Friendly Fraud: What It Is, How It Differs From Chargeback Fraud and How to Fight It

Friendly fraud is when a cardholder disputes a card purchase that they, or someone in their household, really made, usually by telling their bank it was unauthorized. Visa calls it first-party misuse, and Mastercard calls it first-party fraud. The card wasn't stolen, but the merchant still loses the sale, the goods and a fee unless it can prove the purchase was genuine.

What Is Friendly Fraud?

Visa defines friendly fraud as a cardholder disputing a legitimate transaction that they made or that someone in their household made. Instead of stolen credentials, the cardholder falsely claims the purchase was unauthorized or fraudulent. Mastercard describes it as genuine transactions that are "mistakenly or intentionally challenged by cardholders."

Not every case is a scam. Visa says the behavior sometimes comes from a misunderstanding and sometimes from a deliberate attempt to game the system. Mastercard's August 2026 article on first-party fraud makes the same point: many cases come from confusion, household purchases, forgotten subscriptions or service problems that push the customer to call the bank instead of the merchant.

Friendly fraud examples

Visa lists four common forms:

• Household misuse. A family member uses a saved card without the cardholder fully knowing.
• Descriptor confusion. The cardholder doesn't recognize the merchant name on the statement.
• "Free goods" attempts. The customer disputes a valid purchase to keep the item without paying.
• Return-policy abuse. The customer disputes the charge after keeping or using the goods past the return window.

Visa adds other scenarios: claiming goods never arrived after they were delivered, disputing a digital service as unauthorized while still using it, and saying a subscription was canceled when it wasn't.

Friendly Fraud vs Chargeback Fraud

People use "chargeback fraud" and "friendly fraud" for the same thing: a false dispute filed by the real cardholder. The useful comparison is between three kinds of disputed sale, because each one needs a different response.

Mastercard's First-Party Trust announcement draws the same line: the program helps issuers separate third-party fraud, "where someone's details are used without consent," from first-party fraud.

Merchant error is a legitimate dispute. If you billed twice or never processed a promised refund, the customer is right, and fighting it wastes time. For how any dispute moves through the system, see what is a chargeback.

How Common Is Friendly Fraud?

These figures come from the card networks' own publications:

• Visa: friendly fraud is around 20% of all fraudulent disputes globally, and up to 30% for high-volume online merchants. Visa cites the 2025 Global eCommerce Payments and Fraud Report from Visa Acceptance Solutions, Cybersource, the Merchant Risk Council, Verifi and B2B International.
• Mastercard: its 2025 State of Chargebacks report forecasts the global cost of chargebacks to merchants rising to $42 billion by 2028, with nearly half reported as fraudulent.
• Mastercard, 2026: its 2026 research report estimates annual chargeback volume reaching 334 million by 2028, with an average merchant chargeback value of $94. Research from Mastercard and Datos Insights found that 48% of consumers have disputed a charge they later realized was legitimate.

What One Lost Friendly Fraud Dispute Costs

This example is hypothetical. A fictional online shop sells a $90 item. The goods cost the shop $38 and shipping cost $9. Processing fees on the sale were $2.70, and its processor charges a $25 chargeback fee. That fee is an assumption for the arithmetic, not a typical rate; check your own merchant agreement.

If the sale sticks: $90 - $38 - $9 - $2.70 = $40.30 profit.

If the customer files a false dispute and the shop loses:

• The $90 is taken back.
• The $38 item and $9 shipping are already spent, and the customer keeps the item.
• The $2.70 in processing fees is gone too, under our assumption that the processor doesn't refund them.
• The $25 chargeback fee is added.

Loss on the order: $38 + $9 + $2.70 + $25 = $74.70. The swing from a $40.30 profit to a $74.70 loss is $115, which is the $90 sale plus the $25 fee. At $40.30 profit per sale, it takes 2 more completed sales just to cover one lost $90 dispute.

That $90 is close to the $94 average merchant chargeback value in Mastercard's 2026 research. The cost also grows in ways the arithmetic doesn't show: Visa notes that repeated disputes raise your chargeback ratio, which can raise acquiring costs or trigger network monitoring programs.

How to Prove Friendly Fraud: Visa Compelling Evidence 3.0

For a Visa card-absent fraud dispute (Dispute Condition 10.4, Other Fraud, Card-Absent Environment), Visa's strongest tool against friendly fraud is the rule known as Compelling Evidence 3.0, or CE 3.0. Visa's March 2023 merchant readiness guide says it took effect on 15 April 2023 and was built to address "friendly fraud or first party misuse."

The idea is a purchase history. If the same card bought from you before, with the same IP address or device and other matching details, and the cardholder didn't dispute those earlier orders, the new "I didn't make this" claim is hard to believe. When the criteria are met, Visa's rules treat the 10.4 dispute as invalid and liability shifts back to the issuer.

What CE 3.0 requires

Under the Visa Core Rules (18 April 2026 edition), you need:

1. 2 previous transactions on the same card or payment credential that the issuer did not report as fraud to Visa.
2. The right age. Each must have been processed more than 120 calendar days before the dispute, and not more than 365 calendar days before it.
3. A detailed description of the goods or services in the disputed transaction and in both earlier ones.
4. Matching data. The device ID or device fingerprint, or the IP address, plus at least one more element must match between the earlier orders and the disputed one. The other elements are the customer's account or login ID, the full delivery address, and the device ID or fingerprint.

Visa sets format rules for each element. The login ID, delivery address, device ID and IP address must be in clear text, not hashed; only the device fingerprint may be hashed. A device ID must be at least 15 characters. A device fingerprint must be at least 20 characters and come from at least 2 device properties, such as browser version and operating system version. The IP address must be the cardholder's public IP address. From 24 October 2026, Visa says device ID and device fingerprint count as similar data, so you can't use both as your two matches.

