Every merchant that takes cards eventually meets the dispute that makes no sense. The order shipped to the billing address, the carrier scanned it as delivered, the customer logged in twice afterwards, and six weeks later the issuer pulls the money back as fraud. Nothing in the fraud stack flagged it, because nothing about it was fraudulent in the way fraud tools understand the word.
That pattern has a name. Friendly fraud, increasingly called first-party misuse by the card networks, is a dispute raised by the person who actually made the purchase. It sits in a blind spot: the fraud team treats it as a payments problem, the payments team treats it as a customer service problem, and the customer service team never sees it because the customer went to the bank instead of to you.
In short
- Friendly fraud comes from your real customer, so device, IP, velocity and behavioural signals all look clean at authorisation.
- Fraud scoring cannot catch it, and worse, mislabelled chargebacks feed back into the model and quietly degrade it.
- The strongest tells live in your own data: dispute timing relative to delivery, account tenure, repeat “item not received” claims, and refund-then-dispute double dips.
- Billing descriptor confusion is the cheapest fix available, and it is usually a configuration change rather than a project.
- Not every dispute is worth fighting: the arithmetic of refund versus representment versus blocklist should be written down before the next batch lands.
What first-party or friendly fraud means in practice
First-party misuse is a dispute filed by the legitimate cardholder against a transaction they themselves authorised. The card was not stolen, the account was not taken over, and no third party sat in the middle. The customer bought the thing, received the thing, and then told their bank the charge was wrong.
Calling all of that “fraud” flattens a wide spectrum. At one end sits honest confusion: a cardholder who does not recognise a billing descriptor, or who forgot that a free trial converted to a paid plan. At the other end sits deliberate abuse, sometimes coordinated and shared as a technique on social platforms. Most of the volume for a typical retailer sits in the middle, in forgetfulness, family use and impatience.
The card networks have been steadily separating these cases in their own rule sets. Visa and Mastercard both publish dispute reason codes that distinguish an unauthorised transaction from a “goods or services not received” or “credit not processed” claim, and both have published programs aimed specifically at first-party misuse. Those rule sets change on a published release cycle, so treat any specific code, threshold or program name you read anywhere (including here) as a pointer to check against the current network rules through your acquirer.
Why the label matters: unauthorised transaction disputes and service disputes travel through different rules, carry different evidence expectations, and shift liability differently. Getting the classification wrong at your end means you fight the wrong cases and refund the ones you would have won. Our payment fraud and chargeback prevention guide lays out how the categories connect across the whole dispute lifecycle, and this article drills into the one category that automated defences consistently miss.
Why the terminology shifted
“Friendly fraud” was always an awkward phrase. It is not friendly to the merchant, and in the confusion cases it is not fraud in any meaningful sense either. The move toward “first-party misuse” in network documentation reflects a practical reality: the industry needed a term that covers deliberate abuse and honest error without accusing every disputing customer of a crime.
That distinction is not academic. If your internal process labels a confused customer as a fraudster, you will blocklist good buyers, generate complaints, and lose lifetime value that dwarfs the disputed amount.
Why fraud scoring tools mostly miss it
A modern fraud stack scores a transaction on signals that describe whether the person at the checkout is who they claim to be. Device fingerprint, IP reputation and geolocation, email address age, BIN and issuer country, address verification, velocity across the network, behavioural biometrics in the session, and prior history for that identity all feed the model.
In first-party misuse, every one of those signals is genuine. It is the real customer, on their own phone, on their home network, shipping to the address on their card statement, at a normal hour, at a normal basket size. There is nothing anomalous to detect, because nothing anomalous happened.
What the score actually measures
Fraud scores answer the question “is this person the cardholder?” They do not answer “will this cardholder later regret, forget or exploit this purchase?” Those are different questions with different feature sets, and conflating them produces two failures at once: you miss the misuse, and you tighten thresholds that reject good traffic.
The second failure is expensive and invisible. False declines almost never generate a support ticket, because a declined customer usually just leaves. Tightening a score to chase a chargeback rate that first-party misuse is driving therefore trades a visible cost for a larger hidden one.
Why mislabelled chargebacks poison the model
Most fraud systems learn from chargeback outcomes. A dispute arrives, it carries a fraud reason code, and the transaction gets labelled as fraud in the training set. If a meaningful share of those labels are actually first-party misuse, the model is being taught that ordinary customers on ordinary devices are fraud.
