How Chargebacks Work

A chargeback is not a refund. It is a forced reversal: the card network pulls money back from your account because a cardholder disputed a transaction, usually without telling you first.

If a notice has just landed in your portal, the amount at stake and the evidence you already hold should decide whether you accept the loss or contest it. The deadline is short, so establish both before preparing a response.

Chargebacks at a Glance

A cardholder rings their bank to dispute a transaction. The bank raises a chargeback, your acquirer debits your account, and a notice arrives in your portal with a reason code, the disputed amount, and a deadline. The money has gone before you have read the email.

The reason code determines what evidence you need and whether the dispute can realistically be won. Evidence that does not answer that code gives the issuer no reason to reverse the chargeback, however persuasive the rest of your case may look.

Three outcomes are possible:

• You accept the chargeback and absorb the loss.
• You fight it through representment and win. Funds come back.
• You fight it and lose. You pay the disputed amount plus the fees.

Even winning costs you something. With Stripe, the initial £20 dispute fee is non-refundable regardless of outcome. Fighting a £30 transaction does not pencil out, and that asymmetry is built into how the system is priced.

The UK Chargeback Lifecycle in 2026

Stage 1: Cardholder contacts their bank

It starts with a charge the cardholder wants gone. They ring their bank, flag it in their app, or open a dispute through Visa Resolve Online or MasterCom. The bank opens an investigation. You are not told.

The cardholder usually has 120 days from the transaction date. For physical goods bought online, the clock runs from expected delivery date. If no delivery date was agreed, the cardholder waits 30 days then has 120. For future services (concert ticket, holiday package), the 120 days starts when the service should have happened. The outer scheme cap is 540 days, used in complex deferred-service disputes. Visa authorisation-related codes carry a shorter 90-day window.

A chargeback on a January order can land in your June portal, by which point the fulfilment records may already be archived. If those records cannot be retrieved in time, a filing failure can lose a case that the underlying evidence might have won.

Stage 2: Issuer raises the chargeback

The bank files the chargeback against your acquirer, which reverses the funds and adds the chargeback fee to your settlement statement. All of that happens before you see the notice or have the chance to refund the customer yourself.

Stage 3: You receive the notice

Your processor forwards the chargeback notice to your merchant portal, usually within 3–10 days. The notice carries the reason code, the disputed amount, the cardholder’s stated reason, and a deadline.

This is where merchants lose time they did not know they had spent. A notice you do not act on within the deadline is an automatic loss. Mastercard gives you 45 calendar days; some acquirers trim that to 5–10 days. The portal deadline is the one that matters. Check yours before you need to know.

Stage 4: Accept or fight (representment)

You accept the chargeback, or you fight it through representment. Representment means submitting evidence and a rebuttal letter through your acquirer, who passes it to the issuer for review. You do not deal with the cardholder’s bank directly.

Stage 5: Outcome of representment

If the issuer accepts your evidence, the funds return and the chargeback is reversed. If not, the issuer can file a pre-arbitration claim. Most disputes end here, one way or the other.

Stage 6: Pre-arbitration

For Mastercard, the issuer has 45 days from your representment to file pre-arbitration; you then have 30 days to respond. For Visa, the issuer has 45 days from your first representment to raise it. At this point you can accept the second loss or push it to arbitration. Most merchants accept. The maths rarely supports the alternative.

Stage 7: Arbitration

Arbitration is handled by Visa or Mastercard directly. Slow, filing fees £200–£400+, and the losing party pays scheme costs as well as their own. Most merchants never see this stage. Full lifecycle from dispute to arbitration: 3–6 months. Cases that go the distance usually involve a transaction value that justifies the legal time, not the principle.

Reason Codes: Mastercard and Visa

Reason codes tell you, and your acquirer, exactly what kind of dispute you are dealing with. Your evidence bundle has to address the specific code. A general defence built for the wrong code rarely wins.

Mastercard (4-digit codes)

Mastercard reason codes are mid-consolidation. Several legacy codes are being absorbed into broader categories. In practice: if you receive a chargeback under 4855 (Goods or Services Not Provided), treat it as 4853 for evidence purposes; 4855 is being absorbed into 4853.

Visa (VCR, decimal format)

Visa restructured its reason codes under the Visa Claims Resolution (VCR) framework. Codes are grouped by dispute type. Visa 10.4 is the most common card-not-present fraud code, and the only one where Compelling Evidence 3.0 applies. If you get a 10.4 and have a successful 3DS2 record, your position is straightforward: liability has already shifted to the issuer.

