Skip to main content
Blog
Blog

How to dispute a chargeback as a merchant: evidence and process guide

Disputing a chargeback means filing a representment package before your card network deadline, backed by delivery proof and device evidence.

Aug 05, 2026 6 min read
How to dispute a chargeback as a merchant: evidence and process guide

TL;DR: representment package device evidence export

  • Most merchants either don't dispute chargebacks at all or submit underpowered packets that lose. Both routes waste the same 20-to-45-day window and burn the same $15 to $100 in chargeback fees.
  • cside captures the device fingerprint and session data that answer the only question the card network asks on a 10.4 dispute, which is whether the real account holder made the purchase, and exports it in the CE 3.0 packet format the acquirer can file.
  • Visa gives you 30 days, Mastercard 45, Amex 20. Decide before the first notification whether you have session evidence to defend the case, because there is no retroactive way to record a checkout that already happened.

To dispute a chargeback, you file a representment package with your acquiring bank before the card network's response window closes, usually 20 to 45 days depending on the network and the reason code. The package has to prove the transaction was authorized and legitimate. On card-not-present orders, the evidence that moves the needle most is device fingerprint and session data tying the purchase to the account holder's known devices.

A chargeback is a forced transaction reversal initiated by a cardholder through their issuing bank. When one is filed, the acquiring bank debits the merchant's account for the disputed amount plus a chargeback fee, typically $15 to $100. The merchant can contest the chargeback through a process called representment, presenting evidence to the card network that the original transaction was legitimate. If the representment succeeds, the funds are returned. If it fails, the chargeback stands.

Merchants dispute far fewer chargebacks than they should. Win rates for well-evidenced disputes are meaningful, yet most merchants either do not dispute at all, accepting losses they could recover, or submit underpowered evidence packages that fail.

Understanding the chargeback reason codes

The reason code on a chargeback determines what evidence representment requires. The most common codes for card-not-present merchants are:

Unauthorized transaction (Visa 10.4, Mastercard 4837, Amex C08). The cardholder claims they did not authorize the transaction. This is the most common code for friendly fraud, where a cardholder makes a legitimate purchase and then disputes it. It is also used for genuine fraud, where the card was used without the owner's knowledge.

Item not received (Visa 13.1, Mastercard 4853). The cardholder claims the goods or services were never delivered. For digital goods and services, delivery evidence is a session and access log proving the customer used the product.

Not as described (Visa 13.3). The cardholder claims the product differed materially from the description. Evidence includes the product listing at the time of purchase, the terms and conditions accepted, and customer service communications.

Duplicate processing (Visa 12.6). The cardholder claims the same transaction was charged twice. Evidence is a transaction log showing a single charge.

For unauthorized transaction disputes, the category where device fingerprint evidence is most valuable, the question the card network is answering is simple: did the real account holder make this purchase? Evidence that ties the transaction session to the account holder's known devices addresses that question directly.

The representment process, step by step

Step 1: Receive notification and check your response window.

Your acquiring bank notifies you of the chargeback, and the clock starts immediately. Response windows vary:

  • Visa: 30 days from the chargeback date for most reason codes
  • Mastercard: 45 days for most reason codes
  • American Express: 20 days for most disputes

Missing the response window means an automatic loss. Track every chargeback notification and its deadline in a dedicated workflow. Do not rely on email alone, because acquiring banks send chargeback notifications through their merchant portals.

Step 2: Determine whether to dispute.

Not every chargeback is worth disputing. If the transaction was genuinely fraudulent, disputing is unlikely to succeed and wastes the response window. Dispute when you have evidence that the cardholder made the purchase: delivery confirmation, a device match, session history, or prior order history from the same account.

Step 3: Assemble the representment package.

The package goes to your acquirer, who forwards it to the card network for adjudication. A strong package for an unauthorized transaction dispute includes:

  • Order confirmation with transaction details, amount, date, and the last four digits of the card
  • Proof of delivery for physical goods (tracking number with confirmed delivery) or proof of access for digital goods (session logs, login records, usage activity)
  • Customer communication history: emails, support tickets, or chat logs showing the customer acknowledged the purchase or used the product
  • Terms and conditions accepted at the time of purchase, including any language about refund and dispute policies
  • Device fingerprint matching the transaction session to the account's known devices
  • Session behavioral evidence showing the transaction was completed by a human user with normal interaction patterns
  • For Visa disputes, Compelling Evidence 3.0 documentation where it applies (see below)

Step 4: Submit through your acquirer.