The result is a model that drifts toward penalising exactly the profile of your best customers. Over months this shows up as a slowly rising decline rate on repeat buyers, which is close to the worst possible outcome. Splitting your labels by reason code before they reach the training pipeline is one of the highest-leverage hygiene fixes available, and it costs engineering time rather than licence fees.
Where 3-D Secure stops helping
Authentication is often proposed as the answer, and for third-party fraud it is a strong one. The liability shift that comes with successful authentication is scoped to unauthorised transaction disputes, not to service disputes such as “I never received it” or “the subscription was not cancelled”. A customer who authenticated with a passkey or a banking app and then files a non-receipt claim is still your problem.
That scope is worth understanding precisely before you lean on authentication as a fraud strategy, and it is covered in detail in 3-D Secure 2 explained without wrecking your conversion rate. The short version: authentication moves liability for a specific dispute category, and first-party misuse mostly lives outside that category.
| Signal | Third-party fraud | First-party misuse |
|---|---|---|
| Device and browser | New or spoofed, often mismatched | Known device, consistent history |
| Shipping vs billing address | Frequently different, reshipper or freight forwarder | Usually identical or a known second address |
| Account age at purchase | Minutes to days | Months to years |
| Post-delivery account activity | None, account abandoned | Logins, reorders, reviews, support contact |
| Dispute timing | Fast, often within days of the statement | Late, commonly 30 to 90 days after delivery |
| Contact before the dispute | Almost never | Sometimes a refund request that stalled |
| Basket composition | High resale value, quantity outliers | Normal for the customer segment |
| Repeat pattern | Card tested across many merchants | Repeat claims at the same merchant |
Signals in your own order and delivery data
The detection problem moves from impossible to tractable the moment you stop looking at authorisation data and start looking at post-purchase data. Authorisation tells you who paid. Fulfilment, delivery and account activity tell you what happened next, and first-party misuse leaves its fingerprints there.
Timing is the strongest single signal
Plot the gap between delivery scan and dispute filing for every chargeback you receive, split by reason code. Third-party fraud clusters early, because the real cardholder notices an unfamiliar charge when the statement arrives. First-party misuse clusters late, often after the return window has closed, which is precisely the point.
A dispute that arrives 60 days after a confirmed delivery, on an account with prior successful orders, is a very different object from one that arrives on day four of a new account. Two histograms on one chart tell most teams more than a year of vendor dashboards.
Repeat behaviour at the account level
Track claims per account, not per card. Cards get reissued, expire and rotate; the account, the email and the delivery address persist. A customer with three “item not received” claims across three different card numbers is a pattern that card-level reporting will never surface.
Set the threshold conservatively. One non-receipt claim is life: parcels genuinely go missing, and carriers genuinely mis-scan. Two on the same account within a rolling year is a flag worth a human look, and three is a policy decision rather than a judgement call.
Cross-check the double dip
The double dip is a refund already issued, followed by a chargeback for the same order. It happens through genuine confusion more often than people expect, because refunds can take days to post and customers escalate to the bank while waiting.
Either way it is entirely preventable with a reconciliation job that matches dispute records against your refund ledger before anything else happens. A double dip is usually the easiest dispute to win, since the evidence is a single settlement record showing the money already went back.
The signals that live outside payments
Post-delivery logins, app opens, loyalty point redemption, a submitted product review, a warranty registration and a support conversation about the item are all evidence that the goods arrived and were used. Most of that data sits in systems the payments team has never queried. Getting read access is often a one-week integration that permanently improves detection and representment quality.
Descriptor confusion: the cause you can fix this week
A large share of “I do not recognise this charge” disputes are exactly what they claim to be. The customer bought from a brand and the statement shows a holding company, a legal entity, a payment facilitator, or an abbreviation that survives no one’s memory. They call the bank because they cannot call you, since your name is not on the line they are looking at.
This is the rare fraud problem with a configuration-level fix. Most payment service providers support a soft descriptor or dynamic descriptor field, and most acquirers will update the static descriptor on request. The change is usually live within a billing cycle.
What a good descriptor looks like
Put the trading brand first, in the form the customer typed into their browser. Use the remaining characters for a contact route, either a support phone number or a short domain. Where your provider supports a suffix, add an order reference so the customer can search their own inbox.
Field lengths and permitted characters vary by acquirer and by card network, and the network rules on descriptor content do change, so confirm the current specification with your acquirer rather than assuming the format you used at a previous employer still applies. The principle survives every rule revision: the statement line should be recognisable without any additional context.
