The Legal Risks of Chargeback Fraud: What Merchants Can Do
Quick answer
Friendly fraud and first-party fraud are civil matters, not criminal — making prosecution rare and expensive for individual cases. However, merchants can pursue civil remedies (small claims, demand letters), use CE 3.0 as a systematic evidence framework, and ban repeat offenders. The most practical legal strategy is documentation-driven representment that deters repeat fraud and recovers dispute revenue without litigation.
Many merchants assume chargeback fraud is something they must simply absorb. In fact, there are legal remedies — but they require understanding what kind of legal risk you're facing, what tools are available, and when litigation costs outweigh what you'd recover. This guide covers the legal landscape from criminal prosecution (almost never practical) to small claims (sometimes worth it) to proactive evidence systems (always worth it).
Is Chargeback Fraud Illegal?
Yes — intentionally filing a false chargeback dispute is fraud under most jurisdictions. The legal basis varies by country:
- United States: Wire fraud under 18 U.S.C. § 1343 — using electronic communications to commit fraud. Also potentially credit card fraud under state statutes.
- United Kingdom: Fraud Act 2006, Section 2 (fraud by false representation) — making a false representation to gain a financial advantage.
- European Union: Computer Misuse and fraud laws vary by member state, but intentional false dispute filing is generally actionable under national fraud statutes.
However, the gap between "illegal" and "prosecuted" is wide for chargeback fraud. Proving intent is difficult — a customer can always claim they genuinely did not recognize a charge or forgot a subscription. The dollar amount per case rarely justifies criminal investigation resources. Law enforcement consistently prioritizes organized fraud rings over individual friendly fraud incidents.
Practical reality
Unless you have documented evidence of a repeat fraud pattern from the same individual, or a case value exceeding $10,000, criminal prosecution is impractical. Civil remedies are almost always the more productive route.
Criminal vs Civil Remedies
Understanding the distinction between criminal and civil remedies is essential for choosing the right response strategy.
| Factor | Criminal | Civil |
|---|---|---|
| Who initiates | Law enforcement (you file a report, they decide) | You (directly sue the defendant) |
| Burden of proof | Beyond reasonable doubt | Preponderance of evidence (more likely than not) |
| Outcome for you | No direct financial recovery — defendant faces prison/fines | Court judgment requiring defendant to pay you |
| Practical case minimum | $10,000+ typically required for investigation | $100+ in small claims; $500+ to be practical |
| Lawyer required | No (you file report; DA handles) | No for small claims; yes for larger civil suits |
Civil remedies for chargeback fraud:
- Small claims court: For amounts under $10,000 in most US states (varies by state — California limit is $12,500 for individuals). No lawyer required. Process is relatively quick — typically 30–90 days. Best for clear-cut cases with strong documentation.
- Demand letter: A formal written demand for payment, often sufficient to deter repeat offenders without going to court. Low cost, and a court will note you made the attempt before filing.
- Court judgment: Harder to collect (you must locate and levy assets), but damages the fraudster's credit record and creates a public legal record. Useful as a deterrent for documented repeat offenders.
When Legal Action Makes Sense
A practical decision framework based on case characteristics:
Repeat offender — multiple chargebacks, same customer
A pattern of disputes from the same individual establishes criminal intent — the "I forgot" defense fails when there are three disputes across six months. This is the strongest case for both civil action and a criminal complaint. Document each incident in your fraud register from the first occurrence.
High-value single incident — over $1,000
At $1,000+, the math supports legal fees. Small claims filing costs $30–100 depending on state. Your time cost for a well-documented case is 2–4 hours. Recovery probability with strong documentation: 60–80%.
Organized ring — multiple accounts, same patterns
If you identify coordinated patterns — same IP across multiple accounts, same shipping address clusters, coordinated timing — escalate to the FBI Internet Crime Complaint Center (IC3) at ic3.gov. IC3 aggregates complaints across merchants and builds cases for prosecution.
Subscription fraud with ROSCA violations
If a competitor or fraudster is systematically disputing subscription charges in violation of ROSCA (Restore Online Shoppers' Confidence Act), the Federal Trade Commission has jurisdiction. FTC actions result in restitution to affected merchants.
Quick decision guide by dispute value:
- Under $300: Pursue representment only. Legal costs exceed recovery probability.
