Quick summary
Almost every chargeback traces back to one of three causes: real fraud on stolen cards, friendly fraud from your own customers, and processing errors on your side. Each needs a different fix — fraud screening does nothing about friendly fraud, and a clearer billing descriptor won't stop a stolen card. Match the tactic to the cause, keep your dispute ratio under the roughly 1% line the card networks watch, and fight the disputes you can actually win.
Last updated: 10 July 2026
A chargeback is a forced refund. The cardholder calls their bank instead of calling you, the bank pulls the money back out of your account, and you're charged a dispute fee — typically $15 to $50 — whether you deserve it or not. Lose the dispute and you've lost the goods, the revenue, and the fee. Win it and you've still lost the fee at many acquirers, plus hours of your team's time, plus a mark against your dispute ratio.
The good news is that most chargebacks are preventable, and the merchants who get their rate down all do the same thing: they stop treating chargebacks as one problem. There are three distinct causes, each with its own prevention playbook. Applying fraud screening to a friendly-fraud problem wastes money. Tightening your refund policy does nothing about stolen cards. You have to know which problem you've got before you can fix it.
We work with merchants who take card payments over the phone every day, so we'll give phone payments — one of the most overlooked chargeback surfaces — proper attention below. But the framework applies to every card-not-present channel you run.
The three things that actually cause chargebacks#
Before you spend a dollar on prevention, pull your last six months of disputes and sort them by reason code. Every dispute your acquirer sends you carries one, and the codes cluster into three buckets:
| Cause | What it looks like | Primary fix |
|---|---|---|
| True fraud | Stolen card details used by someone who isn't your customer. The cardholder genuinely didn't make the purchase. | Stop the transaction before it authorizes: CVV and AVS checks, velocity limits, 3D Secure on risky orders. |
| Friendly fraud | Your real customer disputes a legitimate charge — they forgot it, didn't recognize it, or want a refund without asking you. | Recognizable descriptors, receipts, clear terms, easy refunds, and solid evidence for representment. |
| Processing errors | Duplicate charges, wrong amounts, refunds that never posted, subscriptions that kept billing after cancellation. | Fix your own operations. These are entirely self-inflicted. |
Most merchants assume true fraud is the big one. Ask anyone who works disputes for a living and they'll tell you the opposite: at a typical card-not-present merchant, friendly fraud usually outweighs true fraud, often by a wide margin. That matters because the instinct — buy a fraud tool — addresses the smaller bucket. The bigger bucket gets fixed with duller work: descriptors, receipts, and refund policy.
Stopping true fraud before it authorizes#
True fraud is the cleanest bucket to attack because you can stop it at the authorization step, before the transaction ever exists. Three controls do most of the work.
First, check the CVV and the billing address on every transaction, and actually decline on mismatch. Plenty of merchants request the checks, get a mismatch response from the issuer, and approve the sale anyway because the authorization technically succeeded. That's how stolen card numbers from data breaches get monetized — the thief has the number and expiry but not the security code or the billing ZIP. Declining on CVV mismatch cuts off the most common attack at the door.
Second, set velocity limits. A card that fails three times and then succeeds, five orders from the same device in ten minutes, a run of small transactions walking up in value — these are card-testing patterns, and they precede the big fraudulent order. Your gateway almost certainly supports velocity rules; most merchants have never turned them on.
Third, tokenize stored cards. A breach of your own systems that leaks card numbers turns you into the source of everyone else's fraud problem — and the reputational and liability cost dwarfs any single chargeback. If your database holds tokens instead of card numbers, there's nothing worth stealing. Our guide to tokenization covers how that works and why PCI DSS rewards it.
Friendly fraud: the one that catches merchants off guard#
Friendly fraud (the industry also calls it first-party misuse) is your own customer disputing a charge that was legitimate. Sometimes it's genuinely innocent — a cryptic billing descriptor they don't recognize, a spouse's purchase they didn't know about, a free trial that converted to paid without them noticing. Sometimes it's deliberate: they want the product and the money. Either way, the dispute lands on you.
