Chargeback and Friendly Fraud
The real cardholder disputes a transaction they made or benefited from, using card network dispute rights to reverse payment while keeping the goods, service or value.
What it is
Friendly fraud is First-Party Fraud that uses the card network's dispute system as the reversal mechanism. The transaction was real, the cardholder (or someone in their household) authorized it, and the dispute is the fraud.
It sits on a spectrum, and where a case lands determines the right response:
| Type | Intent | Typical dispute claim | Right response |
|---|---|---|---|
| Confusion | None; unrecognized descriptor, forgotten subscription, family member's purchase | Fraud / unrecognized | Better descriptors, receipts, pre-dispute alerts |
| Buyer's remorse | Low; wanted a refund, used the bank instead of the merchant | Not as described, cancelled | Easier refunds and cancellations |
| Opportunistic abuse | Real; knows the purchase was theirs | Fraud, not received | Representment with evidence; account restrictions |
| Serial / organized abuse | High; repeat pattern, possibly coached or sold as a service | Any code that wins | Network evidence programs, deny lists, law enforcement |
Distinguish from Card-Not-Present Fraud, where a third party used a stolen card and the dispute is honest. Both arrive under the same fraud reason codes, which is the core labeling problem. See Loss Taxonomy and Attribution.
How it works
The exploit works because dispute rights favor the cardholder by design, issuers grant provisional credit quickly, and many merchants don't contest low-value disputes because representment costs more than the ticket. That math is widely known, and in organized cases is taught.
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Purchase or funding | Normal-looking transaction from a known device and account; sometimes unusual size relative to history | Pre-auth risk: is this customer's dispute history a factor? |
| Consumption | Digital goods consumed, item delivered with proof, service used, or card-funded balance withdrawn, traded or sent | Hold on card-funded value; delivery confirmation |
| Pre-dispute | No contact with merchant support, or a refund request denied just before | Pre-dispute alert networks; refund-on-alert decision |
| Dispute | Fraud or not-received reason code; same device, IP and address as prior undisputed purchases | Representment with compelling evidence |
| Repeat | Same customer, household, device or payment method disputes again | Account-level enforcement; Negative Lists and Deny Lists |
In fintech, friendly fraud often means card-funded deposits that are later disputed. A customer funds a brokerage or neobank account with a debit card, withdraws or trades, then disputes the funding transaction as unauthorized. The platform is the "merchant" and absorbs a chargeback on money it already paid out. This is a first-party cousin of Instant Funding Abuse (Kiting) and, when it happens across many accounts, a form of Bust-Out Fraud.
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| "I didn't make this" on own purchase | Fraud reason code; device and account match history | Ecommerce, digital goods |
| Not-received with proof of delivery | Delivery confirmed; claim persists | Physical goods, marketplaces |
| Subscription disputes | Customer disputes instead of cancelling | SaaS, streaming, memberships |
| Card-funded deposit disputes | Deposit disputed after value withdrawn | Neobanks, brokerages, P2P, crypto on-ramps |
| Rewards double-dip | Purchase earns cashback or points, then charged back | Cashback, Coupons and Rewards, Card-Linked Offer Abuse |
| Coached / as-a-service disputes | Scripts and repeat patterns across unrelated customers | Retail and marketplaces; see Refund and Return Fraud |
| Dual-channel | Refund through merchant and chargeback through bank | Any merchant without refund-chargeback reconciliation |
Where it shows up
- Retail and Ecommerce and digital goods: highest volume; digital goods can't be recovered.
- Online Marketplaces: overlaps with Buyer Protection Claim Abuse (INR and SNAD); the buyer chooses whichever channel is more favorable.
- Cashback, Coupons and Rewards: a disputed purchase can still trigger cashback if the merchant does not report the reversal, so the platform pays out on a reversed sale. Commission reversal and Reward Vesting and Clawback matter.
- Neobanks and Consumer Fintech / Payments and P2P: disputed card loads into wallets; the platform carries the chargeback on money already sent via P2P.
- Brokerage and Investing: disputed debit-card funding after trading or withdrawal; market movement adds a second loss dimension.
Impact
- Share of disputes: Mastercard, citing Ethoca research, says about 75% of fraud experienced by online businesses is first-party fraud (Mastercard, 2023); industry commentary commonly estimates friendly fraud at 60–80% of chargebacks (PaymentsJournal). Treat both as directional, since definitions vary.
