A fraudulent chargeback is a dispute in which a cardholder who made or authorised a purchase tells their card issuer it was unauthorised or never arrived, to get the money back while keeping the goods or service. It is also called chargeback fraud or first-party misuse, and differs from true fraud, where a criminal uses stolen card details. Because the cardholder usually files under a fraud reason code, such as Visa 10.4 (Other Fraud – Card-Absent Environment) or Mastercard 4837 (No Cardholder Authorization), the merchant loses the sale, the goods and a dispute fee. Mastercard cites a 2020 merchant survey putting first-party misuse at 75% of disputes for subscriptions and digital goods.
Fraudulent chargeback vs friendly fraud
Many processors use the two terms interchangeably. Where they are separated, friendly fraud also covers honest mistakes: a cardholder who does not recognise a billing descriptor, or a parent disputing a game purchase made by a child. A fraudulent chargeback is deliberate: claiming non-delivery after a tracked, signed-for delivery, disputing a subscription renewal instead of cancelling it, or calling a digital download unauthorised after using it. The issuer sees only the reason code at filing, not the intent, so the merchant has to prove it.
How merchants fight a fraudulent chargeback
The response is representment with compelling evidence. Since April 2023, Visa Compelling Evidence 3.0 gives card-absent merchants a defined test for 10.4 disputes: two earlier transactions on the same card, 120 to 365 days before the disputed one, that were neither disputed nor reported as fraud. At least two of four data elements must match across all three transactions (user ID, IP address, shipping address, device ID or fingerprint), and one of the two must be the IP address or device ID. When the test is met, the dispute is remedied, it does not add to dispute ratios, and the associated TC40 fraud report is removed.
Mastercard's First-Party Trust programme, announced in March 2024, works earlier in the chain. Merchants share transaction data at purchase or after a dispute; Mastercard combines it with network analytics, and the issuer can show the evidence to the cardholder, who may withdraw the claim.
Why fraudulent chargebacks threaten a merchant account
Visa's Acquirer Monitoring Program (VAMP) divides TC40 fraud reports plus TC15 disputes by settled card-not-present transactions. On 1 April 2026 the "excessive merchant" threshold fell from 2.2% to 1.5% in the US, Canada, the EU and Asia-Pacific; CEMEA stays at 2.2%. In those four regions formal monitoring starts at 1,500 combined events a month. Mastercard flags an Excessive Chargeback Merchant at 100 chargebacks and a 1.5% ratio in a calendar month, and a high-excessive merchant at 300 and 3%, with fees from the second consecutive month.
An illustrative EU subscription merchant settles 120,000 Visa card-not-present transactions a month and logs 900 fraud reports plus 1,100 disputes. Its VAMP ratio is 1.67%: compliant until March 2026, excessive from April. Removing 300 of those events through CE 3.0 remedies brings it to 1.42%.
What fraudulent chargebacks mean in a fintech acquisition
For a buyer of an acquirer, PSP or EMI with merchant acquiring, fraudulent chargebacks show up as reserves held against merchants, VAMP and Mastercard programme history, and the chargeback ratio of high-dispute verticals such as subscriptions and digital goods. Due diligence should ask for CE 3.0 eligibility and win rates by merchant: a portfolio sitting at 1.4% has almost no headroom under the April 2026 Visa threshold.