Disputes & Chargebacks, End-to-End

If a transaction goes sideways, you have two lanes. Lane A is “merchant-first”: ask the business to fix it (refund, replacement, cancellation). Lane B is a formal dispute through your bank or card issuer, which can escalate into a chargeback—a network-run reversal that pulls funds back from the merchant. The lanes touch each other but run on different rules. Picking the right one, at the right time, is the difference between a clean fix and a months-long paper chase.

This guide walks through how card disputes actually flow under the hood, how evidence gets weighed, what the reason codes really mean, the clocks that control the process, and when to choose “merchant-first” versus going straight to a chargeback. I’ll also flag the important differences between credit cards (governed by the Fair Credit Billing Act, “FCBA,” and card-network rules) and debit/ACH (governed by Regulation E), plus newer tools that resolve problems before a chargeback even happens.

The two systems you’re dealing with

When you complain to your credit-card issuer about a “billing error,” you’re invoking rights under FCBA/Regulation Z. That law gives you 60 days from when the statement is sent to mail a written notice, the issuer must acknowledge within 30 days, and it must resolve the issue within two billing cycles (not more than 90 days). During the investigation you can withhold payment on the disputed amount. Those timelines come from the FTC/CFPB’s FCBA guidance and the Regulation Z rule text. (Consumer Advice, Consumer Financial Protection Bureau)

When you complain about a debit-card or other electronic funds transfer, your bank is operating under Regulation E. Different clocks: the bank has 10 business days (20 for new accounts) to investigate or else provisionally credit you; it typically has up to 45 days to finish (90 for certain cases) if it gave provisional credit. Those obligations are straight from Regulation E §1005.11 and CFPB explainers. (Consumer Financial Protection Bureau, Legal Information Institute)

Sitting alongside those consumer-protection laws is the card-network dispute system (Visa/Mastercard). That machinery is what people usually mean by “chargebacks.” Networks define reason codes, accept evidence from both sides, and impose time limits (often up to 120 days from the transaction or service date for the cardholder to initiate a dispute for many categories). These details live in each network’s merchant dispute rules and widely-cited industry summaries. (Visa, Chargebacks911)

Merchant-first vs. chargeback: how to choose

A merchant-first approach makes sense when you have a conventional refund scenario—wrong item, delayed shipment, duplicate billing—and the merchant is responsive. Visa’s own consumer guidance literally says your first step should always be to contact the seller, and only escalate if that fails. That isn’t a legal requirement under FCBA, but it’s often faster and less adversarial. (Visa)

Go straight to a chargeback when the merchant is unresponsive, declines a legitimate refund, has gone out of business, or the transaction is truly unauthorized. Card brands also run Zero Liability policies that promise you won’t be held responsible for unauthorized card use—useful for stolen-card fraud while the bank investigates. (Visa references a five-business-day replacement of funds after notice; Mastercard’s policy bars responsibility for unauthorized transactions when you meet issuer conditions.) (Visa, Mastercard)

Important nuance: once a formal dispute is filed, a merchant-initiated refund doesn’t always stop the chargeback from counting against the merchant. If the chargeback still proceeds, a late refund can even cause “double refund” outcomes (consumer gets both), which merchants then must unwind. That’s why some sellers beg you to “drop the chargeback first”—but you shouldn’t do that until the refund has actually posted. Industry docs and PSP guides call this risk out specifically. (Stripe Docs, Chargeback Gurus)

The chargeback lifecycle (what actually happens)

From the bank’s user-facing perspective, you file a dispute, the issuer investigates, and if it can’t resolve informally it pushes a chargeback through the card network. On the merchant side, that triggers a formal case with a reason code attached. The merchant can accept (refund) or represent (fight) with compelling evidence. If the issuer still disagrees, it can escalate to pre-arbitration and ultimately arbitration at the network. Visa’s official Dispute Management Guidelines map this flow and the allowable evidence. Mastercard’s Chargeback Guide does the same for its rails. (Visa, Mastercard)

Two clocks are always running:

Cardholder clock. For many Visa dispute categories, issuers have up to 120 days from the transaction or expected service date to initiate a dispute (there are exceptions). Mastercard has analogous time-limit constructs embedded in its rules. (Chargebacks911, Mastercard)
Merchant clock. Your acquirer gives you a short window—often 7–21 days—to submit evidence. That exact window is acquirer-specific, but it lives inside the network’s broader deadlines documented in Visa and Mastercard manuals. (Visa, Mastercard)