Alerts and issuer-side deflection
Both major networks operate merchant alert and order-insight services through subsidiaries, which push transaction detail to the issuer or notify the merchant of an incoming dispute so it can be refunded before it becomes a chargeback. These are paid services with per-alert or per-enquiry pricing, and whether they pay for themselves depends on your dispute rate and margin.
Run the arithmetic before signing. If the alert fee plus the refund exceeds the value of avoiding a chargeback fee and a ratio point, the service is a cost rather than a saving on that segment. It frequently is worth it for high-ticket goods and for merchants sitting close to a monitoring threshold.
Measuring whether it worked
Descriptor changes are one of the few interventions with a clean before-and-after read. Track the share of disputes filed under unrecognised-transaction reason codes as a percentage of total disputes, weekly, and expect movement within one to two billing cycles. If that share does not fall, your problem was never the descriptor and you have cheaply eliminated a hypothesis.
| Underlying cause | What it looks like in the data | The fix | Typical time to effect |
|---|---|---|---|
| Unrecognised billing descriptor | Disputes concentrated in unrecognised-charge codes, short time from statement date | Brand-first descriptor plus contact route, pre-charge email | 1 to 2 billing cycles |
| Forgotten subscription renewal | Disputes cluster on renewal dates, especially the first renewal after a trial | Renewal reminder 3 to 7 days ahead, one-click cancellation | 1 renewal cycle |
| Slow or stalled refund | Refund issued, chargeback filed days later for the same order | Refund status page, proactive settlement email, dispute-to-refund reconciliation | Immediate |
| Family or authorised user purchase | Unauthorised claims on long-tenured accounts, digital or gaming goods | Purchase confirmation to the account email, spend controls, clear cardholder receipt | 1 to 3 months |
| Non-receipt after a delivery scan | Late claims, repeat by account, no carrier exception logged | Photo proof of delivery, signature above a value threshold, structured evidence export | 1 to 2 months |
| Deliberate repeat abuse | Three or more claims per account across reissued cards | Account-level review, representment on strong cases, controlled restriction | Ongoing |
Subscriptions, family accounts and unauthorised purchase claims
Recurring billing generates a disproportionate share of first-party disputes, and the reason is structural rather than moral. A subscription charges a customer who is not present, on a date they did not choose, for a service they may have stopped using. Every one of those conditions weakens the memory link between the charge and the decision.
Trials and price changes
The first charge after a free trial is the single most disputed event in most subscription businesses. The customer signed up weeks ago, the value proposition was “free”, and the charge arrives with no accompanying action on their part. A reminder email a few days before the conversion, with a working cancellation link, converts a chargeback into either a retained subscriber or a clean cancellation.
Both major card networks have published requirements around trial disclosures, cancellation methods and transaction receipts for recurring arrangements, and several jurisdictions have layered consumer protection rules on top, including federal and state-level negative option rules in the United States. Those requirements have been revised repeatedly in recent years and are subject to litigation, so confirm the current position with your legal counsel and your acquirer instead of relying on any summary.
Family and shared cards
An unauthorised purchase claim frequently means “authorised by someone in my household who is not me”. A child on a parent’s card, a partner using a shared account, an employee on a company card: the transaction was made with permission to hold the card, if not permission for that specific purchase. This category is common in gaming, digital content, food delivery and marketplace apps.
United States consumer protection rules distinguish between a genuinely unauthorised transaction and one made by a person the cardholder gave the card to, and the consumer-facing guidance published by the Consumer Financial Protection Bureau on Regulation E and on credit card billing errors is a useful primer on how the categories differ. The practical merchant defence is a receipt that reaches the cardholder’s own email, plus spend controls and purchase confirmations for accounts with a history of this pattern.
Digital goods and instant delivery
Digital fulfilment removes the evidence merchants rely on most. There is no carrier scan, no signature and no photograph. What remains is the access log: download timestamps, licence activation, session duration, in-product events and the IP or device used to consume the product.
Instrument that early and retain it, because it is the only evidence you will have. The same logic is starting to apply to agent-initiated purchases, where the buying decision is delegated to software and the question of who authorised what becomes genuinely unsettled. We looked at how the networks are approaching that in agent chargeback rules and the 2026 holidays, and the evidence problem there is a direct extension of the digital goods problem here.
Delivery proof and the evidence trail worth keeping
Representment succeeds or fails on evidence gathered long before the dispute arrives. By the time you have 20 or 30 days to respond, you cannot retroactively ask the carrier for a photograph they never took. The evidence strategy has to be a fulfilment decision, not a dispute decision.