You can send this data before a dispute is filed, through Verifi's Order Insight, or after it, in a pre-arbitration response through your acquirer. Visa's 2023 guide warns that a CE 3.0 submission can be attempted only once, so check it before you send it.

What changes on October 24, 2026

Visa's April 2026 rules expand CE 3.0 for disputes processed on or after 24 October 2026. Visa says the change is meant "to further reduce friendly fraud." Under the 2023 version, the 2 earlier transactions had to be at the same merchant. The new version allows earlier transactions "at one or more Merchants," on the same card or a related credential such as a token. Your acquirer can only submit transaction data it accepted and processed.

Worked example: a $240 order disputed as "not authorized"

A fictional online store sells outdoor gear. A customer orders a $240 jacket on October 12, 2026, it's delivered, and on November 9, 2026, the issuer processes a Visa 10.4 dispute saying the cardholder didn't authorize it.

The store's records show 4 earlier orders on the same card. Count back from November 9, 2026:

So the qualifying window runs from November 9, 2025 to July 11, 2026. Two orders fall inside it.

Next, the matching data. Both qualifying orders came from the same public IP address as the jacket order and shipped to the same full delivery address. That's one of the required elements (IP) plus one more (delivery address). The store also writes a description of each item. If the issuer hadn't reported either earlier order as fraud, this case meets the CE 3.0 criteria.

If the store had saved only order numbers and no IP addresses, it would have nothing to match. You can't rebuild an IP address you never logged, so start capturing the data now.

Other evidence Visa accepts for a 10.4 dispute

If you don't qualify for CE 3.0, Visa's table of allowable compelling evidence for Dispute Condition 10.4 includes:

• Photos or emails linking the person who received the goods to the cardholder, or showing the cardholder has or is using them.
• Proof of delivery to the same address that got an AVS match of Y or M. Visa says no signature is required.
• For digital goods: a description, the download date, and 2 or more items such as IP address, device ID, the purchaser's name and email on the customer profile, or proof the same device and card were used in an undisputed transaction.
• A signed order form for a mail or phone order.

For writing the response itself, see how to win a chargeback.

Mastercard's First-Party Trust Program

Mastercard launched its First-Party Trust program in the US and, in a June 25, 2025 press release, announced expansion to Canada, Latin America, the Caribbean and Asia Pacific. Merchants can share extra data at authorization or later during the dispute. The release says the program provides:

• Signals for issuers on the cardholder's purchase history, device details, delivery information, identity elements and location.
• New rules defining compelling evidence for genuine purchases, including chargeback protection for merchants that meet the program's data-sharing requirements.

The release doesn't publish the detailed data criteria. Ask your processor whether your disputes can use the program.

How to Prevent Friendly Fraud

Visa and Mastercard both point to confusion as a major cause, so most prevention is about making the purchase easy to recognize and easy to fix with you.

1. Use a clear billing descriptor. Visa lists unclear descriptors as a driver of friendly fraud. Make the statement name match the name customers know you by.
2. Send receipts and updates. Visa recommends detailed order confirmations plus shipping, delivery and renewal notices. For recurring charges, see our subscription billing guide.
3. Make your refund and cancellation policy easy to find. Visa recommends it, and encouraging customers to contact you first keeps disputes away from the bank.
4. Capture CE 3.0 data on every online order. Save the IP address, device ID or fingerprint, login ID and full delivery address, in the formats Visa requires.
5. Use dispute alerts. Ethoca Alerts, from Mastercard, shares fraud and dispute information between issuers, acquirers and merchants in near real time, so you can refund or stop shipping before a chargeback. Mastercard reports the alerts prevented more than 39 million chargebacks in 2025. On the Visa side, Verifi's Order Insight lets you share purchase details such as login, IP and delivery data with issuers and cardholders before a dispute is filed.
6. Track usage for digital goods. Visa suggests logging usage to prove fulfillment and revoking access after a confirmed chargeback.

More prevention tactics are in our chargeback prevention guide, and card-not-present fraud screening is covered in card-not-present transactions.

Can You Go to Jail for Friendly Fraud?

The card networks' rules don't answer this. Visa and Mastercard rules govern banks and merchants, not criminal charges. Whether a false dispute is a crime, and what penalty applies, depends on the jurisdiction and the facts, such as whether the customer knowingly lied and how much money was involved. We couldn't find a network or government source that sets a general rule, so we won't quote one.

Visa's rules do act on repeat disputers. An issuer whose cardholder files 5 or more fraud disputes within 12 months must formally review the account to check for first-party fraud abuse. If a customer keeps doing it, fight the disputes with evidence, stop selling to them, and talk to a lawyer before going further.

This is general information, not legal advice. Card network rules change, and your acquirer's agreement may add requirements.

If false disputes are eating into your margins, send us a recent statement for a free statement review.

Sources

• Visa, "Friendly fraud explained: prevention and solutions", observed October 2026.
• Visa, "Visa Core Rules and Visa Product and Service Rules," 18 April 2026 edition (Summary of Changes; sections 10.4.2.1, 10.4.7.3, 11.5.1, 11.7.5.3 and 11.7.5.6; Tables 11-6, 11-28 and 11-31), observed October 2026.
• Visa, "Compelling Evidence 3.0 Merchant Readiness" (March 2023), observed October 2026.
• Mastercard, "To counter 'friendly' fraud, Mastercard expands technology to new markets" (June 25, 2025), observed October 2026.
• Mastercard, "How Ethoca helps prevent first-party fraud and reduce chargebacks" (August 11, 2026), observed October 2026.