Chargeback: operational guide to prevent and dispute chargebacks in your business

Every month, numerous merchants in Spain exceed the maximum threshold of 0.9% in their monthly chargeback ratio, the operational limit established by card schemes. This financial risk is global and growing: Visa alone recorded 11 billion dollars in disputes in the US during the last fiscal year, an upward trend that directly impacts the European market.

What is a chargeback and why it defines the profitability of your business today

A chargeback is the reversal of a card payment initiated by the issuing bank following a claim by the cardholder. Unlike a voluntary return, the merchant does not decide: the money leaves their account automatically and they must justify the validity of the transaction to recover it.

The mechanism was designed by Visa and Mastercard to protect consumers against fraud, errors, or breaches of contract. In practice, the merchant is considered liable until proven otherwise. According to industry data, approximately 75% of disputes correspond to friendly fraud: the cardholder received the product but claims anyway.

Chargeback, refund, and reversal: comparative table

The real impact of chargebacks on conversion, cash flow, and margin

Every euro of fraud ends up costing the merchant between 3.5 times its value when administrative costs, loss of product, dispute fees, and potential arbitration fees (around 500 USD per case) are added.

The effect spreads in three directions. In conversion, a high history of chargebacks causes issuers to reduce the approval rate, and legitimate customers see their payments rejected. In cash flow, each chargeback withdraws funds preventively for 30 to 90 days. In the relationship with the processor, exceeding thresholds triggers monitoring programs with progressive fines. Since 2025, Visa has tightened these controls with the VAMP program, which we detail later.

Technical architecture: how a chargeback works behind the scenes

The process involves five actors: cardholder (claims), issuer (launches the dispute), acquirer (channels the process), payment facilitator (manages communication with the merchant), and card scheme (defines rules and arbitrates). Understanding the role of each is key to knowing at what moment you can intervene and with what tools.

Complete flow of a chargeback

1. The cardholder submits the dispute to the issuer: unrecognized charge, product not received, or non-compliant service.
2. The issuer validates the reason and sends the dispute to the acquirer.
3. The acquirer notifies the merchant with the reason, deadlines, and required evidence format.
4. The merchant decides: accept the chargeback or submit evidence (representment).
5. The acquirer checks the evidence and forwards it to the issuer.
6. The issuer reviews and decides: maintain the chargeback or resolve in favor of the merchant.
7. If it persists, the case escalates to pre-arbitration and, without agreement, to scheme arbitration with costs assigned to the losing party.

In the diagram, you can clearly see how the chargeback process works in acquiring.

Regulatory compliance: PSD2, PCI DSS, 3D Secure, and the new Visa VAMP program

Directive (EU) 2015/2366 (PSD2), transposed in Spain via Royal Decree-law 19/2018, requires strong customer authentication (SCA) for most electronic payments. 3D Secure 2.0 is the most widespread channel for meeting this requirement. When authentication is successfully completed, the liability for fraud shifts from the merchant to the issuer, providing the most powerful protection against chargebacks for unauthorized transactions.

VAMP: the new Visa framework tightening thresholds since 2025

Since April 2025, Visa has consolidated its previous monitoring programs (VDMP and VFMP) into a single framework called VAMP (Visa Acquirer Monitoring Program). The most relevant change for merchants is that the new VAMP ratio combines fraud alerts (TC40) and disputes (TC15) into a single metric, meaning a dispute linked to fraud can count twice in the calculation. This significantly raises the ratio for many merchants who previously stayed within limits.

The effective application of fines began in October 2025, with thresholds set to tighten again in April 2026. Mastercard maintains its ECP program with two levels (ECM and HECM). In practice, acquirers are passing even stricter requirements than the official ones to their merchants to keep their global portfolio ratio under control. Knowing these rules is not optional: it is an operational necessity.

Controls that directly reduce chargebacks

• Tokenization (PCI DSS v4.0): replacing the PAN with a token reduces compliance scope and protects data in the event of a security incident.
• AVS/CVV verification: adds trust signals for the issuer and strengthens your position in case of a dispute.
• Blocklists and velocity controls: limiting attempts per card, amount, and frequency detects stolen card testing patterns.
• Hybrid monitoring: combining deterministic rules with human review for high-value operations improves detection without increasing false positives.