Evidence that moves the needle
A delivery scan with a timestamp, a geolocation and a photograph is the strongest single artefact for non-receipt claims. Signature capture matters above a value threshold that you should set from your own loss data rather than from a vendor’s default. For unauthorised claims, the useful set is the address verification result, the security code result, the authentication outcome where one exists, the device identifier, the IP address, and the login history around the purchase.
Visa’s compelling evidence framework for certain unauthorised disputes allows merchants to submit prior undisputed transactions from the same cardholder that share identifying elements such as device or delivery address. That mechanism has specific qualifying conditions and has been revised since launch, so verify the current requirements through your acquirer before building a process around it. Where it applies, it is one of the few tools that directly addresses first-party misuse rather than working around it.
Evidence that rarely does
Screenshots of internal admin tools, unstructured narrative letters, and terms and conditions pasted without an acceptance timestamp add length without adding weight. A short, structured submission that maps each piece of evidence to the specific claim being made outperforms a 40-page attachment almost every time.
The mechanics of assembling that submission, including what to include per reason code and how to sequence it, are covered in chargeback representment and building evidence that actually wins. The point worth carrying into fulfilment planning is simple: you are collecting for a reader who has minutes, not hours.
Retention and automation
Set retention windows from the outside in. Dispute filing windows run to 120 days from the transaction or delivery date under common network rules, second presentment adds more, and arbitration can extend the tail considerably. Holding fulfilment and session evidence for a year covers almost every realistic case, subject to whatever data protection obligations apply to you.
Automate the export. A manual evidence pack takes an analyst 20 to 40 minutes; a templated export driven off the order ID takes seconds and is more consistent. Consistency is what lets you measure win rates by dispute type.
| Evidence type | Where it matters most | Relative strength | Must be captured at |
|---|---|---|---|
| Photo proof of delivery with geotag | Goods not received | High | Delivery, by carrier configuration |
| Signature capture | Goods not received, high value | High | Delivery, by service level chosen at shipping |
| Prior undisputed orders sharing device or address | Unauthorised transaction | High where the network framework applies | Continuously, in order history |
| Address and security code verification results | Unauthorised transaction | Medium | Authorisation |
| Authentication outcome and identifier | Unauthorised transaction | Medium to high | Checkout |
| Post-delivery login, app session or review | Both categories | Medium | Product and web analytics |
| Digital access and licence activation logs | Digital goods, any category | High for digital, replaces delivery proof | Fulfilment or product runtime |
| Terms acceptance with timestamp and version | Subscription and cancellation claims | Medium | Signup and each material change |
| Refund and settlement ledger extract | Double dip | Decisive | Refund processing |
When to refund, when to fight and when to blocklist
There is no universally correct answer, only an arithmetic that each merchant has to run on its own numbers. The inputs are the disputed amount, the chargeback fee, the cost of goods, the internal cost of assembling a representment, your observed win rate for that dispute type, and the customer’s lifetime value if they stay.
Do the arithmetic first
Fighting is rational when the recovered amount multiplied by the win rate exceeds the cost of the fight. For a low-margin item at a modest ticket, with a 20 percent win rate on that reason code, the maths usually says refund and move on. For a high-ticket order with photo proof of delivery and a strong reason code match, the maths often says fight.
Write the thresholds down and apply them mechanically. Teams that decide case by case end up fighting the emotionally annoying disputes rather than the winnable ones, which is how a dispute function consumes headcount while the ratio keeps climbing.
The ratio you cannot ignore
Both major networks operate merchant monitoring programs that measure dispute counts and ratios against published thresholds, with escalating fees and remediation requirements for merchants that exceed them. Those thresholds, the metrics they use and the enforcement stages have been restructured more than once in recent years, and Visa and Mastercard publish the current definitions in their merchant rules. Check where you sit with your acquirer rather than relying on a figure from a blog post or a vendor deck.
The practical consequence is that a chargeback has two costs. The direct one is the money and the fee. The indirect one is a ratio point that, at sufficient volume, can put your processing arrangements at risk. Deflecting a dispute into a refund removes both; winning a representment removes the first and, depending on the program, may not remove the second.
Restricting accounts without collateral damage
Blocklisting is the last lever and the easiest to misuse. Block at the account, email and address level rather than at the card level, because cards rotate. Require a defined pattern rather than a single event, log the reason, and build an appeal route staffed by a human.