Reason codes: what they actually signal

Networks group disputes into families:

Fraud/Unauthorized (e.g., Visa 10.4 Other Fraud—Card-Absent; Mastercard 4837 No Cardholder Authorization). These mean the cardholder says, “I didn’t do this.” Merchants defeat these by showing strong ties between the buyer and the transaction. (Chargeback Gurus, developers.tabapay.com)
Authorization/Processing errors (late presentment, incorrect amount, no authorization). These are about how the transaction was processed, not the buyer’s intent. (Visa)
Consumer disputes (merchandise not received, not as described, canceled recurring but billed). These hinge on delivery, descriptions, and cancellation proof. (Visa)

Why that matters: the evidence you assemble must match the code. Send shipping proof to a “not as described” case without addressing quality complaints and you’ll likely lose. Visa’s June 2024 guide literally enumerates what qualifies as Compelling Evidence for each fraud code—including detailed device, login, address, and prior-purchase signals for card-not-present transactions. (Visa)

“Compelling Evidence” and how merchants win or lose

“Compelling Evidence” is network-speak for documents/data linking the buyer to the transaction, delivery, or benefit. Visa’s rules spell out acceptable items. For card-not-present fraud (Condition 10.4), Visa allows a combination of: the customer’s login/account ID; delivery address that matched AVS (Address Verification Service); device ID or fingerprint; IP address; email; telephone; and records showing prior, undisputed transactions that share three or more of those attributes. This evolved into Compelling Evidence 3.0 (CE 3.0), designed to clamp down on “first-party misuse” (aka “friendly fraud”). (Visa)

CE 3.0 isn’t just an after-the-fact defense. Visa’s Order Insight pipes merchant order data to issuers in real time so agents can resolve a complaint before a chargeback is filed; Rapid Dispute Resolution (RDR) lets sellers auto-refund certain patterns at the pre-dispute stage. Both tools are Visa products (via Verifi) and exist precisely to keep marginal disputes out of the system. (verifi.com, Visa, Visa Corporate)

Authentication and “liability shift” (3-D Secure)

If a merchant runs 3-D Secure (3DS)—Visa Secure, Mastercard Identity Check—and authentication succeeds (or even is properly attempted in some cases), liability for certain fraud chargebacks shifts from the merchant to the issuer. In other words, a properly authenticated e-commerce transaction usually can’t be charged back as “I didn’t do it,” though disputes for non-fraud reasons can still happen. This liability-shift principle is documented by Visa and Mastercard (and explained clearly by major processors and technical docs). (Visa, Adyen, developers.tabapay.com)

Timelines in practice (credit vs. debit vs. network)

On a credit card, if you send a proper written FCBA notice within 60 days, your issuer must acknowledge within 30 days and finish within two cycles (≤90 days). During that time, they can’t collect the disputed amount or report it late; they can mark it “in dispute.” That’s black-letter FCBA. (Consumer Advice, Consumer Financial Protection Bureau)

On a debit card, once you notify your bank of an unauthorized transfer, it generally has 10 business days to investigate or provisionally credit you, then 45 (sometimes 90) to resolve. If you first gave notice by phone and they require written follow-up within 10 business days but you don’t send it, they may withhold provisional credit while still investigating. Those mechanics are spelled out in Regulation E and CFPB guidance. (Legal Information Institute, Consumer Financial Protection Bureau)

On the network clock, many dispute windows are up to 120 days from the processing or service date, and merchants often get only days to answer once the case lands. Visa and Mastercard manuals drive those windows. (Chargebacks911, Mastercard)

What happens to the merchant (and why it affects you)

Chargebacks are not just a refund; they’re a risk metric. Too many and a business can be placed into monitoring programs with fines and potential processing restrictions. Historically, Visa ran the Visa Dispute Monitoring Program (VDMP) with thresholds such as 0.9% dispute ratio and 100 disputes in a month for “Standard,” and 1.8% and 1,000 for “Excessive.” Visa has been consolidating dispute/fraud oversight for acquirers under VAMP (Visa Acquirer Monitoring Program), but the underlying point remains: disputes are tracked, and high ratios are punished. Mastercard operates an Excessive Chargeback Program and can list merchants in MATCH for persistent problems. Public docs and processor explainers cover those thresholds and changes. (MidMetrics, Stripe Docs, Mastercard)

Why you should care: your good-faith refund request is often faster than a chargeback and doesn’t ding the merchant’s ratio. But if the business stonewalls you—or vanishes—use your legal rights and escalate.

