Chargebacks & fraud12 min readUpdated November 2, 2026

Friendly Fraud and First-Party Fraud: A Merchant's Guide

Friendly fraud and first-party fraud explained: the disputes they cause, Visa's CE 3.0 rules, the evidence that wins, and the subscription traps.

Nick Bonnassies, CMO at Tagada · checked against 9 sources

Article summary

TL;DR

Friendly fraud is a chargeback filed by the real cardholder on a purchase they made, by mistake or on purpose. It is the part of first-party fraud merchants see most. You can't block it at checkout, but you can make it rarer and winnable: a clear descriptor, easy cancellation, alerts, and the data Visa's Compelling Evidence 3.0 needs.

Friendly fraud means the real cardholder disputes a purchase they made. First-party fraud is the wider family, which also covers refund and free trial abuse.
Stripe treats an 'unrecognized' dispute as effectively the same as a fraud claim: most friendly fraud arrives as a fraud dispute.
Visa's Compelling Evidence 3.0 makes a card-absent fraud dispute invalid with two earlier undisputed purchases and matching data. Since October 24, 2026, those purchases can come from other merchants.
A Visa fraud dispute is also invalid when the payment was fully authenticated with 3D Secure (ECI 5 with a CAVV).
Most subscription disputes are prevented at signup: terms shown at consent, a reminder 7 days before a trial ends, and online cancellation.

Want to go further? Ask

On this page

A customer orders, receives the parcel, and a few weeks later their bank tells you they never authorized the payment. That's friendly fraud. Sometimes it is a mistake, sometimes it isn't, and the bank rarely knows which. This guide covers how to tell it apart, how to prevent it and how to win the disputes it causes.

What is friendly fraud?

Friendly fraud happens when a customer disputes a valid charge they made themselves. Stripe also calls it chargeback fraud: the customer buys, then tells the bank the payment was fraudulent or unauthorized.1 Mastercard describes it as "genuine transactions" that "are mistakenly or intentionally challenged by cardholders."3

The word "friendly" is misleading. Stripe lists four common causes:1

Forgetfulness
The customer doesn't recognize the charge on their statement, often a renewal or an unfamiliar descriptor.
Misunderstanding
The customer misread the terms, the trial or the return policy.
Someone at home
A family member used the card, and the cardholder disputes instead of asking.
Regret
The customer changed their mind and finds a chargeback easier than a return.

The first three are mistakes. The fourth, and the customer who keeps the goods and claims they never arrived, is deliberate. From your side the dispute looks the same, so the response is the same: the evidence that the cardholder took part.

Friendly fraud vs first-party fraud vs third-party fraud

The terms overlap, and sources don't use them the same way. The clearest line runs between who commits the fraud.

	Third-party fraud	First-party fraud	Friendly fraud
Who	Someone using another person's card or identity	The account holder themselves	The real cardholder
Scope	Stolen cards, account takeover	Any fraud by the holder: chargebacks, refund and trial abuse; for banks also false applications and bust-out fraud2	A dispute on a purchase the cardholder made1
Intent	Always	Usually deliberate	Mistaken or deliberate
What stops it	3D Secure, fraud rules, velocity limits	Policies, history, data	Clear billing, alerts, evidence
Dispute you see	Fraud (Visa 10.4)	Fraud, not received, refund requests	Fraud, unrecognized, cancelled subscription

For a store, first-party fraud mostly means three behaviors that Stripe tracks across its network: multi-account and free trial abuse, refund abuse, and disputes on purchases the customer made.4

Visa's own rules use the term too: an issuer whose cardholder files 5 or more fraud disputes within 12 months must review the account "to determine if first-party fraud abuse is occurring."6

How common is friendly fraud?

No card network publishes a single rate. The figures that circulate come from studies quoted by networks or processors, each on its own population.

75%

Share of digital goods merchants' card-not-present fraud estimated to be first-party fraud (Datos, quoted by Mastercard, 2023)

62%

Merchants reporting more disputes from first-party fraud over the past year (Merchant Risk Council, quoted by Stripe, 2026)

Fraud disputes in 12 months after which a Visa issuer must review the cardholder for first-party fraud

Sources: Mastercard press release, October 23, 20233; Stripe Blog, March 10, 20264; Visa Core Rules, October 24, 2026, section 10.4.7.36. Other numbers you'll see online, such as the share of all chargebacks that are friendly fraud, come from dispute-management vendors and vary widely.

How friendly fraud shows up in your disputes

The customer picks a reason, and the reason sets the evidence you need. Stripe says fraud is the most common dispute reason, and that an "unrecognized" claim "is effectively indistinguishable from the Fraudulent reason."5

What the customer claims	Visa code	What answers it
"I didn't make this purchase"	10.4, card-absent fraud	Compelling Evidence 3.0, 3D Secure authentication, proof the cardholder used or received the goods5
"I don't recognize this charge"	Usually filed as fraud	Same as fraud, plus the receipt and descriptor5
"It never arrived"	13.1	Tracking to the customer's address, delivery confirmation, usage logs for digital goods5
"I cancelled"	13.2, cancelled recurring	Active subscription, no cancellation on file, terms the customer accepted5
"I returned it" or "I'm owed a refund"	13.6, 13.7	Refund already issued, or the policy that says none is owed5

Reason codes one by one: chargeback reason codes. Your options before and after a dispute is filed: chargeback vs refund.