- $300–$1,000: Send demand letter + blacklist the customer. Legal action only if repeat offender.
- Over $1,000: Consider small claims. Evaluate based on documentation strength.
- Over $10,000 or repeat pattern: File IC3 complaint + pursue civil action with legal counsel.
How to Document Cases for Representment and Legal Action
The critical principle: document at order time, not after the dispute arrives. By the time a chargeback is filed, it is too late to capture the original session data.
What to capture and retain for every order:
- Full IP address and geolocation at time of purchase
- Device fingerprint (browser, OS, screen resolution, accepted languages)
- Account creation date and email verification timestamp
- Email confirmation send time and open timestamp (if tracked)
- Session logs — pages visited, time on site, cart actions
- All customer support transcripts and email correspondence
- Delivery confirmation and tracking data
Operational practices:
- Create a case file immediately when a chargeback is received — before responding to the acquirer. Pull all available data for that transaction while it is fresh and accessible.
- Maintain a fraud register: A spreadsheet (or dedicated system) tracking disputed customers, amounts, reason codes, outcomes, and any patterns. This is essential for identifying repeat offenders and establishing pattern evidence for legal action.
- Retain data for 24 months minimum — card scheme rules require representment evidence within specific windows, but legal action timelines can extend further.
Using CE 3.0 as a Legal-Grade Evidence Framework
Visa's Compelling Evidence 3.0 (CE 3.0) is the most powerful tool available to merchants fighting first-party fraud — both for chargeback representment and as a legal evidence record.
CE 3.0 shifts chargeback liability to the issuing bank when you demonstrate:
- Two prior non-disputed transactions from the same cardholder
- Same device fingerprint across prior and disputed transactions
- Same IP address (or consistent geolocation) across prior and disputed transactions
- Same account identifier
When all four match, the issuing bank cannot maintain the dispute — the documentation proves the cardholder has transacted with you before without disputing, establishing that the current dispute is inconsistent with their prior behavior.
The dual value of CE 3.0 documentation:
Wins the representment
Matching prior transaction data under CE 3.0 shifts liability and wins the dispute without requiring additional evidence. This is the most reliable path to reversing first-party fraud chargebacks.
Serves as legal evidence
The same documentation package — prior transaction records, device match, IP match — constitutes strong evidence of a pattern of authorized purchases in civil court. A CE 3.0 package that wins a representment is also exhibit A in a small claims case.
Build CE 3.0 documentation as standard practice — not just for disputes. The merchants who win representments and deter repeat fraud are those who capture prior transaction data systematically, not reactively.
Blacklisting and Prevention as Practical Alternative to Legal Action
For most merchants, the most cost-effective "legal" strategy is not litigation — it is systematic blacklisting combined with representment. A fraudster who is blocked from purchasing achieves nothing on repeat attempts.
What to blacklist after a confirmed fraudulent dispute:
- Card number (and BIN if pattern suggests card family)
- Email address (and domain if throwaway email pattern)
- Device fingerprint
- IP address (block at checkout, not just account creation)
- Shipping address (physical address fraud is often repeated)
Extend your fraud prevention network:
- Ethoca Merchant Insights / Consumer Clarity: Mastercard's network-level fraud reporting — flagging confirmed fraudulent accounts prevents them from defrauding other Ethoca-connected merchants
- Verifi Order Insight: Visa's equivalent — share transaction details that help issuers resolve disputes before they are filed
- Kount / Sift / Signifyd: Cross-merchant fraud intelligence networks where your blocked customer may already be flagged by another merchant
The deterrence effect: a customer who disputes and gets permanently blocked cannot extract repeat value. Combined with a successful representment (they lost their fraudulent chargeback), they have strong incentive not to attempt the same pattern elsewhere. This outcome — no money recovered by fraudster, blocked from future purchases, chargeback reversed — is better than most legal outcomes achievable at proportionate cost.
Frequently Asked Questions
Is friendly fraud illegal?+
Can I sue a customer who filed a false chargeback?+
When does it make sense to take a chargeback fraudster to court?+
What is the best way to document chargeback fraud for legal action?+
How do I use Compelling Evidence 3.0 to fight friendly fraud?+
ChargeMate builds the documentation record that wins representments today and supports legal action when warranted. $10/case.
See outsourcing plans →