Friendly fraud: Causes, consequences, and prevention

Friendly fraud accounts for as much as 70% of all credit card fraud, according to Mastercard. It happens when a legitimate cardholder makes a purchase, then disputes the charge with their bank rather than contacting the merchant. The cardholder claims the transaction was unauthorised, or that goods or services were never delivered, when in fact they were.

The label is misleading. The cause varies: a customer forgetting the transaction, a teenager using a parent's card, a deliberate attempt to keep both the goods and the money. Whatever the trigger, the merchant absorbs the same outcome: lost revenue, chargeback fees, scheme penalties, and operational costs.

This guide explains what friendly fraud is and why accidental and intentional cases require different responses. It then covers what it costs UK and EEA merchants and the specific controls that prevent and recover it.

What is friendly fraud?

A friendly fraud chargeback happens when a legitimate cardholder disputes a charge they actually made instead of contacting the merchant for a refund. Also known as first-party fraud, it differs from criminal fraud because the cardholder genuinely made the transaction. The fraudulent element is the dispute itself, not the purchase.

The distinction between friendly fraud and criminal fraud matters because the response to each is fundamentally different. Criminal fraud usually shifts liability to the issuer under scheme rules, leaving the merchant with limited recovery. Friendly fraud chargebacks, by contrast, remain merchant-recoverable through evidence-based dispute response.

Friendly fraud is sometimes called chargeback fraud, particularly when the dispute is intentional rather than accidental. The terms overlap, though chargeback fraud usually refers specifically to the deliberate cases. Refund abuse is a different problem entirely: customers exploiting return policies to keep goods, without involving the bank dispute process at all.

Accidental vs intentional friendly fraud

Not all friendly fraud is the same. The cardholder's intent determines both what triggers the dispute and what the merchant can do about it. Accidental cases respond to clearer communication; intentional cases respond to evidence-based defence.

UK and EEA merchants in subscription and digital categories should treat dispute response as a standard operational function. Prevention and defence work together.

Friendly fraud consequences for UK and EEA merchants

Friendly fraud carries direct financial costs and longer-term operational risks. The visible cost is the lost sale and the chargeback fee that follows. The less visible cost is what happens when dispute volumes start counting against scheme monitoring thresholds.

Direct fee impact

When a customer disputes a legitimate charge, you lose the sale and face chargeback fees on top of it. Acquirers in the UK and EEA typically charge between £15 and £25 per dispute, regardless of whether the merchant wins the eventual representment.

This means that a merchant absorbing 50 disputes a month faces up to £1,250 in fees alone. That figure excludes the lost transaction value and the cost of refund processing. The cumulative effect compounds: even successful representments do not always recover the chargeback fee, and won cases still consume time from finance and customer service teams.

Operational and customer service strain

Friendly fraud also pulls disproportionately on internal resources. Each dispute requires evidence collation, response within scheme deadlines, and ongoing case tracking until the issuer rules. For UK and EEA merchants without a dedicated dispute response function, this work usually falls on customer service teams that were not built for it.

The result is slower customer response times for legitimate enquiries and a steady drain on margin that does not appear on a P&L line. In subscription and digital categories, dispute response often becomes a full-time function before any formal headcount is approved for it.

VAMP exposure and long-term consequences

The longer-term consequence is that friendly fraud disputes count toward the Visa Acquirer Monitoring Programme (VAMP). VAMP replaced VDMP and VFMP across UK, EEA, and global markets, combining dispute and fraud signals into a single monitoring ratio. Friendly fraud chargebacks count regardless of intent. The cardholder filed the dispute, so the merchant carries the count.

Breaching VAMP thresholds triggers escalating consequences. Acquirers face increased monitoring obligations from Visa. They typically pass these through to the merchant as elevated processing fees, mandatory remediation plans, and tighter risk reviews. Merchants who remain above threshold for extended periods can face termination of their merchant account, with knock-on effects for any other acquiring relationships. 

The stakes are higher for UK and EEA merchants in CBD, online trading, online dating, or adult physical goods. Replacing a terminated acquiring relationship in those categories is harder and more expensive than in mainstream retail.

How to prevent friendly fraud

Preventing friendly fraud is not a single control. It spans billing communication, transaction authentication, catching disputes before they become formal chargebacks, and defending the disputes that do land. The right combination depends on category, transaction type, and current dispute volume.

