Chargeback Management Services - Dispute Response Aug/ 7/ 2026 | 0
Friendly fraud is the only theft where the thief files the report. At Dispute Response, we’ve watched merchants eat these losses for years on the theory that the customer must be right — while Visa itself has estimated that as many as three in four disputes may be friendly fraud: real purchases, by real cardholders, disputed anyway.
Forgot the charge. Didn’t recognize the descriptor. A teenager with a saved card. Or simple regret dressed up as “fraud.” The motive varies; the result is identical — you lose the product, the revenue, a fee, and a point on your ratio.
Here’s what most merchants don’t know: friendly fraud is now the most winnable dispute category, if your data is in order. This post shows you how to confirm you’re actually facing friendly fraud, how to build the Visa CE 3.0 case that shifts liability back to the bank, what to use when CE 3.0 doesn’t apply, and how to shut down the repeat offenders quietly farming your refund policy.
Step 1: Confirm It’s Actually Friendly Fraud
Fighting true fraud is a donation — you’ll lose, and you’ll spend hours losing. So the first move on any “I didn’t make this purchase” dispute is a five-signal check:
- AVS and CVV matched at checkout
- The account has history — prior undisputed orders, a login, saved preferences
- Delivery went to a verified address (or the digital product was accessed)
- The customer contacted you before or after the purchase
- Device or IP matches earlier legitimate sessions
Three or more signals present? You’re almost certainly looking at first-party misuse, not a stolen card. Zero or one? Concede, refund, and tighten your fraud stack instead. (If the distinction is new territory, our primer on fraud vs. friendly fraud covers the taxonomy.)
Step 2: The CE 3.0 Case — Your Strongest Weapon on Visa
For Visa card-absent fraud disputes (reason code 10.4 — decode yours with the reason-code guide), Compelling Evidence 3.0 changed the balance of power in April 2023.
Qualify, and the “I never bought this” story collapses under purchase history. You need:
- Two prior undisputed transactions on the same card, each 120 to 365 days before the dispute
- Two matching data elements between those transactions and the disputed one — and one of the two must be IP address or device ID (the others: shipping address, account login)
Meet the bar and liability shifts back to the issuer. Even better, the same evidence works at the pre-dispute stage through Visa’s Order Insight — the case can die in the cardholder’s banking app before it’s ever filed.
The catch is unchanged from when we covered it in how to win a chargeback: if you’re not capturing IP addresses and device IDs at checkout and storing them for 13+ months, CE 3.0 is closed to you. That data pipeline is the single highest-ROI project in friendly-fraud defense. Build it this quarter.
Step 3: When CE 3.0 Doesn’t Apply, Stack Circumstantial Evidence
First-time buyers, non-Visa networks, and friendly fraud hiding in “not received” or “cancelled recurring” claims all fall outside CE 3.0. You can still win — the standard is persuasion, not a checkbox:
- Usage logs for digital goods: logins after purchase, streams played, licenses activated, support tickets opened. A cardholder who “never bought” your software but filed three feature requests has already lost.
- Delivery evidence: signature, GPS-stamped photo, address match to AVS.
- Communication trails: order confirmations opened, emails answered, chat transcripts.
- Session forensics: same device and IP as previous legitimate orders, even if only one prior purchase exists.
Mastercard has also been rolling out its own first-party-misuse framework (its First-Party Trust program) built on similar transaction-history logic — worth checking its current scope with your processor, because the data you capture for CE 3.0 feeds it too.
Package everything using the one-page structure from our representment guide: kill shot first, timeline, labeled exhibits.
Step 4: Run the Economics — Not Every Friendly Fraud Deserves a Fight
Righteous anger is not a strategy. A $14 friendly-fraud dispute with a $25 fee attached is still a money-loser to fight, however guilty the cardholder. Route small-ticket cases through pre-dispute deflection and save your analyst hours for cases where the math works.
Where it works, it works well. A Dispute Response client selling subscription software ran this exact split for two quarters: auto-resolve under $30, full CE 3.0 or usage-log packets above it. Their contested friendly-fraud win rate settled at 71% — against an industry-wide average win rate that benchmarks put at 25–45% across all dispute types — and the recovered revenue paid for the evidence-pipeline work inside 60 days.
“Won’t Fighting My Own Customers Destroy the Relationship?”
This is the objection that keeps merchants writing checks, so let’s take it seriously.
First: the dispute already happened. The “relationship” you’re protecting has, at minimum, cost you the product, the revenue, and a fee. You’re not deciding whether to upset them — you’re deciding whether to pay them for it.
Second: representment is bank-to-bank. You submit evidence to your processor; the issuer rules. There’s no confrontation, no email from you accusing anyone. Most cardholders experience a won representment as their bank saying “the charge stands.”
Third: you keep full discretion. Fight the anonymous serial disputer; give your five-year customer who genuinely forgot a courtesy call instead. Winning a dispute and keeping a customer aren’t opposites — they’re separate decisions, and you make both.
What you can’t afford is the reputation of a merchant who never fights. Friendly fraud repeats where it succeeds.
Step 5: Shut Down the Repeat Offenders
The long game is deterrence:
- Track disputers by email, device, and address — a second dispute from the same identity triggers manual review or prepayment-only terms. Keep the rule mechanical: one dispute can be a misunderstanding; two inside twelve months is a pattern, and patterns get policies, not benefit of the doubt.
- Feed outcomes back into your fraud rules so a past disputer can’t check out frictionlessly again — route them into 3DS challenges or manual review automatically.
- Win at least once. Issuers see dispute outcomes; a cardholder whose “fraud” claim was defeated with device evidence faces friction on the next attempt.
None of this touches your honest customers. All of it raises the price of abusing you. And put one sentence in your published terms — “transactions disputed without contacting support may be contested with transaction evidence” — because deterrence works best when it’s announced.
The takeaway: Verify it’s friendly fraud with the five-signal check, lead with CE 3.0 wherever the history qualifies, stack usage logs and delivery forensics where it doesn’t, fold the small tickets without guilt — and make repeat abuse expensive enough to stop.
The Bottom Line
Friendly fraud persists for one reason: it works. Every unchallenged dispute teaches the cardholder — and the issuer’s records — that your store pays out on demand.
You already own the evidence that reverses this: the logins, the devices, the delivery scans, the purchase history. The only question is whether it’s organized before the next dispute lands. Get a free friendly-fraud readiness check from Dispute Response at dispute-response.com — we’ll audit your data capture against CE 3.0’s requirements and show you exactly which disputes you could be winning right now.