What a Chargeback Actually Costs You

The fee in your merchant agreement is only the starting point, because the lost order, fulfilment work and staff time can cost far more than the processor’s charge.

Take a £200 order that becomes a chargeback you lose. The immediate hit: the reversed £200, the processor dispute fee (£15–£25), and any counter fee if you contested and lost (Stripe: £20, non-refundable unless you won). Then the product itself, manufacturing, stock, packaging, none of which you recover. Shipping and fulfilment, gone. Staff time to review and write the rebuttal: 2–4 hours at your overhead rate. And the customer acquisition spend attached to the order. Spent before the dispute landed.

The LexisNexis 2024 fraud cost study puts the multiplier at £4.61 for every £1 of fraud once you total the operational drag. Industry shorthand: a £200 chargeback you lose is closer to a £900 event in real business impact. That figure changes whether prevention tooling looks expensive or proportionate.

Beyond the per-dispute cost, a rising chargeback ratio drags you into card scheme monitoring programmes with fines attached. Visa’s VAMP charges £6.50 per card-not-present dispute once the Excessive threshold is crossed. At 200 additional disputes per month, that is £1,300 in Visa fees alone, on top of whatever your acquirer is charging. Some acquirers also raise processing rates for merchants flagged in monitoring programmes. The cost stacks.

Chargeback Fees by UK Provider 2026

Stripe fees: initial dispute fee non-refundable; counter fee refunded only on a full win. If Stripe rules a partial amount in your favour, the counter fee still applies in full. Source: chargebackgurus.com/blog/stripe-dispute-fees (updated post June 2025). PayPal: fee waived for transactions covered by Seller Protection. Square: no dispute fee; only standard processing fee applies.

Chargeback Ratio Thresholds and What Happens When You Cross Them

Mastercard ECP

Mastercard’s Excessive Chargeback Programme has two tiers. Both require you to exceed both count and ratio in a single calendar month.

ECM (Excessive Chargeback Merchant): 100–299 chargebacks AND a 1.5% chargeback ratio. Fines start at £800/month from month 2, rise to £4,000/month at months 4–6, and escalate to £80,000/month for long-term non-compliance. A merchant with 350 chargebacks at 1.2% is not in ECM. A merchant with 105 chargebacks at 2.0% is.

HECM (High Excessive Chargeback Merchant): 300+ chargebacks AND 3.0% ratio. Higher fines, faster escalation.

Exit requires staying below the threshold for 3 consecutive months. A quarter where prevention has to actually work, not just look like it.

Visa VAMP

Visa retired the VDMP and VFMP on 31 March 2025. VAMP (Visa Acquirer Monitoring Programme) replaced both, and operates differently. It monitors primarily at acquirer level, but merchants who exceed thresholds trigger enforcement against their acquirer, which flows back to the merchant.

From April 2026, the Excessive merchant threshold for the UK is 1.5% with 1,500+ TC40/TC15 cases per month. That is a material reduction; the threshold was 2.2% until March 2026. Merchants operating at 1.7–2.1% who thought they were comfortable are now in the Excessive category, often without anyone telling them in advance.

The fine: £6.50 per card-not-present dispute once the threshold is exceeded. First-time identification includes a 3-month grace period. For a merchant generating 200 excess disputes per month, that is £1,300 in Visa fees on top of acquirer fees.

When VAMP triggers, the acquirer takes the primary enforcement notice. Acquirers typically demand a remediation plan within 15 days, may raise reserve requirements, and can restrict or close accounts in serious cases. What your specific acquirer will do is rarely in the merchant agreement. Worth asking before you need to know.

Friendly Fraud vs Criminal Fraud

Criminal fraud and friendly fraud can produce similar disputes while requiring different evidence. Treating a stolen-card purchase like a customer denying their own order weakens the response before it reaches the issuer.

Criminal fraud means a stolen card or a compromised account. The cardholder genuinely did not make the purchase. Your exposure depends on authentication. If 3DS2 was used and authenticated the transaction, liability shifts to the issuer and you are largely covered. Without 3DS2 on a card-not-present transaction, the dispute is yours alone, and the evidence usually does not exist.

Friendly fraud is a cardholder who made the purchase disputing it anyway. Three recognisable sub-types, each with a different fix:

Deliberate misuse. The buyer receives the goods, decides they want the money back, and files a dispute knowing the claim is false. UK fraud prevention research suggests 1 in 4 UK consumers have done this at least twice. CE 3.0 and Mastercard FPT exist to counter this, by requiring you to prove the cardholder was present at prior undisputed transactions. The tools work; the data has to be in place before the dispute arrives.