The single highest-return fix is your billing descriptor. If your legal entity is "JDH Holdings LLC" and your brand is "Brightlawn," the statement line says JDH Holdings, the customer doesn't recognize it, and they dispute it in the banking app in about four taps. Set the descriptor to the name the customer actually knows, add a phone number to the soft descriptor if your processor supports it, and a chunk of your "unrecognized transaction" disputes disappears.
The second fix is making the refund path easier than the dispute path. Banking apps have made disputing a charge nearly frictionless, so if reaching your support team takes more effort than tapping "dispute transaction," the customer takes the easy route. A refund costs you the sale. A chargeback costs you the sale, the fee, and the ratio. Answer support quickly, publish a clear refund policy, and honor it without a fight — it's cheaper than the alternative every time.
The third is evidence discipline. Send a receipt for every transaction, get delivery confirmation with signature on anything valuable, log IP addresses and device details for online orders, and for subscriptions, keep a timestamped record of the sign-up, the terms shown, and every renewal notice. You're building the file you'll need if the dispute comes anyway — more on that under representment below.
Processing errors: the self-inflicted ones#
This bucket has no villain — just operational sloppiness that turns into disputes. The patterns repeat across almost every merchant we've looked at.
Duplicate charges come from retry logic that resubmits a payment after a timeout when the first attempt actually succeeded. Slow refunds get disputed because the customer was promised their money back, watched nothing arrive for two weeks, and asked their bank to force it. Subscriptions that keep billing after cancellation are the classic: the customer cancelled by email, someone missed it, the next renewal fires, and the dispute follows with the customer firmly in the right.
The fix is unglamorous. Reconcile daily so duplicates get caught and refunded before the customer notices. Process refunds the day they're approved, and tell the customer the posting timeline. Treat a cancellation received through any channel as effective immediately. None of this needs new software — it needs someone to own the process.
Phone payments: the overlooked chargeback surface#
Every payment taken over the phone is a card-not-present transaction, which means it carries CNP dispute risk without any of the protections a web checkout gets by default — no 3D Secure prompt, no device fingerprint, no checkout page recording what the customer saw and agreed to. If you take meaningful volume by phone, this channel deserves its own look.
The traditional flow makes it worse. The customer reads their card number aloud, the agent keys it into a terminal, and two problems follow. Keying errors produce wrong-amount and wrong-card disputes. And the card details are now sitting in your call recordings, which PCI DSS forbids — so most call centers pause the recording during payment, which destroys the very evidence you'd want when the customer later claims they never authorized the charge.
The better architecture fixes both at once. With DTMF masking or agent-assisted secure capture, the customer types their own card number on their phone keypad, the tones are masked so they never reach the agent or the recording, and the digits travel straight to the payment processor. The customer entering their own card eliminates agent keying errors. And because there's no card data in the audio, you keep recording the entire call — including the part where the customer confirms the amount and agrees to the charge. That recording is exactly the evidence that wins a "transaction not authorized" dispute.
The same setup takes your call recordings and agent workstations out of PCI scope, which is the main reason merchants buy it — the chargeback evidence is the bonus. Our pages on telephone payments and the PCI-compliant call center walk through the architecture, and there's a deeper treatment in PCI compliance for telephone payments.
Taking payments by phone? Book a 15-minute demo — we'll show you a live secure capture and what the dispute-ready audit trail looks like.
When to turn on 3D Secure#
3D Secure (the "verify it's you" prompt from the cardholder's bank) does one thing brilliantly and one thing not at all. The brilliant part: on a 3DS-authenticated transaction, liability for fraud chargebacks generally shifts from you to the card issuer. A "transaction not authorized" dispute on an authenticated payment is the issuer's problem, not yours. For true fraud, that's as close to a kill switch as exists.
The not-at-all part: 3DS does nothing for friendly fraud coded as "product not received" or "not as described," and nothing for processing errors. If your dispute file is mostly those, 3DS won't move your numbers.
The cost is friction. Every authentication step loses some buyers, and US shoppers see 3DS far less often than European ones, so the prompt reads as unusual. Our position: don't run 3DS on everything. Run it risk-based — high ticket values, first-time customers, mismatched AVS signals, shipping addresses that differ from billing. You take the liability shift where fraud risk is real and skip the friction where it isn't. Most modern gateways support exactly this kind of conditional triggering.
