A chargeback is the forced reversal of a card payment. The cardholder complains to the bank that issued the card, the bank pulls the money back from the merchant's bank, and the merchant either accepts the loss or argues its case under rules written by the card network. It exists because a card payment, unlike cash, passes through intermediaries that can undo it. US law made banks responsible for correcting billing errors in the 1970s, and Visa and Mastercard built the reversal machinery that carries out that duty across millions of merchants.

The mechanism was designed as consumer protection. It has become a cost centre for online merchants, a fraud vector in its own right and, as of November 2026, an unresolved question for purchases made by AI agents.

How a chargeback moves through the system

Four parties sit in every card transaction: the cardholder, the issuer (the cardholder's bank), the acquirer (the merchant's bank or payment processor) and the merchant. The network, Visa or Mastercard, sets the rules and routes the messages between the two banks.

A dispute runs in stages.

  1. Dispute filing. The cardholder contacts the issuer, usually through a banking app. The issuer assigns a reason code describing the complaint. Under Visa's rules, codes fall into four categories: fraud (10.x), authorisation (11.x), processing errors (12.x) and consumer disputes (13.x). Code 10.4, fraud in a card-absent environment, is the one most online merchants see. Mastercard uses four-digit codes, such as 4837 for a transaction the cardholder says was not authorised and 4853 for goods or services not as described.
  2. Provisional credit and debit. The issuer typically credits the cardholder while the case runs. The network then moves the disputed amount from the acquirer to the issuer, and the acquirer debits the merchant, usually adding a fee. Processor fees commonly range from about $15 to $100 per dispute.
  3. Representment. The merchant can accept the loss or submit evidence: delivery confirmation, login records, IP addresses, device identifiers, terms of service, prior correspondence. The acquirer forwards this to the issuer.
  4. Pre-arbitration and arbitration. If the issuer rejects the evidence, the case can escalate. At the final stage the network itself rules, and the losing side pays an arbitration fee that can run to several hundred dollars.

Deadlines frame each step. Visa generally gives issuers 120 days from the transaction processing date to raise most disputes, with longer windows for goods never delivered. Merchants get far less time to respond, often 20 to 30 days depending on the network and the processor's own internal cut-off.

The chargeback is distinct from the money itself. A merchant that wins a dispute receives the funds back, but rarely the fee, and every dispute counts against its ratio with the network whatever the outcome.

Origin and evolution

The legal root is American. The Truth in Lending Act of 1968 was amended in 1970 to cap a consumer's liability for unauthorised credit card use at $50. The Fair Credit Billing Act, signed in October 1974, went further: it obliged card issuers to investigate billing errors that a consumer reported in writing within 60 days of the statement, and allowed consumers to withhold payment while the dispute ran. The Electronic Fund Transfer Act of 1978 and its Regulation E did the equivalent for debit cards, with liability tiers of $50 and $500 depending on how quickly a loss was reported.

Neither law used the word chargeback. The networks turned the legal obligation into a commercial one: if the issuer had to make the cardholder whole, it would recover the money from the merchant's side of the transaction. Network rules extended the process well beyond what statute required, to non-US cards and to complaints about quality or non-delivery.

Two changes reshaped the system in the past decade. In April 2018 Visa introduced Visa Claims Resolution, which collapsed dozens of reason codes into the four categories above and let issuers resolve some disputes automatically using transaction data. Then, on April 15, 2023, Visa's Compelling Evidence 3.0 rules took effect. Under CE3.0, a merchant facing a code 10.4 fraud claim can point to at least two earlier transactions on the same card, made between 120 and 365 days before the disputed one and never disputed, that share at least two data elements with it. One of those elements must be the IP address or device ID. If the match holds, liability shifts back to the issuer, according to Visa.

Mastercard followed a different route. Its First-Party Trust programme lets merchants share purchase data with issuers before a dispute becomes a chargeback, and was expanded globally in 2025, according to PYMNTS.

Monitoring was overhauled too. In April 2025 Visa replaced its separate fraud and dispute monitoring programmes with the Visa Acquirer Monitoring Program (VAMP), which adds fraud reports and disputes together and divides them by settled card-not-present transactions. Merchants above the "excessive" threshold, initially 2.2% with a minimum of 1,500 qualifying events in a month, face per-dispute fines passed down by their acquirers. Visa scheduled the threshold to tighten to 1.5% in 2026 and has revised the programme's details several times since launch, so the level a given merchant faces depends on region and date.

Why it matters to marketers

Chargebacks sit downstream of every paid acquisition campaign that ends in a card payment. Three effects reach marketing teams.

First, reported revenue overstates real revenue. A conversion pixel fires at checkout. A chargeback 60 or 90 days later rarely flows back into the ad platform unless the merchant uploads a conversion adjustment, so return on ad spend calculated in-platform includes sales that were later reversed. Offers that attract impulse buyers, free trials that roll into subscriptions and aggressive discounting all tend to raise dispute rates.

Second, dispute ratios can shut down a sales channel. A merchant flagged under VAMP or Mastercard's Excessive Chargeback Program can be fined, pushed onto a higher-risk processor or lose card acceptance altogether. Subscription businesses are especially exposed. The FTC's case against Match Group, which settled for $14 million, included allegations about how the company treated users who disputed charges.