Descriptor confusion. A customer buys a £45 item through your online shop in March. In April, their statement shows “GLOBALMERCHSVCS REF 4892”, not your brand. They do not recognise it. They ring the bank in good faith. No malice, no need. One of the most preventable chargeback categories in the system, and the fix is a single config change: set your billing descriptor to your trading name. Merchants pay for this every month because nobody got round to it.

Forgot-I-subscribed. A customer signs up after a free trial, the plan converts to paid, and six months later they dispute a charge they technically agreed to but do not remember. Not deliberate misuse. Produces the same reason code as if it were.

Industry sources put friendly fraud at roughly 45% of all chargebacks, with the share higher in digital goods, subscriptions, and fast-moving e-commerce. First-party fraud grew from 15% to 36% of reported fraud between 2023 and 2024. The rise is not because more people are dishonest. It is because more people know the dispute option exists and how easy it is to use.

The distinction matters for your evidence strategy. Deliberate misuse is where CE 3.0 and FPT are your strongest tools. Descriptor confusion is fixed by changing your billing descriptor. Forgot-I-subscribed is addressed by pre-charge reminder emails and a cancellation flow that does not punish the customer for trying to use it.

How to Win Representment in 2026

The average merchant wins 20–30% of chargebacks they contest [editorial judgement based on industry source aggregates; no independently verified UK-specific benchmark exists]. Merchants who assemble reason-code-aligned evidence across three or more categories win at higher rates. With a 3DS2 authentication record on a fraud dispute, win probability is substantially higher because liability has already shifted to the issuer.

Step 1: Check your 3DS2 record first

If the dispute is fraud-related (Visa 10.4, Mastercard 4837/4863) and your checkout used 3DS2 successfully, pull the authentication response code and ECI value. That record shifts liability to the issuer for most card-not-present fraud scenarios. Lead with it.

Step 2: Match the evidence to the reason code

Your rebuttal letter and evidence have to address the specific code. A general evidence pack built for the wrong code signals that your core case is thin.

For fraud disputes (Visa 10.4, Mastercard 4837): 3DS2 authentication record; AVS match confirmation; CVV verification; IP geolocation; device fingerprint; prior undisputed transactions from the same device or card credential (required for CE 3.0).

For goods not received (Visa 13.1, Mastercard 4853): Carrier tracking with delivery confirmation; GPS or photo proof of delivery (both schemes now accept carrier GPS data as compelling evidence); signed delivery receipt where available; shipping confirmation email to the cardholder.

For not as described (Visa 13.3, Mastercard 4853): Product description and images at time of purchase; accepted terms at checkout; photos of dispatched goods; full customer service communication history.

For cancelled recurring (Visa 13.2, Mastercard 4853/4841): Proof the cardholder did not cancel at least 15 calendar days before the disputed charge; timestamped login and usage activity; billing terms disclosed at checkout; cancellation policy accessible and screenshotted.

Step 3: Write a clear rebuttal letter

A clear rebuttal letter follows the reason code, presents the relevant evidence in a logical order and ends with the outcome you are seeking. Leave unrelated material out: it makes the issuer work harder to identify the evidence that actually answers the dispute.

Step 4: Submit before your acquirer’s deadline, not the scheme deadline

If your acquirer says 10 days, you have 10 days. The scheme rule is irrelevant when your acquirer holds the gate.

The economics of whether to fight

Not every chargeback is worth contesting. With Stripe, the £20 initial dispute fee is non-refundable even if you win, so a £30 disputed transaction where you prevail recovers £30 but costs you £20 plus staff time. Not an economics case. A principle case.

A rough frame: under £20, rarely worth contesting on cost grounds. £20–£100, worth fighting only with strong evidence (3DS2 fraud record: yes; fraud without 3DS2: probably not). Over £100, worth contesting in almost all cases where evidence exists. Factor staff time at your real overhead rate, not the optimistic one.

CE 3.0 and Mastercard Collaboration: What Changed

Visa and Mastercard now use transaction data early enough to stop some disputes becoming chargebacks. That makes the information collected before a sale more valuable than a better rebuttal letter written after the money has gone.

Visa CE 3.0

Compelling Evidence 3.0 applies specifically to Visa reason code 10.4. It lets you show that the disputed transaction used the same device fingerprint, IP address, email, or physical address as two prior undisputed transactions from the same cardholder, where those prior transactions took place between 120 and 365 days before the disputed one. At least one matched data point must be an IP address or device ID.