When prevention fails: representment basics#
Some disputes will arrive no matter what you do, and eating every one of them trains the deliberate friendly-fraudsters that you're a soft target. Representment is the formal process of fighting back: you submit evidence to your acquirer, who forwards it to the issuer, who decides whether the charge stands.
The evidence has to match the reason code. A "fraud" dispute wants proof the cardholder made the purchase — AVS and CVV match results, a delivery signature, prior undisputed orders from the same customer, or that call recording of them authorizing the payment. A "product not received" dispute wants tracking and delivery confirmation. A "cancelled subscription" dispute wants your cancellation log showing no cancellation before the billing date. Visa and Mastercard both publish what counts as compelling evidence for each code, and submissions that ignore the code get rejected without a second look.
Be selective. Fight the disputes where your evidence is strong and the amount justifies the effort; refund the rest quickly, because a fast refund can sometimes head off the formal chargeback entirely. It's also worth asking your processor about the dispute-alert programs run through the card networks — Verifi on the Visa side, Ethoca on Mastercard's. They flag a dispute a day or two before it becomes a chargeback, giving you a window to refund proactively and keep it off your ratio.
Watch your dispute ratio like the networks do#
Chargebacks don't just cost money one at a time — in aggregate they threaten your ability to take cards at all. Visa and Mastercard both run monitoring programs that flag merchants whose dispute ratio crosses a threshold, typically in the neighborhood of 1% of transactions, with a lower "early warning" tier before that. Cross the line and the consequences escalate: remediation plans, monthly fines, higher processing costs, bigger rolling reserves, and eventually a terminated merchant account — which follows you when you apply elsewhere.
Healthy merchants run well under that line, and the practical target we'd suggest is staying below half of it. Track the ratio monthly, broken out by channel and by reason code. When it moves, the reason-code breakdown tells you which of the three buckets is leaking — and by now you know each bucket has its own fix.
Frequently asked questions#
What's a good chargeback rate?
The card networks' monitoring programs generally start paying attention around 0.9% to 1% of transactions, but you don't want to live anywhere near that. Well-run merchants typically sit under 0.5%, and many run below 0.1%. Treat anything trending toward the network thresholds as an emergency, not a curiosity — the monitoring programs bring fines and reserve requirements once you're in them.
Do chargebacks hurt me even if I win the dispute?
Yes. At most acquirers the dispute fee isn't refunded when you win, your team still spent hours assembling evidence, and — the part that surprises people — a won dispute still counts against your dispute ratio at the networks. Winning representment recovers the transaction amount, nothing else. That's why prevention beats fighting, every time.
What's the difference between a refund and a chargeback?
A refund is voluntary — the customer asks you, you return the money, no fee, no ratio impact. A chargeback is forced — the customer's bank claws the money back, you pay a dispute fee, and the event counts against your ratio regardless of the outcome. This is why making refunds easy is a chargeback-prevention tactic: every dispute you convert into a refund is a fee and a ratio mark you didn't take.
How does 3D Secure reduce chargebacks?
On an authenticated transaction, liability for fraud disputes generally shifts from the merchant to the card issuer, so "transaction not authorized" chargebacks largely stop being your problem. It doesn't touch friendly fraud coded as "not received" or "not as described," and it adds checkout friction, so run it risk-based — high-value orders, new customers, mismatched signals — rather than on every transaction.
Can friendly fraud be prevented completely?
No, but it can be cut hard. A recognizable billing descriptor, receipts on every charge, clear subscription terms with honest renewal notices, and support that's easier to reach than the bank's dispute button remove the innocent cases — which are most of them. For the deliberate cases, the answer is evidence and representment: fight with delivery confirmations, usage logs, or call recordings, and the repeat offenders learn you're not a free store.
How do phone payments affect chargeback risk?
Phone payments are card-not-present transactions, so they carry CNP dispute risk — and the traditional read-your-card-aloud flow adds keying errors and forces you to pause call recordings during payment, destroying your best evidence. Secure capture with DTMF masking flips that: the customer enters their own card on the keypad, the digits never enter the audio, and you keep a complete recording of the customer authorizing the amount — strong compelling evidence if a dispute arrives.