Warning signs of friendly fraud

You can't decline a payment for friendly fraud at checkout: the card and the buyer are real. The signs show up after the order.

Fraud dispute from a customer with earlier undisputed ordersThe cardholder, not a thiefCheck Compelling Evidence 3.0 eligibility first
Dispute filed with no message to supportThe customer went straight to the bankSay so in your response; show your contact options
Not received, but tracking shows deliveredPossible false claim, or a parcel taken at the doorSend tracking, address match and any signature
Disputes right after each renewalCustomers forget the subscriptionDescriptor, renewal reminders, online cancellation
Same customer, repeated refund claimsRefund abuseRefund policy limits, block future orders

Compelling Evidence 3.0: Visa's rule against friendly fraud

Compelling Evidence 3.0 (CE 3.0) turns a customer's history into proof. It applies to Visa condition 10.4, card-absent fraud. Under the rules in force since October 24, 2026, the dispute is invalid when all of these hold:6

The same card, or a token linked to it, was used at one or more merchants in 2 earlier transactions the issuer did not report as fraud.
Those transactions were processed more than 120 days before the dispute and no more than 365 days before it.
You give a detailed description of what was bought in the disputed and earlier transactions, or a purchase order number in some authenticated flows.
The device ID or device fingerprint, or the IP address, plus one more element (login ID, full delivery address), match between the earlier and disputed transactions.

Fig. 1A dispute CE 3.0 makes invalid

Disputed order · Visa •4821Fraud dispute, condition 10.4, filed November 20, 2026

Earlier order 1: March 10, 2026 · 255 days before · undisputed
Earlier order 2: May 20, 2026 · 184 days before · undisputed
IP address: Same public IP on all three
Delivery address: Same full address on all three
Product descriptions: Provided for all three

Illustrative record.

two old orders beat one claim

Illustrative example.

Visa sets strict formats: IP and delivery address in clear text, a device fingerprint of at least 20 characters, and since October 2026 device ID and device fingerprint count as one element, not two.6 The full rule and data table: Compelling Evidence 3.0.

CE 3.0 works at two moments. Before a dispute, through Visa's Order Insight, the issuer sees the earlier orders and the dispute is blocked; Stripe says that adds no dispute fee and no increase in your dispute rate.9

After a dispute, it becomes your response. Stripe flags eligible disputes and prefills the earlier transactions, but only from charges it processed.8 How the pre-dispute tools work: chargeback alerts.

Other ways a Visa fraud dispute becomes invalid

The same table makes a 10.4 dispute invalid when the payment was fully authenticated with 3D Secure (ECI 5 with a CAVV), or when the issuer has already filed more than 35 disputes on that card within the previous 120 days.6

Visa also polices the merchant side. Under its Fraud Dispute Monitoring Program, a merchant found falsifying data to qualify loses this protection on future disputes until the problem is fixed and confirmed in writing.6 Send real data, captured at the time of each order.

What Mastercard does about first-party fraud

Mastercard has no CE 3.0. Its answer is the First-Party Trust program, announced on October 23, 2023.

Merchants share extra transaction data, either "as part of the transaction" or "post transaction as part of the disputes process," and Mastercard offers "merchant chargeback protection for disputes that meet First Party Trust data sharing requirements." The rollout started in the US in 2024.3 Ask your processor whether it takes part.

Subscriptions: where most friendly fraud starts

A renewal the customer forgot looks, on their statement, like a charge they never made. Visa's rules for recurring payments are written to stop exactly that, and following them is also your best evidence.6

At signup, show the terms of the recurring payment, including the fixed dates or interval of the charges.
Offer a simple way to cancel, and an online one if the customer signed up online.
At least 7 days before a trial, intro offer or promo ends, email the amount and date of the next charges with a link to cancel online or by text.
When a renewal is disputed as cancelled (13.2), check whether the claim holds: Visa makes it invalid for a customer-initiated payment, an unscheduled card-on-file charge, a claim of fraud, or a cancellation dated after the transaction.
Know the limit: a 13.2 dispute only covers the unused part of the service or goods.

Source: Visa Core Rules, October 24, 2026, table 5-20 and tables 11-98 and 11-99.

Trials attract their own abuse. Stripe reported a "significant increase in abusive free trials" across its network from November 2025 to February 2026, mostly people cycling through trials with several accounts.4 The rules for trials and "until cancelled" offers: free trials and negative option billing. Renewals and failed payments: subscription payment processing.

How to prevent friendly fraud

Prevention works on the three things behind most cases: the customer doesn't recognize the charge, can't reach you, or finds the bank easier than your refund process.