Clear billing descriptors

The descriptor on a customer's bank statement is the first thing they see when checking their charges. If it does not match the customer-facing brand, they may not recognise the transaction and dispute it in confusion. Visa and Mastercard descriptor fields each have specific format requirements: merchant name, city, and a contact identifier. UK and EEA acquirers can set these statically or dynamically per transaction.

For multi-brand or subscription merchants, dynamic descriptors that include a product reference or ticket number significantly reduce accidental disputes. The minimum standard for any UK or EEA merchant is a descriptor that exactly matches the trading name on the receipt and order confirmation.

3D Secure 2 and Strong Customer Authentication (SCA)

3D Secure 2 (3DS2) and Strong Customer Authentication (SCA) are the most consequential friendly fraud controls available to UK and EEA merchants. Under PSD2, SCA requires two of three authentication factors at checkout: knowledge (password), possession (device), or inherence (biometric). When SCA is correctly applied, liability for fraud-related disputes shifts to the issuer rather than the merchant.

This matters because friendly fraud disputes raised under fraud reason codes (such as Visa 10.4) cannot easily succeed against a properly authenticated transaction. The cardholder authenticated themselves at the time of purchase, which contradicts a later claim that the transaction was unauthorised.

Exemptions to SCA exist (low-value transactions, transaction risk analysis, trusted beneficiaries), but applying SCA wherever possible remains the strongest defensive posture. Merchants in subscription, digital, and recurring billing models should treat 3DS2 as default rather than exception.

Behavioural fraud analytics and chargeback alerts

Behavioural fraud analytics catch suspicious activity at the point of authorisation, before the order ships. Device fingerprinting compares the device used for a purchase against the device history for that cardholder. Velocity checks flag rapid sequential purchases or unusual transaction patterns. Together, these tools reduce both friendly and criminal fraud by adding context to the authorisation decision.

Chargeback alerts work after authorisation but before a formal chargeback is recorded. Verifi's Rapid Dispute Resolution (RDR) and Cardholder Dispute Resolution Network (CDRN) let merchants refund disputed transactions automatically when a cardholder contacts their issuer. Ethoca provides similar coverage across Mastercard. The chargeback fee is avoided, the dispute does not count toward VAMP thresholds, and the customer gets a refund without the bank involved.

For UK and EEA merchants in subscription, digital, or recurring billing categories, alert programmes are usually the highest-ROI dispute control after SCA. They convert disputes that would have become chargebacks into clean refunds.

Defending disputes through representment

Once a friendly fraud chargeback lands, the merchant has formally 30 days, though processors typically require responses within 7–18 days.

The framework is Visa Compelling Evidence 3.0 (CE3.0), which accepts evidence of a prior trust relationship rather than proof of delivery alone. Qualifying evidence includes two prior undisputed transactions with matching payment credentials. The transactions must also share one common data element such as IP address, device fingerprint, account login, or shipping address. 

Physical goods cases benefit from signed delivery confirmation; digital and subscription cases benefit from login records, IP matches, consumption logs, and 3DS2 authentication records. Mastercard accepts similar evidence categories.

The response runs in three steps: classify the dispute by reason code, assemble the evidence package, and submit it through the acquirer within the scheme deadline. The strongest outcomes come from merchants who build evidence collation into the order workflow rather than scrambling after a dispute lands.

How Fibonatix helps UK and EEA merchants tackle friendly fraud

Fibonatix builds friendly fraud controls into the acquiring relationship rather than selling them as separate add-ons. This matters most for UK and EEA merchants in CBD, online trading, online dating, and adult physical goods, where dispute profiles differ from mainstream retail.

• 3DS2 and SCA implementation with PSD2 liability shift handling.
• Pre-chargeback alert integration with Verifi RDR, CDRN, and Ethoca.
• Dispute representment under Compelling Evidence 3.0, with evidence collation built into the order workflow.

Disclaimer: Fibonatix is a UK-based, FCA-regulated payment service provider (FRN 768776) specialising in merchant accounts for B2C businesses globally, but B2B exclusively to the UK and EEA. Verify our regulatory status on the FCA Financial Services Register.