- Network program exposure: friendly-fraud disputes still count toward dispute ratios. Visa's VAMP combines fraud and dispute counts against CNP volume (Rapyd), so first-party abuse can push a merchant toward Excessive status even with no third-party fraud.
- Model contamination: friendly-fraud chargebacks labeled as third-party fraud teach models to decline good customers. See Fraud Labeling and Feedback Loops.
- Operational cost: representment staffing, evidence systems and fees.
Red flags
- Prior undisputed purchases from the same device, IP, account and address as the disputed one → Device Fingerprinting, Customer Tenure and History
- Repeat disputes or refund requests from the same customer, household or payment method → Dispute and Return History
- Dispute filed after a declined refund request, or with no merchant contact at all → Customer Contact Signals
- Value consumed or withdrawn shortly before the dispute → Transaction Pattern Anomalies, Fast In Fast Out Patterns
- Clusters of similar dispute narratives across unrelated accounts → Entity Link Analysis
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Clear descriptors, receipts, easy cancellation | Eliminates confusion disputes, the cheapest category to fix |
| Prevent | Claims and Returns Policy Controls | Makes the merchant channel easier than the bank channel for legitimate complaints |
| Prevent | Withdrawal and Payout Controls, Funds Availability Holds | Holds card-funded value until the dispute risk has aged |
| Prevent | 3-D Secure and Card Verification | Authenticated transactions shift fraud-coded dispute liability to the issuer and strengthen evidence |
| Detect | Dispute and Return History | Customer-level abuse scoring |
| Respond | Network evidence programs (Visa CE 3.0, Mastercard First-Party Trust) | Uses historical transaction matches to defeat false fraud claims |
| Respond | Case Management Systems | Evidence assembly and representment tracking |
| Respond | Negative Lists and Deny Lists, Consortium and Data Sharing | Restricts serial abusers; shares signals |
Emerging variants and adversary adaptation
- Networks now reward evidence. Visa Compelling Evidence 3.0, effective April 15, 2023, applies to reason code 10.4 (card-absent fraud). The merchant shows at least two prior undisputed transactions on the same card, 120–365 days before the dispute, sharing at least two data elements (user ID, IP, delivery address, device ID) with the disputed one, and one of those elements must be IP or device ID (Adyen). Compliance improves the odds of winning; it doesn't guarantee a win.
- Mastercard's First-Party Trust program, announced in October 2023 with the U.S. Merchant Advisory Group and Merchant Risk Council, lets merchants share device, delivery and identity data before authorization or at the dispute stage, and offers chargeback protection for qualifying disputes (Mastercard, 2023). The U.S. rollout began in October 2024 and covers reason code 4837 (Chargeflow).
- The adaptation is to break the match. As evidence programs rely on device and IP continuity, abusers who know about them may dispute from customers without history, or across channels the evidence can't link. Compensating controls: richer identity linkage, delivery evidence, and tighter policy for first-time customers on high-risk items.
- Dispute-as-a-service (coached or outsourced dispute filing) industrializes first-party abuse and makes it look like an organized ring. Graph analysis across dispute narratives and devices is the counter.
- Labeling is the strategic issue. As more disputes are recognized as first-party, programs need separate loss buckets and separate controls. See First-Party Fraud.
Related mechanisms
- First-Party Fraud: the umbrella
- Card-Not-Present Fraud: the honest-dispute counterpart
- Refund and Return Fraud and Buyer Protection Claim Abuse (INR and SNAD): merchant-channel versions
- Instant Funding Abuse (Kiting) and Bust-Out Fraud: when the disputed transaction funded an account
Real-world examples
- Visa launched CE 3.0 in April 2023 and Mastercard announced First-Party Trust in October 2023. Both are explicit network acknowledgments that a large share of "fraud" disputes are first-party (Adyen; Mastercard, 2023).
Sources and further reading
- Adyen: Visa Compelling Evidence 3.0 FAQ: CE 3.0 effective date, 120–365 day window, data-element matching
- Mastercard press release: First-Party Trust (Oct 2023): program design and the 75% first-party share statistic
- Mastercard B2B blog: First-Party Trust: three data categories and validation against prior transactions
- Chargeflow: Mastercard First-Party Trust: U.S. effective date, reason code 4837 coverage
- PaymentsJournal: New Visa chargeback rules: industry estimates of friendly fraud share and cost
- Rapyd: Visa VAMP: how disputes count toward monitoring ratios
- See also Card Network Dispute Rules