Friendly fraud: when the cardholder disputes a real purchase

In third-party fraud a criminal pays with someone else's card data. In first-party fraud the cardholder bought the goods and then tells the issuing bank that the payment was not theirs or that nothing arrived. Some of these claims are made in good faith, for example by a cardholder who forgot the purchase; others are deliberate. The issuer cannot tell the two apart when the claim comes in.

Under the Visa Core Rules, an issuer raises such a claim as dispute condition 10.4, "Other Fraud: Card-Absent Environment": the cardholder denies authorizing or taking part in an online or phone transaction. The issuer must report the fraud to Visa before it opens the dispute, and it has 120 calendar days from the processing date to do so.

Visa changed the rules for these disputes with Compelling Evidence 3.0, which applies to pre-arbitration cases processed from April 15, 2023. According to Verifi's FAQ on the rule, a merchant can answer a 10.4 dispute with two earlier transactions of the same cardholder that were not reported as fraud and are 120 to 365 days old. At least two data elements must match across them: customer account or login ID, delivery address, device ID or device fingerprint, and IP address. One of the two has to be the device ID or the IP address.

When the evidence holds, liability moves away from the merchant, and the case does not count against the merchant's fraud ratio. A merchant can only use the rule if its checkout stores device IDs and IP addresses with each order and its payment service provider passes them on.

The 2025 report on payment fraud by the EBA and the ECB puts fraud on cards issued in the EU and EEA at EUR 1.3 billion in 2024, and remote payments made up around 83 percent of it. Payment service users bore 38 percent of the card fraud losses, payment service providers the rest.

Authentication changes who carries the loss. A card payment authenticated with 3-D Secure shifts fraud liability to the issuer, as the strong customer authentication page explains. The card not present fraud page covers the third-party side of the same channel.

The two terms usually mean the same thing: a dispute filed by the cardholder who made the purchase, whether by mistake or on purpose. Wikipedia lists chargeback fraud as another name for friendly fraud. Third-party fraud, with stolen card data, is the opposite case.

With order data. Under Compelling Evidence 3.0 the merchant answers a 10.4 dispute with earlier undisputed orders that share the device ID or IP address and one more data element. Authenticating the payment with 3-D Secure shifts fraud liability to the issuer. Stripe advises in its guide on card testing to refund payments that look fraudulent before they turn into disputes.