Evidence: what to include in a consumer dispute (and why)

Think like the network. For not received, include order/contract, promised delivery date, tracking scans showing non-delivery or failed delivery, and any merchant promises. For not as described, include the product description, photos, your communication history, and any third-party assessments where relevant. For unauthorized, include when/how you discovered it, how the card was secured, and any police report if there was theft.

Even though consumers don’t submit evidence in “network format,” your issuer will lean on exactly this material when it writes to the merchant’s bank or weighs compelling evidence returned by the seller. Visa’s guideline section on compelling evidence makes clear the kind of artifacts that move the needle (addresses/AVS, device fingerprints, IPs, prior undisputed use). (Visa)

Friendly-fraud versus true fraud

Issuers and networks distinguish true fraud (stolen card or credentials) from first-party misuse (“friendly fraud,” where a cardholder buys and later claims they didn’t). CE 3.0 was introduced specifically to let merchants defeat first-party misuse by proving continuity—same device, same address, same login as prior, undisputed orders—and to deflect those disputes at the pre-dispute stage via Order Insight. Visa’s documentation spells this out. (Visa)

For you as a consumer, the takeaway is simple: if you recognize the merchant and your household used the goods/services, a chargeback isn’t a substitute for a return policy. Networks are increasingly tuned to spot that pattern.

Pre-dispute tools you may encounter

You might hear from your merchant that they “resolved it through Order Insight” or that your bank “confirmed details and closed it.” That’s the pre-dispute layer at work. Order Insight shares order metadata with issuers to reassure confused cardholders. Rapid Dispute Resolution (RDR) auto-refunds in specified scenarios before a chargeback is filed. Ethoca Alerts (a Mastercard company) send near-real-time notices from issuers to merchants so the merchant can stop fulfillment or refund in hours rather than weeks. These tools exist to resolve gray-area disputes quickly. (verifi.com, ethoca.com)

Edge cases that change the rules

3-D Secure-authenticated e-commerce transactions carry a liability shift: if the merchant properly authenticates you, your issuer typically can’t hit the merchant with a fraud reason code on that transaction. You still retain consumer-dispute rights for quality or delivery issues. Documentation across Visa/Mastercard and major PSPs is consistent on this shift. (Visa, developers.tabapay.com)

Digital goods and crypto/NFT purchases: Visa’s June 2024 guidelines explicitly list acceptable compelling evidence for digital downloads (download logs, IP/device) and, newly, for crypto/NFT transactions (destination wallet address, blockchain hash, prior similar approved transactions) to rebut fraud claims. That means these categories are now more “evidenceable” than they were a few years ago. (Visa)

Authorization holds and timing: Mastercard’s rules even define “chargeback protection periods” around authorization types (for example, seven days on many final authorizations) which influence how long funds can be held and what authorization-related disputes can be raised. It’s a reminder that processing details matter. (Mastercard)

Practical playbook: step-by-step, without the headaches

Start with the merchant, in writing, with a concise summary and your ask, and set a response date. If the issue is unauthorized, call your bank immediately and lock the card; Zero Liability policies and Reg E timelines are strict about prompt notice. Visa and Mastercard publish these consumer-facing protections, and CFPB guidance explains the Reg E clocks. (Visa, Mastercard, Consumer Financial Protection Bureau)

Credit card: send a written FCBA letter to the address for billing errors within 60 days of the statement. Keep copies. The issuer must acknowledge within 30 days and resolve in ≤90 days. (Consumer Advice, Consumer Financial Protection Bureau)
Debit card: report quickly; if the bank can’t finish in 10 business days, it generally must provisionally credit you and then has up to 45/90 days to finish. (Consumer Financial Protection Bureau)
If a formal chargeback is already filed, don’t accept “we’ll refund if you drop it” from the merchant. Wait for the refund to post or ask your issuer how to proceed; refunds after disputes can turn into messy double-credit situations and still count against the merchant. (Stripe Docs, Chargeback Gurus)

