Payment chargebacks are bank-initiated reversals of card transactions that happen when a cardholder disputes a charge through their issuer instead of asking the merchant for a refund. When one lands, the disputed funds come out of the business account immediately, the card network adds fees, and the merchant has a short window to respond with evidence. Too many chargebacks in a month can trigger network monitoring programs that impose per-violation fines or end the merchant’s ability to accept cards altogether. Federal law caps a credit cardholder’s liability for unauthorized charges at $50, and most issuers waive even that, which means the cost of consumer disputes falls squarely on the business side of the transaction.
How a Chargeback Moves Through the System
Five parties touch every chargeback. The cardholder starts the dispute. The issuing bank (the bank that gave the cardholder their card) reviews the complaint and decides whether to pursue it. The merchant faces the potential reversal. The acquiring bank (the bank that processes the merchant’s card payments) relays information between the merchant and the network. Card networks like Visa and Mastercard sit in the middle and set the rules both banks must follow.
The process starts when a cardholder contacts their issuing bank. If the complaint has enough merit, the bank issues a provisional credit to the cardholder and sends a formal dispute notification to the merchant’s acquiring bank. That notification carries a reason code identifying the type of dispute: unauthorized transaction, undelivered merchandise, processing error, or something else. The merchant then has a limited window to respond with evidence. Miss the deadline and the provisional credit becomes permanent.
Throughout the process, the issuing bank holds the disputed funds. The merchant’s account is debited when the dispute is filed, regardless of how the case eventually resolves. Even merchants who win every dispute still absorb the cash-flow disruption and the administrative cost of assembling a response.
The Rules That Govern Disputes
The legal framework differs depending on whether the transaction involved a credit card or a debit card, and the distinction matters more than most merchants realize.
Credit Cards
The Fair Credit Billing Act and its implementing regulation (Regulation Z) govern credit card disputes. A cardholder must send written notice to the issuer within 60 days of the statement showing the disputed charge.1Office of the Law Revision Counsel. United States Code Title 15 – Section 1666 The issuer must acknowledge the dispute within 30 days and resolve it within two complete billing cycles, capped at 90 days total.2Consumer Financial Protection Bureau. 12 CFR Part 1026 – Regulation Z, Section 1026.13
For unauthorized use, the cardholder’s statutory maximum liability is $50, and only if the issuer met specific notice and identification conditions. If it didn’t, the cardholder owes nothing.3Office of the Law Revision Counsel. United States Code Title 15 – Section 1643 Most major issuers publish zero-liability policies that go beyond the statutory floor.
Debit Cards
Debit card disputes fall under the Electronic Fund Transfer Act and Regulation E. The consumer filing window is the same 60 days from the statement date, but cardholder liability for unauthorized transfers escalates based on how quickly the cardholder reports the problem, and the burden of proof falls on the financial institution to show that a disputed electronic transfer was actually authorized.4Office of the Law Revision Counsel. United States Code Title 15 – Section 1693g If the institution can’t prove authorization, it must credit the consumer. That presumption tilts debit disputes against the merchant from the outset.
Reason Codes and What They Demand
Every chargeback arrives with a reason code that tells the merchant exactly what the cardholder alleges. The code dictates what evidence will win the response. Visa groups its reason codes into four broad categories:
- Fraud (Category 10): unauthorized transactions, including counterfeit card fraud and card-not-present fraud. The most common and often the hardest to fight without strong authentication records.
- Authorization (Category 11): the merchant processed a transaction without proper authorization, such as running a declined card or submitting a charge after the authorization expired.
- Processing Errors (Category 12): duplicate charges, incorrect amounts, wrong currency, or invalid account numbers.
- Consumer Disputes (Category 13): merchandise not received, goods not as described, canceled recurring charges that kept billing, or refunds never posted.
Mastercard uses its own numbering system but covers similar ground. The reason code isn’t just administrative labeling; it dictates the entire defense strategy. A merchandise-not-received dispute needs shipping confirmation. A not-as-described claim needs product documentation and communication records showing what was promised.