Third, platforms that host checkout carry dispute handling. When Meta phased out checkout on Facebook and Instagram Shops by August 2025, returns and chargebacks moved back to merchants' own sites. Scam shops advertised on social platforms, such as the operation behind a plush cow toy that became one of Instagram's most profitable scams, leave victims with a chargeback as their main route to recovery.

Advertisers can also be on the other side. Ad platforms bill by card, and Google publishes its own process for disputing Google Ads charges, separate from a bank chargeback. Payment problems also feature among the grounds for Google's billing and payment suspensions.

Limitations and disputes

The central dispute concerns friendly fraud, a contested label for chargebacks filed by the genuine cardholder for a purchase they made. Merchants and dispute-management vendors use the term for buyers who receive goods and then claim fraud. Consumer advocates object that the phrase treats confused customers, unrecognised billing descriptors and forgotten subscriptions as dishonesty. Visa now prefers "first-party misuse". The Federal Reserve Bank of Atlanta has described first-party fraud as one of the hardest categories for payment firms to measure, partly because intent is hard to prove.

Estimates of its scale vary widely and mostly come from vendors that sell dispute services. Mastercard's 2025 research projected global chargeback volume rising from about 261 million in 2025 to 324 million by 2028, according to Mastercard. Figures for the share caused by first-party misuse range from under half to more than three-quarters depending on the survey, and few are independently audited.

Merchants also argue that the system is asymmetric. Issuers decide whether to accept evidence, merchants pay fees even when they win, and representment win rates reported by industry surveys are commonly below half. Issuers respond that they bear regulatory obligations to cardholders that merchants do not.

A further limitation is scope. Chargebacks exist only where card network rules apply. Bank transfers, most real-time payment schemes and cryptocurrency transactions have no equivalent, which is one reason fraudsters push victims towards them.

What chargeback is not

  • Refund. A refund is initiated by the merchant, voluntarily, and carries no network fee or ratio impact. A chargeback is imposed by the issuer.
  • Reversal or void. An authorisation reversal cancels a payment before it settles. A chargeback undoes a settled transaction.
  • Section 75 claim. In the UK, Section 75 of the Consumer Credit Act 1974 makes the card issuer jointly liable with the merchant for credit card purchases between GBP100 and GBP30,000. It is a statutory claim against the issuer, separate from the network chargeback process, though issuers often use chargebacks to recover the cost.
  • Ad platform refunds for invalid traffic. Credits issued by Google, Meta or Amazon for invalid clicks are internal adjustments between advertiser and platform, not card disputes.

Recent developments

The pressing question in late 2026 is how chargebacks apply when software, rather than a person, presses the buy button. Visa has been building payment infrastructure for AI agents to shop on a consumer's behalf, and Mastercard has bet that future payments will run through AI agents. Both networks have introduced agent identification schemes, Visa's Trusted Agent Protocol and Mastercard's Agent Pay, designed to let merchants recognise legitimate agents.

Dispute rules have lagged. Existing reason codes assume a cardholder either authorised a purchase or did not; an agent that buys the wrong item on a valid instruction fits neither. Research covered by PPC Land found that AI agent purchases and fraud can look identical to merchant systems. Some sellers have chosen exclusion: United banned AI agents from buying its tickets, seats and upgrades.

Banks are automating their own side. Salesforce released AI tools to help banks resolve transaction disputes faster, part of a wider shift that could make filing a dispute easier for cardholders and, merchants fear, raise volumes further.

Timeline

  • October 26, 1970 - Truth in Lending Act amendment caps consumer liability for unauthorised credit card use at $50.
  • October 28, 1974 - Fair Credit Billing Act signed, creating the 60-day billing-error dispute right.
  • November 10, 1978 - Electronic Fund Transfer Act signed, later implemented through Regulation E for debit transactions.
  • April 2018 - Visa Claims Resolution launches, consolidating reason codes into four categories.
  • April 15, 2023 - Visa Compelling Evidence 3.0 takes effect.
  • April 2025 - Visa Acquirer Monitoring Program replaces Visa's separate fraud and dispute monitoring programmes.
  • April 2025 - Mastercard announces Agent Pay.
  • 2025 - Mastercard expands First-Party Trust globally.
  • October 2025 - Visa introduces Trusted Agent Protocol.

Summary

Who: Cardholders, issuing banks, acquiring banks and merchants, under rules set by card networks such as Visa and Mastercard.

What: A forced reversal of a settled card payment, initiated by the cardholder's bank and resolved through reason codes, evidence and, if needed, network arbitration.

When: Rooted in US consumer credit law of 1970 to 1978, restructured by Visa in 2018 and 2023, with monitoring overhauled in 2025 and agent purchases unresolved as of November 2026.

Where: Wherever card networks operate, most acutely in card-not-present ecommerce and subscriptions.

Why: To protect consumers from errors and fraud by letting banks undo payments, at a cost that falls mainly on merchants and that now shapes how online sales, subscriptions and AI-agent purchases are designed.