If CE 3.0 is validated, the chargeback is reversed. The dispute still appears in your overall dispute ratio but does not count in your fraud ratio, so it does not drive VAMP escalation.

In October 2025, Visa automated issuer-side CE 3.0 validation and improved Order Insight integration. Merchants enrolled in Order Insight can deflect disputes before they become chargebacks. The cardholder’s bank sees transaction detail in their app; if the cardholder recognises the purchase, the dispute is abandoned before it is ever formally raised.

In practice: CE 3.0 is a data-collection discipline, not a dispute tactic. The merchant who benefits is the one who stores device ID, IP address, and email at every checkout, keeps that data for at least 13 months, and has enrolled in Order Insight. None of that can be done retrospectively after a dispute lands.

Mastercard First-Party Trust

Mastercard’s equivalent expanded globally, including the UK, in June 2025. FPT works on similar principles: prior transaction evidence across three categories (Device Identity, Delivery Factor, Additional Identity Factor) shows the disputed transaction was legitimate.

FPT also operates in a pre-dispute mode through Consumer Clarity. If enrolled, the issuer queries your records before raising a chargeback. If the data matches, the dispute is deflected.

Early programme data shows FPT deflection rates of approximately 3.8% of enrolled transactions over the first 60 days. Participants combining FPT with increased 3DS usage report fraud ratios dropping to levels that clear the EFM four-part trigger threshold.

The operational step is the same as CE 3.0: ask your acquirer or payment platform whether they support Order Insight (Visa) and Consumer Clarity (Mastercard). If they do, enrol. If they do not, raise it at your next contract review.

Subscription and Recurring Billing Chargebacks

Subscription chargebacks often turn on whether the customer recognised the payment, understood the renewal and could cancel without obstruction. Your evidence needs to answer the failure that actually triggered the dispute.

Descriptor confusion is the single most preventable cause. Your checkout shows your brand. Three months later, the statement shows the name of your payment processor or legal entity. The cardholder disputes in good faith. Fix: set your billing descriptor to your trading name. Check what appears on a test transaction before launch, not after disputes start arriving.

Forgot-I-subscribed accounts for a large share of 13.2 and 4853 disputes on subscription businesses. A free trial that converts automatically to a paid plan, where the first paid charge appears six months after sign-up, is a reliable source of disputes. Fix: a reminder email 3–5 days before the first paid charge, clearly branded, showing the amount, with a prominent cancellation link.

Difficult cancellation is a dispute engine. If a customer cannot cancel without phoning support or clicking through a three-step confirmation flow, they ring the bank instead. UK regulatory direction, including FCA Consumer Duty expectations, runs consistently towards cancellation being as accessible as sign-up. A hard-to-cancel flow does not save revenue. It moves it from “subscriber” to “chargeback” on the same statement line.

SCA and recurring transactions in the UK

UK PSD2 requires Strong Customer Authentication (SCA) at sign-up: 2-factor authentication for the first transaction. Subsequent recurring charges qualify as merchant-initiated transactions (MIT) and can run without re-authentication, provided the initial SCA was captured properly and recurring billing was clearly disclosed at sign-up.

If your original checkout did not capture SCA properly, or did not clearly disclose recurring billing, your MIT exemption is on uncertain ground. Chargebacks on those charges are harder to defend, and the issue surfaces months after the checkout went live.

Evidence for recurring billing disputes

Proof the cardholder did not cancel at least 15 calendar days before the disputed charge is the standard for most recurring billing representments. Combine with timestamped login and usage activity, checkout screenshots showing billing terms and frequency, and any renewal reminder emails sent before the charge.

Subscription businesses are well placed for CE 3.0 and FPT: regular billing accumulates prior undisputed transaction data faster than almost any other model. A 12-month subscriber has given you 12 prior undisputed transactions on the same card credential. Solid CE 3.0 base, provided you have stored the device and IP data alongside it.

How to Reduce Chargebacks in the First Place

Prevention compounds. A 0.3% ratio is not just cheaper than 1.5%. It avoids monitoring programme risk entirely.

Fix your billing descriptor. Customers need to recognise your name on their statement. Check what yours shows. If it is your parent company or a processor ID abbreviation rather than your trading name, change it this week. Single fix; meaningful share of descriptor-confusion disputes gone.

