Unfiltered: chargebacks are a relic

Dwayne Gefferie, Payments Strategist, explains why chargebacks are an outdated approach to payments in September’s issue of his monthly column in The Paypers.

Chargebacks are the most admired consumer protection in payments, and also the reason why card risk management no longer works. 

The US Congress passed the Fair Credit Billing Act in 1974, amending the Truth in Lending Act, to give cardholders the right to dispute billing errors: unauthorised charges, wrong amounts, and goods that never arrived. It capped consumer liability at USD 50 but didn’t specify how any of it should work. The law created a consumer right, leaving the card networks and issuers to set up the approach, which they did, and never changed. 

Chargebacks were built to do one job, but ended up doing four, three of which they never designed for. Every complaint the industry has about fraud metrics, acquirer monitoring, and dispute costs traces back to this overload rather than anyone's bad behaviour.

Chargebacks’ four jobs run on a single data structure

The first job is the original, and it still works: to act as a consumer remedy. 

The second is a fraud indicator. When an issuing bank decides a transaction was fraudulent, it files a report called a TC40. When a cardholder recovers the money, that's a chargeback, filed as a TC15. The industry now treats both as evidence of something wrong at the merchant level. 

The third job is a merchant risk score. Visa's Acquirer Monitoring Program (VAMP) unifies TC40s and TC15s, divides by settled card-not-present (CNP) transactions, and labels anyone above the line as excessive at USD 8 a transaction. As a result, the merchant threshold decreased from 2.2% to 1.5% in April. 

Finally, job four is supervision. VAMP measures acquirers across their whole book, at 0.5% above standard and 0.7% excessive. Mastercard's revised scam merchant standards, announced in May as part of Merchant Trust Services and effective 24 July, run alongside it, requiring acquirers to open an investigation within 72 hours of a merchant triggering defined warning signals. 

Those purposes oppose each other. A consumer right should be easy to exercise, and a risk metric should be hard to trigger accidentally. You can't tune one data point for both, and the industry has spent a decade pretending otherwise. 

What overloading looks like in the infrastructure

A fraud-coded dispute produces a TC40 and a TC15 on the same transaction, landing twice in the numerator, a decision nobody made. It's what happens when you add a performance score onto a record built for something else. 

TC40s also count fraudulent transactions even if the issuer never filed a chargeback. The merchant keeps the revenue and loses nothing but is still flagged. The fraud report was never meant as a metric, so nobody built it to identify a real loss from a signal. 

The measurement trails, meaning fraud processed today lands in the next quarter's reporting, and while this is tolerable for a consumer remedy, it is close to useless as a control. 

This is also a portfolio ratio. An acquirer is judged on every merchant it onboarded, so the rational response is to offboard a marginal merchant before the monthly report arrives, rather than remediate the issue. 

From what I'm seeing in the market, Mastercard has been working directly with merchants and acquirers to unwind cases where the new scam rules caught the wrong businesses. That's the right instinct and speed, and it's also a company fixing individual outcomes of a system-level flaw, one case at a time. 

Nobody can agree on what a chargeback even is

The finding that should end the argument comes from Mastercard's own research with Datos Insights. Issuers label 72% of disputes as fraudulent, while merchants identify 45% of the same chargebacks as fraudulent, a 27-point difference on identical transactions. The two parties aren’t disagreeing on facts. The difference comes from the fact that they are looking at a record without enough information to settle the question and filling the gap based on what they can see. The issuer sees what the cardholder claimed, the merchant sees the order history behind it, but neither sees both, and the chargeback was never designed to carry both. 

The rest of Mastercard's research explains why. Three-quarters of disputes go straight to the issuer, leaving the merchant out of the conversation entirely. Its 2026 work with Datos found 48% of consumers have mistakenly disputed a legitimate charge. Its Javelin research found 77% of merchants believe the dispute process is too easy, and 83% of issuers think chargebacks are rising partly because more customers have learned they can file one. Visa's own published figure puts first-party misuse at around 20% of fraudulent disputes globally, rising to 30% for high-volume online merchants. 

So, every risk score on card acceptance data is interpreted by the two parties closest to it, by a factor approaching two. Each subsequent threshold and penalty inherits that, and the acquirer at the end of the chain is the one carrying the risk.

