How to avoid chargebacks in your e-Commerce?
- Chargeback: operational guide to prevent and dispute chargebacks in your business
- What is a chargeback and why it defines the profitability of your business today
- The real impact of chargebacks on conversion, cash flow, and margin
- Technical architecture: how a chargeback works behind the scenes
- Regulatory compliance: PSD2, PCI DSS, 3D Secure, and the new Visa VAMP program
- Chargeback in action: use cases by sector
- Action plan: 7 controls to reduce chargebacks this week
- Professional acquiring versus generic models
- Sources and related readings
Chargeback: operational guide to prevent and dispute chargebacks in your business
Every month, numerous merchants in Spain exceed the maximum threshold of 0.9% in their monthly chargeback ratio, the operational limit established by card schemes. This financial risk is global and growing: Visa alone recorded 11 billion dollars in disputes in the US during the last fiscal year, an upward trend that directly impacts the European market.
This guide is built from real acquiring operations, with European regulatory backing (PSD2, PCI DSS v4.0) and oriented toward immediate decisions regarding your dispute flow. By the time you finish reading this guide, you will perfectly understand the following:
- What a chargeback is and how it differs from a refund or a reversal.
- The complete technical flow of a chargeback, from the claim to arbitration.
- The new Visa VAMP program and what it implies for your business.
- An action plan with specific controls to reduce chargebacks this very week.
What is a chargeback and why it defines the profitability of your business today
A chargeback is the reversal of a card payment initiated by the issuing bank following a claim by the cardholder. Unlike a voluntary return, the merchant does not decide: the money leaves their account automatically and they must justify the validity of the transaction to recover it.
The mechanism was designed by Visa and Mastercard to protect consumers against fraud, errors, or breaches of contract. In practice, the merchant is considered liable until proven otherwise. According to industry data, approximately 75% of disputes correspond to friendly fraud: the cardholder received the product but claims anyway.
Chargeback, refund, and reversal: comparative table
| Concept | Who initiates it | Timing | Cost for the merchant | Merchant control |
|---|---|---|---|---|
| Reversal (void) | Merchant | Before settlement (D1) | Zero or minimal | Total |
| Refund | Merchant | After settlement (D2+) | Processing fees | Total |
| Chargeback | Issuer (cardholder's bank) | Risk exposure period according to card scheme regulations. Up to 120 days after the operation | Amount + dispute fee + potential arbitration | None until the representment phase |
The real impact of chargebacks on conversion, cash flow, and margin
Every euro of fraud ends up costing the merchant between 3.5 times its value when administrative costs, loss of product, dispute fees, and potential arbitration fees (around 500 USD per case) are added.
The effect spreads in three directions. In conversion, a high history of chargebacks causes issuers to reduce the approval rate, and legitimate customers see their payments rejected. In cash flow, each chargeback withdraws funds preventively for 30 to 90 days. In the relationship with the processor, exceeding thresholds triggers monitoring programs with progressive fines. Since 2025, Visa has tightened these controls with the VAMP program, which we detail later.
Technical architecture: how a chargeback works behind the scenes
The process involves five actors: cardholder (claims), issuer (launches the dispute), acquirer (channels the process), payment facilitator (manages communication with the merchant), and card scheme (defines rules and arbitrates). Understanding the role of each is key to knowing at what moment you can intervene and with what tools.
Complete flow of a chargeback
- The cardholder submits the dispute to the issuer: unrecognized charge, product not received, or non-compliant service.
- The issuer validates the reason and sends the dispute to the acquirer.
- The acquirer notifies the merchant with the reason, deadlines, and required evidence format.
- The merchant decides: accept the chargeback or submit evidence (representment).
- The acquirer checks the evidence and forwards it to the issuer.
- The issuer reviews and decides: maintain the chargeback or resolve in favor of the merchant.
- If it persists, the case escalates to pre-arbitration and, without agreement, to scheme arbitration with costs assigned to the losing party.
In the diagram, you can clearly see how the chargeback process works in acquiring.
If the evidentiary base is weak (without strong authentication or proof of delivery), accepting the chargeback on time can save you arbitration costs and preserve your relationship with the issuer. Not all disputes deserve to be fought to the end.Regulatory compliance: PSD2, PCI DSS, 3D Secure, and the new Visa VAMP program
Directive (EU) 2015/2366 (PSD2), transposed in Spain via Royal Decree-law 19/2018, requires strong customer authentication (SCA) for most electronic payments. 3D Secure 2.0 is the most widespread channel for meeting this requirement. When authentication is successfully completed, the liability for fraud shifts from the merchant to the issuer, providing the most powerful protection against chargebacks for unauthorized transactions.
VAMP: the new Visa framework tightening thresholds since 2025
Since April 2025, Visa has consolidated its previous monitoring programs (VDMP and VFMP) into a single framework called VAMP (Visa Acquirer Monitoring Program). The most relevant change for merchants is that the new VAMP ratio combines fraud alerts (TC40) and disputes (TC15) into a single metric, meaning a dispute linked to fraud can count twice in the calculation. This significantly raises the ratio for many merchants who previously stayed within limits.