Consider graduated restrictions before an outright block: prepayment only, no stored payment method, signature required on delivery, or removal of instant refund privileges. These preserve the revenue from customers whose behaviour was situational rather than habitual. Treat any decision that looks like a permanent denial of service as a policy question with legal input, not a fraud analyst’s discretionary call.
None of these levers works in isolation. Descriptor hygiene, subscription communications, evidence capture and dispute triage reinforce each other, and the return on each one rises when the others are in place. If you are building the program rather than tuning it, the sequencing and the surrounding controls are set out in the payment fraud and chargeback prevention guide, which covers third-party fraud and account takeover alongside the first-party problem described here.
A note on rules, figures and professional advice
This article is general information for retail and e-commerce operators. It is not legal, tax or regulatory advice, and it does not create any professional relationship. Card network rules, consumer protection regulations and monitoring thresholds differ by region, by card brand, by acquirer contract and by merchant category, and they are revised regularly.
Before you change a dispute policy, a subscription flow, a cancellation process or an account restriction rule, confirm the current requirements with your acquirer or payment service provider and, where the question touches consumer protection or contract law, with qualified legal counsel in the relevant jurisdiction. Primary sources are the published merchant rules from Visa and Mastercard, the regulations and guidance published by the Consumer Financial Protection Bureau and the Federal Trade Commission in the United States, and the equivalent regulator in your market.
One further caution on tone. Describing a disputing customer as a fraudster in writing, whether in a representment file, a support macro or an internal ticket, creates risk and is usually inaccurate. Report what the data shows, describe the pattern, and let the issuer draw the conclusion. Background on how the term itself is used and contested is available in the Wikipedia entry on friendly fraud.
FAQ on friendly fraud
What is friendly fraud in simple terms?
It is a payment dispute raised by the real customer against a purchase they actually made and authorised. The card was not stolen and the account was not compromised. The customer bought the item and then told their bank the charge should be reversed, whether through genuine confusion, forgetfulness, a household member’s purchase, or deliberate abuse.
How is friendly fraud different from card theft?
Card theft involves a third party using credentials the cardholder never shared. The signals differ sharply: stolen-card orders typically come from new accounts, unfamiliar devices, mismatched addresses and short account histories, and the dispute arrives quickly. First-party misuse comes from established accounts on known devices, with normal delivery patterns, and the dispute usually arrives weeks after delivery.
Why does my fraud tool not catch it?
Fraud scoring models are built to answer whether the person at checkout is the legitimate cardholder. In first-party misuse the answer is yes, so there is no anomaly to detect. Detection has to come from post-purchase data instead: delivery confirmation, dispute timing, account-level claim history and refund reconciliation.
Does 3-D Secure prevent friendly fraud?
Only partially. Authentication and the associated liability shift apply to unauthorised transaction disputes, not to service disputes such as goods not received or a subscription that was allegedly cancelled. A customer can authenticate successfully and still file a non-receipt claim, which remains the merchant’s exposure.
What is the fastest single fix for a rising dispute rate?
For most retailers it is the billing descriptor. Making the statement line lead with the trading brand and include a contact route removes a large share of unrecognised-charge disputes, is usually a configuration change at the payment provider or acquirer, and typically shows measurable effect within one to two billing cycles.
How many disputes should I actually fight?
Fight the cases where the expected recovery, meaning the disputed amount multiplied by your observed win rate for that reason code, exceeds the internal cost of assembling the evidence. Set that threshold in advance and apply it mechanically. Fighting everything burns analyst time on unwinnable cases, and fighting nothing invites repeat claims.
Can I refuse to sell to a customer who files repeated disputes?
Merchants generally have latitude over who they trade with, but the specifics depend on your jurisdiction, your contract terms and consumer protection law, so this is a question for legal counsel rather than a fraud policy decided in isolation. Practically, graduated restrictions such as prepayment only, no stored card or signature-required delivery are lower risk than an outright block and preserve revenue from situational cases.
What evidence should I collect before a dispute arrives?
Photo proof of delivery with a timestamp and geolocation, signature capture above a value threshold, address and security code verification results, authentication outcomes, device and IP data, post-delivery login or app activity, terms acceptance with a version and timestamp, and for digital goods the access and activation logs. Automate the export so the evidence pack is assembled from an order ID rather than by hand.
How long should I keep dispute evidence?
Long enough to cover the full dispute lifecycle, which under common network rules can run well beyond the initial filing window once second presentment and arbitration are included. A one-year retention on fulfilment and session evidence covers almost every realistic case, subject to the data protection rules that apply to your business. Confirm the current filing windows with your acquirer, since they vary by reason code and region.