The chargeback alternative already exists

Visa bought Verifi in 2019, and Mastercard owns Ethoca, both selling a way to resolve a dispute before it becomes a chargeback. Stripe's documentation states the mechanism plainly: Ethoca-resolved disputes don't count toward dispute rates, which is how merchants get themselves out of Mastercard's monitoring programmes. 

Visa's Order Insight does something even simpler. It shares transaction details with the issuer so the cardholder can see what they bought, enabling visibility on the missing information that would otherwise cause the 27-point difference discussed above. 

Look at what those products are, structurally. Real-time data exchange when confusion occurs, replacing a money reversal filed six weeks later. This is the chargeback replacement: already built, live, and sold by both networks as an accessory to what it supersedes. 

This isn't cynicism on anyone's part. Chargebacks are foundational, with consumer law written around them, issuer systems built on them, and the FCBA right itself can't be switched off by a scheme bulletin. As a result, everyone builds around a primitive approach instead of replacing it, and the workarounds accumulate into a costly compliance stack. 

Which explains the fee moves

Read pricing changes rather than press releases if you want to know where a company thinks value sits. 

Visa Compelling Evidence 3.0 is the process a merchant uses to prove a disputed transaction was legitimate by showing prior undisputed orders from the same cardholder. Since 17 April, Visa charges a fee on every successful qualification. The tool that proves a chargeback was unwarranted is no longer free. Two weeks before that, Visa's Digital Commerce Service Fee expanded to bundle account updater activity, token authentication, credential updates and credential enrichment. Then it applied a card-present token fee to tokenised in-person transactions at 0.01% domestic and 0.05% cross-border rate. CMSPI put the total merchant cost impact of the April US network fee updates at around USD 3 billion. 

None of these approaches scales with size, but with operating behaviour: disputes, token events, credential refreshes. I read this as two companies correctly realising that the expensive part of a card payment in 2026 isn't moving money, but adjudicating what happened afterwards. They're pricing adjudication because adjudication is genuinely hard and costly. But nobody admits it's hard because of the primitive infrastructure underlying it. If you fix that, most of the stack has no reason to exist. 

Then the agents arrive

The chargeback rests entirely on one word: authorisation. Regulation E defines authorisation as the consumer granting permission for a transfer. Liability follows it, and the entire dispute taxonomy assumes a human either authorised a transaction or didn't. 

When you put an agent in the middle, the definition stops resolving this issue. A customer tells it to find the best deal on running shoes, and it buys the wrong pair, so they technically authorised the payment, not the shoes. Worldpay's (now Global Payments) read is that clean agent fraud is handled fine under existing tokenised rules, with the issuer carrying the risk, and that everything short of outright fraud is murkier, which is exactly where the volume will be. 

EMVCo published a draft framework on 1 September proposing Intent Services, a shared layer where participants register, reference, retrieve, and manage consumer-authorised intent before, during, and after a transaction, aimed at cases where intent must persist over time. Comments close on 30 September. In April, American Express went further, launching its ACE developer kit alongside Amex Agent Purchase Protection, a commitment to protect card members against errors by Amex-registered agents if it receives authenticated purchase intent. That's the most concrete answer anyone has given, because it's a balance sheet commitment rather than a working group. 

Intent is precisely what chargebacks were meant to infer, but they do it badly, six weeks after the fact. The industry is building its replacement publicly and still filing it under extensions. 

What to do with this

If you run an acquiring book, stop treating dispute rate as a risk number. Split it before your scheme report does, into third-party fraud, first-party misuse, and service failure. Those are three different businesses with different fixes, and the ratio you're graded on blends them into one. 

Buy the dispute tooling but book it as infrastructure rather than insurance. You're purchasing the successor mechanism early, which is a reasonable thing to do. If you crossed a threshold after April, your risk didn't change, only the measurement. That's a very different conversation to have with your acquirer, preferably before the settlement pause lands. 

Fifty-two years of useful work is a good run for any piece of infrastructure. The chargeback is now the main thing standing between this industry and a dispute system that could tell a fraudster and a confused customer apart, and the first network to say that plainly gets to design what comes next. 

About the author

Dwayne Gefferie is a payments strategist, data scientist, and advisor with over 22 years of experience in the global payments industry. Unfiltered is his monthly column for The Paypers.