Move	Stops
A statement descriptor with the brand name customers know5	"I don't recognize this charge"
A receipt by email after every payment and renewal5	Forgotten purchases
Renewal reminders and online cancellation, as Visa requires6	"I cancelled" disputes
Fast refunds when the customer has a point	Disputes filed out of frustration
Visible support contact on the receipt and the site	Customers going straight to the bank
Alerts: Order Insight, RDR, Ethoca	Disputes resolved before they count
IP, device, login and full address saved on every order	Lost CE 3.0 eligibility
3D Secure on risky first orders	Fraud claims on authenticated payments

Eighteen measures ordered by stage and reason code: how to prevent chargebacks. Alerts, costs and setup: chargeback alerts.

How to fight a friendly fraud chargeback

Fight when the evidence answers the reason code. Accept when the customer has a point: a late parcel, a cancellation you missed, a product that didn't match its page.

Fig. 2From dispute to decision

Read the reasonFraud, not received, cancelled, refund owed
Check CE 3.0Visa fraud disputes on repeat customers
Gather proofDelivery, usage, terms, earlier orders
Respond on timeShort letter, evidence attached

answer the claim, not the customer

Evidence types from Stripe Docs, Dispute reason code categories, read November 2, 2026.

For a fraud claim, Stripe's guidance is to show that the legitimate cardholder, or someone they authorized such as a family member, made the payment; that 3D Secure authenticated it; that you already refunded; or that the customer withdrew the dispute or admitted filing it in error.5

For physical goods, Stripe lists photos or emails linking the recipient to the cardholder, and proof the cardholder has the products.5 For digital goods, usage, logins and downloads tied to the customer.5

A customer who admits the mistake can withdraw the dispute through their bank. Ask, in writing, and attach their reply to your evidence. To write the response: chargeback rebuttal letter. Fees and timelines: chargebacks for merchants.

Refund abuse: the quiet form of first-party fraud

Refund abuse never reaches the bank. Stripe defines it as customers who "request refunds for goods or services they've already received and plan to keep": false "not delivered" or "defective" claims, refunds after fully consuming a digital good, repeated refunds on the same card or account.7

Stripe's Radar now gives each payment a refund abuse risk level, but warns that it reflects "the likelihood that a payment will result in a refund policy violation," not fraud.7

Use it to enforce your refund policy, for example by reviewing refund requests from customers who already had several, not to decline first orders. A written policy, limits on the number of refunds per customer, and proof of delivery do most of the work.

How Tagada helps

Disputes you can answer, on every processor

Native 3DS2, device intelligence and a rules engine: "approve real customers, block the rest."
Your vault: "Your PCI-tokenized cards, your customer profiles, your subscription data, all portable."
Subscriptions with trials, billing cycles, retries and automatic recovery.
Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with one logic; switch processors without re-onboarding customers.
TagadaPay underwrites every file and refuses businesses that try to get around chargeback rules.
From 2.9% + $0.29, no setup fees, no monthly minimums. High-risk verticals and edge cases are priced case by case.
24/7 human support on Slack Connect.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply today · Go live in under 24 hours

Apply for processing

Disputes you can answer, on every processor

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What is the difference between friendly fraud and first-party fraud?

Friendly fraud is a chargeback filed by the real cardholder on a purchase they made. First-party fraud is the wider term for fraud by the account holder themselves. For a merchant it covers friendly fraud, refund abuse and free trial abuse; for banks it also covers false credit applications and bust-out fraud.

Can you win a friendly fraud chargeback?

Often, if you kept the data. On Visa fraud disputes, Compelling Evidence 3.0 makes the dispute invalid when the same card made two earlier undisputed purchases with a matching IP address or device plus one more element. For other claims, delivery proof, usage logs, signed terms and your cancellation records answer the reason code.

How do you prove friendly fraud?

You prove the cardholder took part or benefited. Stripe lists evidence such as photos or emails linking the recipient to the cardholder, delivery to a verified address, logins and downloads for digital goods, earlier undisputed orders on the same card, and messages where the customer recognized the charge. Proof of an issued refund also closes the case.

Does 3D Secure stop friendly fraud?

It stops one form. Under Visa's rules, a card-absent fraud dispute is invalid when the payment was fully authenticated with 3D Secure (ECI 5 with a CAVV). It does nothing for 'not received', 'not as described' or 'cancelled subscription' claims, which follow the normal dispute process and need their own evidence.

Should I block a customer who filed a chargeback?

Usually, for future orders, unless it was a genuine mistake you have since cleared up. Block on the card, email, device and address together. Stripe's refund abuse risk level flags serial refund abusers, but Stripe says it measures policy violations, not fraud, so use it to enforce your refund policy rather than as a fraud score.

Do friendly fraud disputes count in my chargeback ratio?

Yes, a filed dispute counts, won or lost. What stays out: a dispute blocked before filing through Visa Order Insight with Compelling Evidence 3.0, disputes resolved through alerts such as RDR or Ethoca at Stripe, and, in Visa's VAMP ratio, fraud reports covered by Compelling Evidence 3.0.