Chargebacks and payment fraud: catching them before the dispute
By the time a chargeback arrives, the money is already gone, leaving you with nothing but evidence. TruvaLI analyzes signals at the moment of payment, flagging transactions destined to become disputes before they are processed.
A chargeback occurs when a cardholder disputes a transaction, clawing back the funds from the merchant. The dispute might stem from actual fraud, where card details were stolen, or from friendly fraud, where the cardholder themselves disputes the charge. Distinguishing between the two after the fact is difficult, as only the transaction record remains.
Where does the cost come from?
The cost of a chargeback consists of three components: the refunded amount, the dispute fee charged per transaction, and the sanctions imposed by the payment processor when the chargeback rate exceeds a specific threshold. The third is the most expensive, as it impacts the merchant's license to operate rather than individual transactions.
This is why fighting chargebacks happens at the moment of transaction, not during the dispute process. By the time a dispute arrives, the outcome has already been decided.
Which signals are analyzed at checkout?
| Signal | What it indicates |
|---|---|
| Device ID | The card being used on a device it has never been associated with before |
| IP attributes | The address being a proxy or VPN, determined via rDNS and ownership records |
| Address match | Discrepancies between billing address, shipping address, and IP location |
| Card velocity | Multiple cards or amounts being attempted in rapid succession |
| Email attributes | Disposable providers, addresses not matching the name, or similar addresses in the system |
| Cart behavior | Order amounts, products, or delivery options that deviate from normal habits |
None of these signals reject a transaction on their own. The decision depends on the aggregation of signals and the threshold set by the institution.
How many accounts have used the same card?
Payment fraud is rarely limited to a single transaction. Clusters of accounts and transactions linked by the same card, device, or email pattern remain invisible when viewed individually. Link analysis uncovers these clusters: if one transaction is suspicious, others sharing the same card or device are also brought under review. Learn more on the fraud detection page.
Rejection has a cost too
There are two types of errors in payment fraud, and both are costly: letting fraud slip through, and rejecting a legitimate customer. Raising the threshold reduces chargebacks but also lowers sales. Finding the right threshold requires balancing these two costs, which varies from one institution to another.
This is why the impact of a threshold is measured before going live: the new rule is run against historical transaction traffic to see how many transactions it would reject and how many of those would actually turn into disputes. The rule simulation and backtesting page explains this in detail.
Is the evidence ready when a dispute arrives?
Responding to a dispute requires evidence: device and IP information at the moment of transaction, address matching, session history, and delivery records. Having this data stored alongside the transaction determines your leverage during the dispute process. Everything is kept together in the case record; the workflow is detailed on the alert and case management page.
A past chargeback case is a valuable source for rules: its pattern can be extracted and converted into a rule. The generating rules from past cases page explains this step. For transactions resulting from account takeovers, you can visit the account takeover page.
Common questions
- Why is the cost of a chargeback more than just the refunded amount?
- A dispute fee is added to the refunded amount for each transaction, and the payment processor imposes sanctions if the chargeback rate exceeds a certain threshold. The third is the most expensive because it impacts the merchant's license to operate.
- Which signals are analyzed at the moment of transaction?
- Device ID, proxy or VPN status of the IP, match between billing/shipping addresses and IP location, card velocity, email attributes, and cart behavior.
- Does a single signal reject a transaction?
- No. The decision depends on the aggregation of signals and the threshold set by the institution.
- Can you detect if the same card is used across different accounts?
- Yes. Clusters of accounts and transactions linked by the same card, device, or email pattern are uncovered using link analysis.
- Is raising the threshold always beneficial?
- No. Raising the threshold reduces chargebacks but also lowers legitimate sales. The optimal threshold is found by balancing these two costs.
- Can the impact of a new rule on sales be measured?
- Yes. The rule is run against historical transaction traffic, allowing you to see how many transactions it would reject and how many of those would actually turn into disputes before going live.
- What evidence is used when responding to a dispute?
- Device and IP information at the moment of transaction, address matching, session history, and delivery records. Having this data stored alongside the transaction determines your leverage during the dispute process.
- Can a rule be created from a past case?
- Yes. The pattern of the case can be extracted and converted into a rule, ensuring the same path cannot be exploited again.