Friendly Fraud
Not every chargeback comes from a genuine problem. A large share of disputes, particularly in e-commerce, involve what the industry calls friendly fraud or first-party fraud: a cardholder files a dispute on a legitimate purchase they actually received. Motivations range from buyer’s remorse to subscription confusion to deliberate abuse. The chargeback process was built to protect consumers from merchants, so when a cardholder lies about a transaction, the merchant starts at a disadvantage. Card networks have begun to respond. Visa’s compelling-evidence rules for reason code 10.4 (card-not-present fraud) now let merchants submit prior successful transactions from the same device or IP address to show the cardholder has a history with the business. Assembling that evidence is still the merchant’s job.
Responding Within the Window
When a chargeback notification arrives, the clock starts immediately. Under Visa’s dispute resolution system, merchants get 30 days to submit a response with supporting evidence.5Visa. Visa Claims Resolution – Efficient Dispute Processing for Merchants Mastercard runs on similar timeframes. Missing the deadline is an automatic loss.
The evidence depends on the reason code. For a fraud dispute, the strongest response includes proof that the legitimate cardholder was involved: matching billing and shipping addresses, AVS (Address Verification Service) confirmations, CVV matches, and records of 3D Secure authentication. For merchandise-not-received, a tracking number showing delivery to the cardholder’s confirmed address is the centerpiece. For not-as-described, product photos, listing descriptions, and any pre-sale communication where the customer acknowledged what they were buying all help.
Beyond the evidence, the merchant must complete the response forms required by the acquiring bank or payment processor. These forms capture transaction dates, authorization codes, and a narrative explaining why the charge was valid. Precision matters. An incomplete form, or a narrative that doesn’t directly address the specific reason code, is functionally the same as no response at all.
Communication records often decide borderline cases. Emails where a customer confirmed receipt, chat transcripts where they discussed the product positively, or support tickets where they originally asked for something other than a refund can all show that the chargeback doesn’t match what actually happened.
Pre-Arbitration and Arbitration
If a merchant submits a compelling response and the issuing bank still sides with the cardholder, the case doesn’t necessarily end. Most card networks include a pre-arbitration stage where both sides get another chance to resolve before things escalate. The issuer can present additional evidence or certify that it contacted the cardholder to review the merchant’s submission.6Visa. Dispute Management Guidelines for Visa Merchants
If pre-arbitration fails, the case moves to formal arbitration where the network itself reviews everything and issues a binding decision. Visa’s case filing fee for arbitration is $600, and the losing party pays it. The combined cost of losing (the chargeback amount, the arbitration fee, and any accumulated processing fees) can make it uneconomical to pursue disputes under a certain dollar threshold. Many merchants accept the loss rather than risk another $600 on top of the original chargeback.
Arbitration decisions are final within the network’s system. The only remaining option is to pursue the matter through the courts, which rarely makes sense for individual transaction disputes.
Liability Shifts
Two technological developments have changed who pays for fraud chargebacks, and merchants who haven’t adapted are absorbing losses they don’t need to.
EMV Chip Cards
Since October 2015, the major card networks have enforced an EMV liability shift: whichever party in the transaction doesn’t support chip technology bears the cost of counterfeit card fraud.7Mastercard. EMV/Chip Frequently Asked Questions for Merchants If a customer uses a chip card at a terminal that only reads magnetic stripes, the merchant is liable for any resulting fraud chargeback. If the merchant has a chip-enabled terminal but the card doesn’t have a chip, liability shifts to the issuing bank.
3D Secure Authentication
For online transactions, 3D Secure (the technology behind prompts like “Verified by Visa” and “Mastercard Identity Check”) creates a similar shift. When a card-not-present transaction is successfully authenticated through 3D Secure, fraud chargeback liability generally shifts from the merchant to the issuing bank. This applies across Visa, Mastercard, American Express, and several other networks. The shift does not cover recurring transactions, so subscription businesses can’t rely on a one-time authentication to protect every future charge.
Network Monitoring Programs
Card networks track patterns and penalize merchants who generate too many disputes. Crossing the wrong threshold escalates quickly from fees to account termination.