The effective application of fines began in October 2025, with thresholds set to tighten again in April 2026. Mastercard maintains its ECP program with two levels (ECM and HECM). In practice, acquirers are passing even stricter requirements than the official ones to their merchants to keep their global portfolio ratio under control. Knowing these rules is not optional: it is an operational necessity.
Controls that directly reduce chargebacks
- Tokenization (PCI DSS v4.0): replacing the PAN with a token reduces compliance scope and protects data in the event of a security incident.
- AVS/CVV verification: adds trust signals for the issuer and strengthens your position in case of a dispute.
- Blocklists and velocity controls: limiting attempts per card, amount, and frequency detects stolen card testing patterns.
- Hybrid monitoring: combining deterministic rules with human review for high-value operations improves detection without increasing false positives.
Chargeback in action: use cases by sector
E-commerce
The most frequent chargebacks are for merchandise not received and non-compliant products. An electronics merchant sending packages worth over 200 EUR without a delivery signature loses disputes for "product not received", even when the carrier confirms delivery on their portal. The signature turns that case into a winning defense.
Digital services and subscriptions
Unprocessed cancellations and unrecognized recurring charges are the main challenge. Platforms that charge automatic renewals without prior notice generate disputes for "unrecognized charge". Chargeback prevention involves sending reminders 48-72 hours before each payment and offering accessible cancellation from day one. In the diagram, you can see the functioning of recurring payments and the essential phase for detecting a chargeback.
Tourism and hospitality
A hotel that charges a late cancellation penalty but fails to prove the customer accepted the policy loses the representment. Documenting explicit acceptance with a timestamp and keeping service usage records (check-in, consumption) is the basis of the defense.
Action plan: 7 controls to reduce chargebacks this week
- Review your billing descriptor with your processor: ensure it is recognizable and includes a contact phone number or URL.
- Activate 3D Secure 2.0 with exemptions. SCA when risk requires it, exemptions (low value, TRA) where appropriate.
- Standardize evidence collection from day one: tracked delivery, terms accepted with timestamps, usage logs.
- Configure alerts for every dispute. The response window is usually 7-10 days. Missing the deadline is equivalent to losing the case.
- Offer a refund before it escalates. An accessible and fast support channel is the first defense against friendly fraud.
- Activate velocity controls and blocklists by card, IP, and device.
- Measure monthly your chargeback rate by reason, BIN number, and issuer. Adjust rules before the ratio approaches the threshold.
Professional acquiring versus generic models
A generic processor offers a standard notification flow and little else. A professional acquiring model provides three specific advantages: a dispute team that acts as a quality filter verifying evidence before sending it to the issuer, integrated prevention from merchant onboarding with limits and standards adapted to the vertical, and a balance between SCA and conversion by applying exemptions where regulations allow. Coordination between the merchant, payment facilitator, and regulated premium acquirer turns regulation into a competitive advantage rather than an operational burden that slows down sales.
Professional chargeback management is a direct indicator of the operational health of any business accepting card payments. At PayOk, we optimize the dispute flow for merchants across all verticals while complying with European regulations. If you need to review your chargeback prevention strategy, contact our team.
Legal and regulatory framework
- Directive (EU) 2015/2366 of the European Parliament and of the Council (PSD2), on payment services in the internal market.
- Royal Decree-law 19/2018, of November 23, on payment services and other urgent financial measures.
- Delegated Regulation (EU) 2018/389, regulatory technical standards for strong customer authentication (RTS SCA).
- PCI DSS v4.0, Payment Card Industry Data Security Standard (PCI Security Standards Council, March 2022).
- EBA/GL/2018/05 Guidelines, on fraud reporting under PSD2 (European Banking Authority).
- Visa Acquirer Monitoring Program (VAMP), effective since April 2025 (Visa Corporate).
Usually between 30 and 90 days. If the case goes to pre-arbitration or arbitration, it can take several more months. Each stage has a fixed response deadline, and if you miss it you will usually lose the dispute.
Successful 3D Secure authentication, matching AVS and CVV checks, proof of delivery with tracking and signature, timestamped acceptance of your terms, service usage logs, and messages showing you offered a solution before the dispute. For Visa fraud disputes, Compelling Evidence 3.0 also lets you use earlier undisputed purchases by the same customer as proof.
VAMP (Visa Acquirer Monitoring Program) replaced VDMP and VFMP in April 2025. It combines fraud reports and disputes into a single ratio over your card-not-present sales. Fees have applied since October 2025, and since April 2026 the merchant threshold in the EU is 1.5% (previously 2.2%). Merchants above it pay around 8 USD per disputed or fraudulent transaction, and your acquirer may apply stricter limits of its own.
No, not for all of them. PSD2 requires Strong Customer Authentication (SCA) for most online card payments in the EEA, and 3D Secure is how it is applied. Exemptions include low-value payments (up to 30 EUR, with cumulative limits), later payments in a recurring series of the same amount, trusted beneficiaries and transaction risk analysis (TRA). Merchant-initiated transactions and MOTO payments fall outside the SCA requirement.
Yes. If the name on the customer's bank statement doesn't match your store name, many customers won't recognise the charge and will dispute it. Ask your processor for a clear descriptor with your trade name and a phone number or website.
Was this post useful?
1 of 1 I found it useful
Leave a Comment
Ready to get started?
Create your PayOk account in minutes. No maintenance fees, pay per transaction.