Submit the package through your acquirer's chargeback dispute portal by the deadline. Include every piece of evidence in a single, clearly organized submission. Adjudicators review high volumes of disputes, so a well-labeled, concise package beats a large, disorganized one.

Step 5: Track the outcome.

Card network adjudication typically takes 30 to 60 days after submission. If you win, the funds return to your account minus the acquirer's fee. If you lose, you can escalate to arbitration for Visa disputes, though arbitration carries additional fees and is appropriate only for high-value disputes where the evidence is strong.

Visa Compelling Evidence 3.0

Visa Compelling Evidence 3.0 (CE 3.0) is a Visa framework that lets merchants counter unauthorized transaction disputes by demonstrating that the same device and IP address used in the disputed transaction has a prior verified history with the account, without any previous fraud disputes.

CE 3.0 shifts the burden of proof in unauthorized transaction cases when a merchant can show:

  • The device fingerprint in the disputed transaction matches at least two prior undisputed transactions from the same account
  • Those prior transactions fall within a defined lookback window, generally 120 to 365 days before the dispute
  • At least two of four data elements match across all three transactions (customer ID, shipping address, IP address, device ID), with at least one being IP address or device ID
  • None of the prior transactions were disputed

When the CE 3.0 criteria are met, Visa can require the issuing bank to accept the merchant's evidence and close the dispute in the merchant's favor. The prerequisite is having collected and stored device fingerprint data for every transaction session.

cside chargeback evidence captures the device fingerprint, session behavioral data, and transaction linkage CE 3.0 needs during every session, then exports it in CE 3.0 format within seconds of a dispute landing. It builds on the same device fingerprinting that identifies returning devices across sessions. Merchants who pair that evidence with a representment partner such as Chargebacks911 report materially higher win rates than they see with order confirmation and delivery documentation alone.

Further reading

Mike Kutlu
Client-Side Security Consultant

Client-side security consultant at cside. 10+ years of experience implementing technology solutions for enterprises (previously at Oracle, Cloudflare, and Splunk). Now helping teams use client-side intelligence to catch & reduce fraud.

FAQ

Frequently Asked Questions

Response windows vary by card network: Visa typically allows 30 days, Mastercard 45 days, and American Express 20 days from the chargeback notification date. These deadlines are strict. A submission received after the window closes is rejected regardless of how strong the evidence is. Track every chargeback notification and its specific deadline as soon as it arrives.

For unauthorized transaction disputes, the strongest evidence demonstrates that the legitimate account holder made the purchase. This includes device fingerprint data matching the transaction session to the account's known devices, prior transaction history from the same device without disputes, and session behavioral evidence showing human interaction patterns. Visa Compelling Evidence 3.0 formalizes this into a framework that can shift the dispute burden back to the issuing bank.

Visa Compelling Evidence 3.0 is a Visa dispute framework that lets merchants contest unauthorized transaction chargebacks by showing that the same device and IP address used in the disputed transaction also appeared in at least two prior undisputed transactions on the same account. When the CE 3.0 criteria are satisfied, the dispute can be resolved in the merchant's favor without the full adjudication process. The prerequisite is collecting and retaining device fingerprint data at the session level for every transaction.

Yes. Device fingerprint evidence directly answers the question card networks ask in unauthorized transaction disputes: did the real account holder initiate this transaction? A device fingerprint match to the account's prior verified transactions, especially when packaged in Visa CE 3.0 format, is more persuasive than order confirmation and delivery documentation alone. Merchants who pair cside's device fingerprint evidence with a representment partner such as Chargebacks911 report materially higher dispute win rates.

Monitor and Secure Your Third-Party Scripts

Gain full visibility and control over every script delivered to your users to enhance site security and performance.

Start free, or try Business with a 14-day trial.

cside dashboard interface showing script monitoring and security analytics
Related Articles
Book a demo