Chargeback in action: use cases by sector

E-commerce

The most frequent chargebacks are for merchandise not received and non-compliant products. An electronics merchant sending packages worth over 200 EUR without a delivery signature loses disputes for "product not received", even when the carrier confirms delivery on their portal. The signature turns that case into a winning defense.

Digital services and subscriptions

Unprocessed cancellations and unrecognized recurring charges are the main challenge. Platforms that charge automatic renewals without prior notice generate disputes for "unrecognized charge". Chargeback prevention involves sending reminders 48-72 hours before each payment and offering accessible cancellation from day one. In the diagram, you can see the functioning of recurring payments and the essential phase for detecting a chargeback.

Tourism and hospitality

A hotel that charges a late cancellation penalty but fails to prove the customer accepted the policy loses the representment. Documenting explicit acceptance with a timestamp and keeping service usage records (check-in, consumption) is the basis of the defense.

Action plan: 7 controls to reduce chargebacks this week

1. Review your billing descriptor with your processor: ensure it is recognizable and includes a contact phone number or URL.
2. Activate 3D Secure 2.0 with exemptions. SCA when risk requires it, exemptions (low value, TRA) where appropriate.
3. Standardize evidence collection from day one: tracked delivery, terms accepted with timestamps, usage logs.
4. Configure alerts for every dispute. The response window is usually 7-10 days. Missing the deadline is equivalent to losing the case.
5. Offer a refund before it escalates. An accessible and fast support channel is the first defense against friendly fraud.
6. Activate velocity controls and blocklists by card, IP, and device.
7. Measure monthly your chargeback rate by reason, BIN number, and issuer. Adjust rules before the ratio approaches the threshold.

Professional acquiring versus generic models

A generic processor offers a standard notification flow and little else. A professional acquiring model provides three specific advantages: a dispute team that acts as a quality filter verifying evidence before sending it to the issuer, integrated prevention from merchant onboarding with limits and standards adapted to the vertical, and a balance between SCA and conversion by applying exemptions where regulations allow. Coordination between the merchant, payment facilitator, and regulated premium acquirer turns regulation into a competitive advantage rather than an operational burden that slows down sales.

Questions merchants ask about the dreaded chargebacks

How long does it take to resolve a chargeback?

The complete process usually lasts between 30 and 90 days. If it escalates to pre-arbitration or arbitration, the period can extend for several months. Speed in the merchant's initial response is decisive in shortening the timeframes.

What evidence is most effective for disputing a chargeback?

Successful 3D Secure authentication results, positive AVS/CVV verification, proof of delivery with tracking and signature, terms accepted with timestamps, service usage records, and communication threads where a solution was offered before the dispute.

What is the Visa VAMP program and how does it affect my business?

VAMP is the new unified Visa framework (effective since April 2025) that consolidates the previous VDMP and VFMP. It combines fraud alerts and disputes into a single ratio, with effective fines since October 2025 and stricter thresholds planned for April 2026.

Is it mandatory to apply 3D Secure to all card payments in Europe?

PSD2 requires SCA for most remote electronic payments in the EEA. There are regulated exemptions: low-value operations (under 30 EUR), recurring transactions, trusted beneficiaries, and transaction risk analysis (TRA).

Can the billing descriptor cause chargebacks for unrecognized charges?

Yes. If the name appearing on the cardholder's bank statement does not match the store's trade name, the probability of the customer initiating a dispute multiplies. Check with your processor that the descriptor is clear, identifiable, and contains a phone number or contact URL.

Professional chargeback management is a direct indicator of the operational health of any business accepting card payments. At PayOk, we optimize the dispute flow for merchants across all verticals while complying with European regulations. If you need to review your chargeback prevention strategy, contact our team.

Sources and related readings

Legal and regulatory framework

• Directive (EU) 2015/2366 of the European Parliament and of the Council (PSD2), on payment services in the internal market.
• Royal Decree-law 19/2018, of November 23, on payment services and other urgent financial measures.
• Delegated Regulation (EU) 2018/389, regulatory technical standards for strong customer authentication (RTS SCA).
• PCI DSS v4.0, Payment Card Industry Data Security Standard (PCI Security Standards Council, March 2022).
• EBA/GL/2018/05 Guidelines, on fraud reporting under PSD2 (European Banking Authority).
• Visa Acquirer Monitoring Program (VAMP), effective since April 2025 (Visa Corporate).