its requirements.

Which records should you keep, and for how long?

Keep each order's records for 365 days: an issuer has 120 days to file (Visa Rules, p. 712), and CE3.0 looks back 365. Keep the device ID or fingerprint, IP address, login ID, delivery address, goods description, delivery proof and, for subscriptions, cancellation dates and usage.

complead, formerly Sanction Scanner, builds that file at the decision: its payment fraud product keeps the device's continuity across this and earlier orders, the session, the decision and its signals, and exports them as an evidence pack for the dispute.

What the card networks changed in October 2026

• 22 October 2026. Mastercard took First-Party Trust, live in the US, Canada, Latin America, the Caribbean and Asia Pacific, to Eastern Europe, the Middle East and Africa, with Europe from July 2027.
• 24 October 2026. Visa's new rules edition lets CE3.0's two earlier transactions be "used at one or more Merchants", treats device ID and fingerprint as "considered similar data elements" and voids disputes on a payment credential with "more than 35 Disputes" in 120 days.
• Next, 24 April 2027. Voiding a domestic fraud dispute after an AVS result code U extends to Australia, New Zealand, Singapore, Visa's Europe region and seven Latin American markets (p. 711).

When real customers become friendly fraudsters: how do you stop friendly fraud and first party fraud?

Visa's definition of friendly fraud, also known as first party misuse, is a cardholder disputing a legitimate purchase they or someone in their household made; Visa notes it is sometimes accidental. By intent, the spectrum runs from a forgotten renewal or a child's purchase on a saved credit card to a customer who claims a parcel never came and keeps it. The accidental end is a communication problem and the deliberate end an evidence problem; dealing with either starts with telling it apart from third party fraud.

What signals help tell friendly fraud from real fraud?

The test is the match. A disputed order that shares the device, IP address and login with earlier undisputed orders reads as friendly fraud; a device and IP address new to the account point toward a stolen card or a taken over account. Visa's guide names two indicators that weaken those detection signals: a guest checkout or first purchase, which gives CE3.0 little history to work with (guide, p. 81), and an email address, which counts as a login only if it authenticated the cardholder (p. 82).

Visa's 2026 merchant survey rates five methods most effective: monitoring transaction data, analyzing non fraud chargebacks and declines, requiring CVV codes, checking order histories and working with providers (p. 35).

How big is first party fraud in 2026?

In Visa Acceptance Solutions' 2026 report (1,278 merchant professionals, surveyed in November and December 2025), 64 percent saw first party misuse rise, yet they put its share of fraudulent disputes at 17 percent, down from 20 (p. 33): the post purchase side of ecommerce fraud.

LexisNexis Risk Solutions, counting fraud detected across its Digital Identity Network, found first party fraud "almost two in five (38.3%)" of reports in 2025 (26 March 2026), up from 36 percent in 2024 and 15 percent in 2023 (13 May 2025). Its definition also takes in false details on a loan application, the banking side of the term.

Mastercard's 2025 State of Chargebacks report put the global cost of chargebacks to merchants at "$42 billion by 2028, with nearly half being reported as fraudulent" (Mastercard, 25 June 2025).

What do PSPs and acquirers add to chargeback prevention?

A payment service provider or acquirer is a regulated institution with AML and KYC duties, and it carries every merchant's ratio. Its internal controls sit around the merchant:

1. Portfolio lines. VAMP flags an acquirer's portfolio as above standard at 50 basis points and excessive at 70, and Visa may evaluate a payment facilitator at the level of each sponsored merchant (10.4.3.1, p. 638).
2. Daily spend limits. Each card absent merchant sets a daily limit, at most 25 transactions, after which it confirms that the cardholder approves more spend (10.4.4.2, p. 639).
3. Screening before signing. In Europe, CEMEA and listed Asia Pacific markets, the acquirer checks the Visa Merchant Screening Service before signing a merchant (10.17.1.1, p. 669).
4. Listing at termination. A merchant terminated for excessive disputes, a VAMP identification or depositing another merchant's sales goes on the Terminated Merchant File by close of business on the day after it is told of the termination (10.10.1.1, pp. 650 to 651); the last is transaction laundering.
5. Reporting. The duty to report sits on regulated institutions: a money services business reports a suspicious transaction that involves or aggregates at least $2,000 under 31 CFR 1022.320, and banks file suspicious activity reports under their own rules. Neither rule reaches a merchant that only takes card payments.

complead's merchant monitoring checks each merchant's chargeback rates, volume changes, MCC mismatches and settlement patterns daily and as transactions arrive; the team holds settlement, opens a case or schedules a review from the alert, and each action is recorded with the user, the time and a reason code.

What is the regulatory position on refund fraud and false disputes?

The dispute right comes from consumer law: the law table in the chargeback fraud entry shows who enforces it in the US and the UK, and lists the fraud offenses a false claim can fall under. The refund fraud as a service underground is the organized end. University of Portsmouth research funded by Cifas, published 21 May 2026, put the cost to UK online retailers at up to £5.76 billion a year, from nearly 500,000 posts on cybercrime forums, Telegram and Discord, with some vendors taking up to 30 percent of the refund.

On 30 April 2026 the US Attorney's Office for the Northern District of Alabama announced prison sentences for members of the Telegram channel "Noir's Luxury Refunds", which had over 5,900 followers and ran from July 2020 to July 2022 by manipulating customer service staff, altering shipping labels, recruiting insiders and using malware against retailers' fraud prevention. Sentences reached 21 months. The release places the case in Operation Chargeback, which it calls "an FBI investigation into organized refund fraud groups". It is refund fraud, not card disputes.

Every control above assumes the cardholder goes to the bank. Refund abuse skips it: the box arrives empty, the return is a substitute or never ships, and the merchant refunds without a dispute.

Before the next monthly ratio lands, three checks:

1. Divide last month's card not present fraud reports and disputes by settled sales and set the result against 150 basis points and a count of 1,500.
2. Confirm that every order stores the device ID or fingerprint, IP address, login ID and delivery address, and that the store holds 365 days.
3. Ask the acquirer whether Order Insight and RDR are switched on for your merchant ID.

How this page was checked. Barbaros Sercan read the Visa Core Rules and Visa Product and Service Rules (edition of 24 October 2026), Visa's VAMP overview, the Visa Dispute Management Guide for Merchants (October 2026), the 2026 Global eCommerce Payments & Fraud Report and Mastercard's Excessive Chargeback Program terms as Braintree and J.P. Morgan publish them, on 30 October 2026. Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, fact checked it. Last reviewed: the publish date.