Friendly fraud: when cardholders dispute legitimate charges and the evidence that defeats them

Card fraud does not always originate from organised networks operating with stolen credentials. Across European e-commerce, a substantial proportion of payment disputes are initiated by genuine cardholders regarding purchases they actually authorised or consumed. This phenomenon is technically known as first-party fraud or friendly fraud, and it represents one of the most stubborn operating costs in digital sales.

Unlike strict criminal fraud, friendly fraud involves no technical compromise of card credentials: the payment method, browser session, or mobile device usually belongs to the customer or someone within their immediate household. However, the financial consequence for the business mirrors that of outright card theft: an immediate provisional withdrawal of funds alongside an administrative dispute fee.

Why friendly fraud occurs

It is useful to distinguish between deliberate and accidental friendly fraud, as both trigger identical banking workflows while stemming from fundamentally different motives:

• Unrecognised statement descriptors: online bank statements do not always display a store's customer-facing brand name, often showing a corporate entity or an abbreviated technical descriptor instead. The cardholder fails to recognise the line item and flags the transaction as fraudulent in their banking app.
• Household and family purchases: children or family members make purchases on digital entertainment or gaming platforms using devices where card details were stored. Upon seeing the unexpected charge, the account holder assumes the card was cloned.
• Intentional chargeback abuse: the buyer receives the physical parcel or downloads the digital asset and deliberately requests a chargeback from their bank, falsely claiming non-receipt or lack of authorisation to obtain the goods free of charge.
• Confusion over recurring renewals: following a free trial or an annual billing interval, the subscriber forgets the renewal terms and turns to their bank for a dispute rather than requesting standard cancellation from the merchant.

The cost of disputes and the role of authentication

When a buyer lodges a formal claim with their card-issuing bank, the chargeback process begins. The issuing bank provisionally clawbacks the disputed sum from the merchant account through the card scheme network, while the acquiring processor applies a non-refundable administrative penalty, an impact examined in the hidden cost of payment failure.

Across the European Economic Area, enforcing Strong Customer Authentication (SCA) under 3D Secure 2 protocols delivers essential protection: if the transaction was authenticated with two factors (such as device biometrics and a banking passcode), liability for unauthorised fraud claims generally shifts from the merchant to the card issuer (*liability shift*).

However, a liability shift does not prevent cardholders from disputing transactions under other reason codes, such as claimed non-delivery or merchandise not as described, forcing merchants to submit structured compelling evidence to rebut the claim.

Compelling evidence that defeats friendly fraud

Major card schemes (such as Visa and Mastercard) provide formalized representation frameworks enabling merchants to prove transaction legitimacy. Following rules such as Visa Compelling Evidence 3.0 (CE 3.0), evidence requirements have grown more structured yet stricter.

To counter a friendly fraud dispute asserting lack of authorisation, the merchant must provide an audit trail directly tying the claimant's identity to the purchase and consumption of the service:

• Prior transaction history: establishing that the same card, customer account, IP address, or physical device successfully completed at least two undisputed, authentic transactions within a preceding qualifying timeframe (typically between 120 and 365 days prior).
• Digital access and usage logs: comprehensive server logs detailing platform log-ins, the download IP address, unique device identifiers, and verifiable activity following the transaction (such as streaming hours or in-app balance consumption).
• Proof of physical delivery: carrier delivery receipts carrying recipient signatures, delivery geolocation records, or delivery verification matched to the billing address stored during checkout.
• Direct communications: support ticket logs, customer service chat transcripts, or email exchanges where the cardholder actively discussed the purchased order after the billing date.
• Explicit contract acceptance: precise timestamps recording agreement to terms of service and cancellation policies during checkout.

Practical prevention in the checkout flow

Preventing friendly fraud requires intervention well before the customer views their bank statement. Several operational practices reliably mitigate confusion-driven disputes:

• Refining dynamic descriptors: configure your payment gateway to output explicit, readily recognisable text on bank statements, pairing the consumer-facing trading brand with a support URL or telephone number.
• Prompt receipts and renewal notifications: deliver detailed email invoices immediately upon billing, and issue advance reminders prior to annual or recurring subscription renewals.
• Accessible refund channels: ensure rapid customer support avenues so dissatisfied customers can resolve issues directly instead of resorting to their bank's dispute button, which carries substantial dispute surcharges.

Successfully fighting first-party fraud is not about gathering disconnected screenshots; it relies on building an automated, structured trail of technical and operational data for every charge. The clearer the link between the purchaser, their verified device, and the actual delivery of the service, the higher the probability of recovering improperly disputed revenue.