What “winning” looks like (and the hidden collateral)

A merchant win at representment returns the funds to the merchant and closes the case unless the issuer pushes to pre-arbitration/arbitration. For merchants, too many disputes—won or lost—still hurt, because monitoring programs look at counts and ratios, not just outcomes. Visa and Mastercard publish those programs and thresholds; processors summarize them for merchants because the fees and restrictions are real. (MidMetrics, Mastercard)

A consumer win restores funds (or prevents them from being collected in the first place), and on credit cards it keeps finance charges on the disputed amount off your bill during the investigation window. The legal structure for that is straight from FCBA and CFPB/FTC explainers. (Consumer Advice, Consumer Financial Protection Bureau)

Glossary (plain-English, right where you need it)

Chargeback. A network-run reversal where the issuer pulls funds back from the merchant via the card network after a dispute. It’s not the same as a refund; it carries fees and risk metrics for merchants. (Visa)
FCBA / Regulation Z. The U.S. law and implementing rule that govern credit-card billing errors: 60-day notice, 30-day acknowledgement, ≤90-day resolution, and the right to withhold payment on the disputed amount. (Consumer Advice)
Regulation E. The U.S. rule for debit/ACH error resolution, including 10-day investigations, provisional credit, and 45/90-day resolution windows. (Consumer Financial Protection Bureau)
Reason code. A label the networks use to categorize the dispute (fraud, not received, processing error, etc.). Visa’s Condition 10.4 is the classic card-not-present fraud code; Mastercard uses codes like 4837 for “No Cardholder Authorization.” (Chargeback Gurus, developers.tabapay.com)
Compelling Evidence (CE 3.0). A Visa framework that lets merchants defeat “first-party misuse” by showing continuity across prior undisputed transactions (same login, device, address, IP, etc.), ideally at pre-dispute via Order Insight. (Visa)
3-D Secure (3DS) / Liability Shift. An authentication protocol for online card payments (Visa Secure, Mastercard Identity Check). When it succeeds, liability for many fraud disputes shifts from the merchant to the issuer. (Visa)
Order Insight / RDR / Ethoca Alerts. Pre-dispute tools: Order Insight shares order details with issuers; RDR lets sellers auto-accept liability and refund before a chargeback; Ethoca Alerts notify merchants in near real time so they can refund or stop fulfillment quickly. (verifi.com, ethoca.com)
Zero Liability. Brand policies (Visa/Mastercard) promising no consumer responsibility for unauthorized usage when issuer conditions are met. These are separate from legal rights under FCBA/Reg E but often operate in parallel. (Visa, Mastercard)

Sources & notes (public, accessible)

Visa — Dispute Management Guidelines for Visa Merchants (June 2024). This is the primary reference for dispute flows, reason codes, and Compelling Evidence examples, including CE 3.0 attributes and special rules for digital goods and crypto/NFT transactions. (Visa)
Visa — Visa Core Rules and Visa Product and Service Rules (Apr 2025 edition). Baseline operating rules for participants. (Visa)
Mastercard — Chargeback Guide—Merchant Edition (May 13, 2025) and Transaction Processing Rules (Jun 10, 2025). Covers reason codes, case stages, and authorization-related protection periods. (Mastercard)
CFPB / FTC — FCBA/Reg Z and Reg E timelines and consumer rights: 60-day written notice, 30-day acknowledgement, ≤90-day resolution (credit); 10-day investigation, provisional credit, 45/90-day resolution (debit). (Consumer Advice, Consumer Financial Protection Bureau)
Visa & Mastercard — Zero Liability consumer policies (what issuers promise for unauthorized activity). (Visa, Mastercard)
3-D Secure / Liability Shift — Visa/Mastercard materials and processor docs explaining when fraud liability moves to the issuer after successful authentication. (Visa, Adyen)
Pre-dispute solutions — Visa/Verifi Order Insight and RDR, and Mastercard Ethoca Alerts, which resolve issues before chargeback and reduce merchant ratios. (verifi.com, Visa Corporate, ethoca.com)
Monitoring/thresholds — Public summaries of Visa’s historic VDMP thresholds and Mastercard’s Excessive Chargeback/MATCH programs (useful context for why merchants care deeply about disputes). (MidMetrics, Mastercard)