Merchant liability for credit card chargebacks is the default outcome of almost every disputed transaction: when a cardholder challenges a charge, the acquiring bank pulls the money out of the merchant’s account immediately, and the business has to prove the transaction was legitimate to get it back. Federal law caps the cardholder’s exposure at $50, and most issuers waive even that.1Office of the Law Revision Counsel. United States Code Title 15 Section 1643 – Liability of Holder of Credit Card Whether the merchant can shift that loss back to the issuing bank, or successfully contest the dispute, depends on how the card was accepted, what authentication the merchant used, and how quickly and precisely the business responds.
How the Money Actually Moves
A chargeback starts when a cardholder contacts their issuing bank. The bank credits the cardholder provisionally and routes the dispute through the card network to the merchant’s acquiring bank, which then debits the merchant’s account for the transaction amount plus a chargeback fee. The merchant has already lost the money at that point. Getting it back requires representment: resubmitting the transaction with evidence, which the issuing bank reviews and either accepts or rejects. If the issuer rejects it, the merchant can escalate to network arbitration, but the fees are steep and merchants rarely win at that stage.
Cardholders generally have 120 days from the transaction date to open a dispute with the major networks, and some reason codes extend that window further. The important takeaway for the business is that a transaction is not final at settlement. Months of exposure sit behind every sale.
Card-Present Liability and the EMV Shift
Since October 2015, the major card networks have enforced an EMV liability shift on in-person transactions. If a merchant processes a chip-equipped card by swiping the magnetic stripe instead of reading the chip, the merchant absorbs the loss on any counterfeit fraud from that transaction.2EMV Migration Forum. Understanding the 2015 U.S. Fraud Liability Shifts Before the shift, the issuing bank ate that cost by default. The rule is designed to push liability onto whichever side has the weaker security.
The practical line is clean. Terminal reads the chip: issuer generally carries counterfeit fraud risk. Terminal swipes a chip card: merchant carries it, with almost no realistic path to winning the dispute. There is no partial split.
Contactless and Mobile Wallets
Contactless payments through tap-to-pay cards and mobile wallets follow slightly different rules. Most networks do not apply a separate counterfeit liability shift to contactless transactions, and the deciding factor is whether the terminal supports contact EMV at all. Visa protects merchants from counterfeit liability on contactless transactions as long as the terminal is enabled for contact chip. Mastercard treats properly coded contactless transactions the same way. If your terminal reads chips, contactless fraud liability generally sits with the issuer.
Card-Not-Present Liability
Online orders, phone orders, and any transaction where the physical card is not read all fall under card-not-present, and the merchant carries the default fraud liability on every one of them. There is no chip in the loop, so issuers treat authentication as the merchant’s problem. Collecting the CVV, matching the billing address, verifying the shipping address, and logging the customer’s IP address all help build a defense, but none of them shift the underlying liability the way a chip read does in person.
3D Secure Is the One Real Shift
The one tool that actually moves card-not-present fraud liability off the merchant is 3D Secure authentication. When the customer completes a 3D Secure challenge and the issuer authenticates the transaction, fraud liability shifts to the issuing bank.3Visa. 3D Secure – Your Guide to Safer Transactions It applies across Visa, Mastercard, American Express, and other major networks. The current version, 3D Secure 2.0, supports both a full challenge and a frictionless flow where the issuer approves silently based on risk signals.
Two boundaries matter. The shift only covers fraud disputes, so it does nothing against a “product never arrived” or “not as described” claim. And it does not apply to merchant-initiated transactions like recurring charges processed without fresh cardholder authentication.
Subscription and Recurring Billing
Recurring charges create a distinct exposure because the cardholder authorized the first transaction and may dispute later ones. Mastercard requires merchants to send a reminder notification three to seven days before each billing date on subscriptions billed every six months or less frequently, and a separate reminder before a trial longer than seven days converts to paid.4Mastercard. Revised Standards for Subscription, Recurring Payments, and Negative Option Billing Merchants Every transaction receipt must include clear cancellation instructions, and merchants flagged in chargeback monitoring programs must send an electronic receipt after each authorized charge.
Failing to send the required pre-billing notices gives the cardholder a strong foundation for a chargeback and leaves the merchant with little to contest it with. Subscription businesses that treat the rules as optional tend to find their chargeback ratios climbing into monitoring territory.
Friendly Fraud and Visa Compelling Evidence 3.0
Friendly fraud is a legitimate purchase that the cardholder disputes as if it were unauthorized. The customer received the product, used the service, or benefited from the transaction, but tells the bank otherwise. The merchant is debited immediately and has to produce delivery confirmation, customer communications, signed receipts, login records, or whatever else shows the cardholder got what they paid for. A tracking number showing delivery does not guarantee a win. It gives you a chance at one.
Visa’s Compelling Evidence 3.0 rule gives merchants a stronger position on first-party fraud. To qualify, you present at least two previous transactions from the same customer that were never disputed, are between 120 and 365 days old, and share at least two identifying data points with the disputed charge.5Visa. Compelling Evidence 3.0 Merchant Readiness The matching elements can include user ID, IP address, shipping address, or device fingerprint, and at least one must be either the IP address or the device fingerprint. When the criteria are met, liability shifts to the issuing bank before the traditional evidence review even starts. It only works, though, if the merchant was logging device fingerprints and IPs alongside every transaction from the start.