Visa’s Acquirer Monitoring Program (VAMP)
As of April 2026, VAMP flags merchants as “excessive” when combined fraud reports and chargebacks reach 1.5% of total monthly Visa transactions. The ratio includes both fraud alerts (TC40 reports) and actual chargebacks (TC15), divided by total settled Visa volume. Merchants must also hit a minimum of 1,500 combined events per month before formal monitoring kicks in. Under the current rules there is no warning tier; merchants who cross the threshold face immediate per-violation fines, and their acquiring bank may pass those costs through or terminate the relationship.
One detail that catches merchants off guard: chargebacks where the merchant isn’t financially liable, such as counterfeit card fraud at a chip-enabled terminal, still count toward the VAMP ratio. The only events excluded are those resolved through pre-dispute alert services before a formal chargeback is filed.
Mastercard’s MATCH List
Mastercard maintains a database called MATCH (Mastercard Alert to Control High-risk Merchants) that functions as an industry blacklist. When a processor terminates a merchant relationship for excessive chargebacks or certain other violations, it must add that merchant to MATCH within one business day. The excessive chargeback trigger: if chargebacks exceed 1% of Mastercard transactions in any calendar month and total at least $5,000, the merchant meets the criteria.8Mastercard. Chargeback Guide – Merchant Edition
Records stay on MATCH for five years. During that time, most acquiring banks refuse to open a new processing account for the listed merchant. Other grounds for MATCH inclusion go beyond chargebacks, including data breaches, fraud convictions of business owners, PCI compliance failures, and illegal transactions.
Preventing Chargebacks Before They Happen
Fighting chargebacks after they arrive is expensive and time-consuming. Merchants with the lowest dispute ratios invest more in prevention than in response.
- Use recognizable billing descriptors. A large share of chargebacks start because a cardholder doesn’t recognize a charge on their statement. If the business name on statements doesn’t match what customers know you as, confusion becomes a chargeback.
- Send order confirmations and tracking numbers immediately. Automated emails with order details and shipping tracking let customers check delivery status themselves, which undercuts merchandise-not-received claims before they start.
- Make customer service easy to reach. If a frustrated customer can get a human on the phone or a quick response in chat, they’re more likely to ask for a refund than to file a dispute. Every refund costs less than a chargeback.
- Require CVV and use address verification. These basic fraud tools don’t stop every unauthorized transaction, but they create evidence that the legitimate cardholder was involved.
- Implement 3D Secure for online sales. Beyond the liability shift, authenticated transactions simply generate fewer fraud disputes.
Merchants processing significant volume should also consider chargeback alert services like Ethoca (primarily for Mastercard disputes) and Verifi’s Cardholder Dispute Resolution Network (originally Visa, now covering some Mastercard disputes as well). These services notify you when a dispute is filed and give you a brief window to issue a refund before the chargeback is formally recorded. The refund costs you the transaction amount, but you avoid the chargeback fee and, critically, the event doesn’t count against your dispute ratio. Speed matters: if the refund doesn’t process quickly enough, the chargeback may still be recorded.
Records, Retention, and the 1099-K Wrinkle
Network rules generally require merchants to retain transaction records for retrieval requests, and disputes can surface months after a sale. A chargeback filed 120 days post-sale is useless to fight if the shipping confirmation was deleted at 90 days. Most payment professionals recommend keeping records for at least two years, and three years provides a comfortable margin for late-arriving disputes and tax documentation needs. That means authorization codes, receipts, shipping confirmations, and communication logs, all retrievable.
For merchants receiving Form 1099-K from their payment processor, chargebacks create a tax reporting wrinkle. The IRS defines the gross amount reported on 1099-K as the total dollar amount of reportable payment transactions “without regard to any adjustments for credits, cash equivalents, discount amounts, fees, refunded amounts, or any other amounts.”9Internal Revenue Service. Instructions for Form 1099-K The 1099-K shows full gross payment volume, and chargebacks don’t reduce the reported number.
For 2026, third-party settlement organizations must report if you exceed $20,000 in total payments and more than 200 transactions in the calendar year.10Internal Revenue Service. Publication 1099 (2026) When you file, you’ll need to account for chargebacks as adjustments to gross income rather than expecting them to be excluded from the 1099-K. Detailed chargeback records kept throughout the year prevent a mismatch between reported income and what the business actually retained.