Use 3DS2 on all card-not-present transactions. 3DS2 shifts fraud chargeback liability to the issuer on authenticated transactions. The checkout friction is real; some customers drop off. For any merchant with a meaningful fraud chargeback rate, the liability protection outweighs the conversion cost. For very low-risk merchants with near-zero fraud, the trade-off is less clear.

Collect and store CE 3.0-eligible data at checkout. Store IP address, device fingerprint, and email at every transaction. Keep for at least 13 months. Groundwork for CE 3.0 and FPT, and it cannot be assembled after the dispute arrives.

Communicate proactively before recurring charges. A reminder email 3–5 days before a subscription renewal, with amount, brand, and a clear cancellation link, deflects a meaningful share of friendly fraud disputes before they start. The cardholder who cancels after the reminder does not become a chargeback.

Make refunds faster than chargebacks. A customer who gets a refund within 24 hours rarely files a dispute. One who waits 10 days and cannot reach support rings their bank instead. Speed on genuine complaints is the cheapest chargeback prevention you will ever buy.

Review your reason code breakdown monthly. Your acquirer portal shows reason code distribution. If 40% of your disputes are 13.1 (goods not received), you have a fulfilment or communication problem. If 30% are 10.4 (fraud), you have an authentication problem. The breakdown tells you which lever to pull. The aggregate does not.

Watch the ratio, not just the count. Fifty chargebacks across 5,000 monthly transactions is 1.0%, well inside threshold. The same 50 across 200 transactions is 25%, and a different conversation with your acquirer is incoming. The ratio triggers monitoring programmes. Know yours.

Frequently Asked Questions

How long do I have to respond to a chargeback?

The card scheme deadline is 45 calendar days for Mastercard and approximately 30 days for Visa from when you receive the chargeback notice. In practice, your acquirer sets its own internal deadline, often considerably shorter, some 5–10 days. The countdown on your portal is the deadline you need to track. An uncontested chargeback is an automatic loss.

Will I get my chargeback fee back if I win?

Depends on the provider and which fee. With Stripe, the initial £20 dispute fee is non-refundable even if you win. The separate £20 counter fee, charged when you choose to contest, is refunded only on a full win. Worldpay and PayPal generally do not refund the handling fee regardless of outcome. Square charges no dispute fee at all. Adyen, Dojo, SumUp, Teya, and Tyl by NatWest do not publicly list their policies. Ask before signing.

Can I pass the chargeback fee on to the customer?

No. Passing chargeback fees on to customers as a penalty charge is not enforceable under UK consumer law, and card scheme rules prohibit dispute-related surcharges. If you believe a customer has committed deliberate friendly fraud, recovery is a civil matter: small claims court for amounts under £10,000. Rarely economic for individual disputes, but it may be relevant if you see a pattern with a repeat customer.

What is a chargeback ratio and why does it matter?

Your chargeback ratio is total chargebacks in a calendar month divided by total transactions in that month, expressed as a percentage. Mastercard’s ECM threshold is 1.5% with 100+ chargebacks. Visa’s VAMP Excessive threshold is 1.5% from April 2026, down from 2.2%. Exceeding either triggers fines and, if persistent, acquirer enforcement that can include account restrictions.

Does 3DS2 protect me from all chargebacks?

No. 3DS2 authentication shifts liability for fraud chargebacks to the issuer when authentication succeeds, so Visa 10.4 and Mastercard 4837 disputes are largely your issuer’s problem when your checkout used 3DS2 properly. It does not protect against goods-not-received, not-as-described, or cancelled-service chargebacks. Those depend on your fulfilment, your communication, and how you handle cancellations.

What is the difference between a PayPal dispute and a chargeback?

A dispute through PayPal’s Resolution Centre runs inside PayPal’s framework first. PayPal gives both parties a window to resolve it directly. If the case escalates to a PayPal claim, or the cardholder bypasses PayPal and rings their issuer instead, it becomes a standard card scheme chargeback with normal Visa or Mastercard timelines and fees. Two separate fee structures, and the card scheme chargeback supersedes PayPal’s process if both are open at once.

What happens if I exceed the VAMP or ECP thresholds?

Mastercard places you in the ECP, starting with £800/month fines from month 2 and escalating. Under VAMP, Visa charges £6.50 per card-not-present dispute above threshold. In both cases, your acquirer receives the primary enforcement notice and will require a remediation plan, typically within 15 days. Failure to remediate can lead to higher reserve requirements, processing restrictions, or account termination. The card schemes do not contact you directly. Enforcement flows through your acquirer.