What a Chargeback Actually Costs
The transaction amount is only the beginning. Payment processors charge a per-dispute fee that typically runs between $20 and $100 regardless of the outcome. The merchant also loses the product or service already delivered, any shipping absorbed, and the original processing fee, which commonly falls between 1.5 and 3 percent and is not refunded when a chargeback occurs. A single chargeback on a $100 sale can easily cost $150 or more.
Rolling Reserves
Merchants classified as high-risk or those with elevated chargeback rates may be required to maintain a rolling reserve. The processor withholds a percentage of daily sales, typically 5 to 15 percent, and holds those funds for six months to a year before releasing them. The reserve gives the processor a cushion if chargebacks exceed what the account can otherwise cover. Travel, digital goods, and subscription businesses are especially likely to face reserves, and a sudden spike in disputes can trigger one on a previously low-risk account.
Monitoring Programs and Termination
Each major network operates a monitoring program that flags merchants with excessive dispute activity. Visa’s consolidated program, the Visa Acquirer Monitoring Program, tracks fraud reports plus chargebacks divided by settled transactions. A merchant is flagged as excessive at 220 basis points (2.2 percent) with at least 1,500 monthly fraud and dispute counts, and Visa is reducing that threshold to 150 basis points (1.5 percent) in the U.S. as of April 2026.6Visa. Visa Acquirer Monitoring Program Fact Sheet 2025 Mastercard’s program flags merchants at 100 chargebacks per month with a chargeback-to-transaction ratio of 1.5 percent or higher.
Being placed in a monitoring program brings monthly fines, mandatory remediation plans, and higher per-transaction fees. In severe cases the processor terminates the account. A merchant dropped for excessive chargebacks ends up on a shared industry list that makes opening a new merchant account elsewhere extremely difficult. The fines hurt. Losing the ability to accept cards at all is the existential threat.
Fighting a Chargeback Through Representment
When a chargeback hits, the clock is short and unforgiving. Depending on the network and reason code, you have as few as 5 days or as many as 40 to respond. Visa gives merchants either 9 or 18 days depending on the dispute flow. Mastercard allows up to 40 in some categories and only 5 in others. Miss the deadline and the loss is automatic.
The response has to match the reason code, not just fill a folder. For a fraud claim, that means proof the cardholder authorized the transaction: AVS and CVV match records, IP geolocation data, 3D Secure authentication results, or device fingerprints tied to the cardholder’s prior purchases. For a “goods not received” claim, delivery confirmation with a signature or tracking data showing delivery to the verified address. For “not as described,” the product listing, the return policy, and any customer communications acknowledging the product’s condition. Submitting a generic bundle of documents without connecting each piece to the specific dispute reason is the fastest way to lose. If the issuer upholds the chargeback after representment, arbitration through the network is available, but the fees run several hundred dollars and merchants lose most of these cases.
Prevention Tools That Reduce Exposure
Hardware compliance is the baseline. Every physical location should accept chip and contactless transactions; a swipe-only terminal in 2026 has no defensible position. Beyond the terminal, a handful of tools target the verification gaps that chargebacks exploit.
- Address Verification Service (AVS): Compares the billing address the customer enters against the address the issuer has on file. A mismatch does not automatically block the transaction, but it flags suspicious orders for manual review, and documenting AVS results strengthens representment later.
- CVV verification: Requiring the security code confirms the customer has the card or at least the code. Stolen card numbers circulating online often lack the CVV.
- 3D Secure authentication: The only tool that actually shifts card-not-present fraud liability to the issuer. Worth the checkout friction for high-value or high-risk orders.
- Velocity filters: Rules that flag or block multiple rapid transactions from the same card, IP address, or device, which is how fraudsters test stolen cards before placing a large order.
- Clear billing descriptors: A large share of friendly fraud disputes come from customers not recognizing the business name on the statement. A descriptor that identifies the business and includes a phone number or URL reduces “I don’t recognize this charge” chargebacks.
No single tool eliminates chargebacks. Layered together, they cut both fraud losses and the friendly disputes that stem from confusion.
Tax Treatment of Chargeback Losses
Chargeback losses and fees are deductible as business expenses. The IRS treats unrecovered chargebacks on credit sales as business bad debts, deductible in full or in part on the business tax return provided the amount was previously included in gross income.7Internal Revenue Service. Topic No. 453, Bad Debt Deduction Sole proprietors report business bad debts on Schedule C. Chargeback fees, the cost of lost merchandise, and unrecovered shipping expenses are all deductible as ordinary business expenses in the year the loss becomes final.
One trap is worth flagging. Form 1099-K reports the gross dollar amount of your payment transactions without subtracting chargebacks, refunds, or processing fees.8Internal Revenue Service. Frequently Asked Questions About Form 1099-K The figure on the 1099-K will be higher than what actually reached your account. Chargeback losses and fees have to be accounted for separately when calculating taxable income, which means keeping detailed records of every dispute, its outcome, and its associated costs. Rely on the 1099-K figure alone and you overpay.
Why the System Sits This Way
The chargeback framework exists because federal law gives cardholders protections merchants cannot override through their own policies. Under the Truth in Lending Act, a consumer’s maximum liability for unauthorized credit card use is $50, and only if the issuer provided adequate notice of potential liability, the unauthorized use occurred before the cardholder notified the issuer, and the issuer gave the cardholder a way to report loss or theft. Most major issuers waive even the $50 through zero-liability policies. The card networks then use the chargeback process to determine who absorbs the loss the issuer credited back. Absent proof from the merchant that meets the network’s evidence rules for the specific reason code, that loss lands on the business. The burden of proof sits with the merchant from the start, and the businesses that build their verification and documentation processes around that fact fare better than the ones who learn it after the first dispute lands.