A Customer Disputed a Payment. The Bank Will Not Take Your Word for It.

The email arrives with all the drama of a delivery notification. A customer has disputed a payment. There is a transaction reference, an amount, a date from six weeks ago, and no explanation worth reading. By the time you open it, the money has already left your account.

You packed that order. It went out the same day. The courier's tracking number is still sitting in your inbox and you can remember the customer's name. None of that is the point. The bank is not asking for your version of events. It is asking what your website can still produce, months after the sale, in a format a card scheme will accept.

That is a very different question, and most business owners only discover the difference the first time it costs them.

What Actually Happens After That Email

A card dispute, the thing everyone calls a chargeback, is not a complaint. It is a formal reversal of funds that runs on scheme rules with fixed deadlines, and you are the last party to hear about it.

The sequence is short. Your customer contacts their bank. The bank, the issuer in scheme language, files a dispute under a specific numbered condition. Money is pulled back through your acquirer and out of your settlement, usually with a fee attached. You then get a window to respond with evidence. If your evidence holds, the funds come back. Where the issuer disagrees, the case can go to pre-arbitration and then arbitration, and the fees there start to look silly next to the value of a €70 order.

Now the part that catches people out. Visa's public rules give issuers 120 calendar days from the transaction processing date to raise most disputes, and for goods that were promised for a later delivery date that outer limit stretches to 540 days ^[1]. A sale you made last September can be reversed in February. If your order records, your delivery confirmations and your email thread with that customer are not still retrievable, you are not defending anything. You are guessing, in writing, to a bank.

The Two Disputes That Land on Businesses Like Yours

Almost everything you will see falls into one of two buckets, and they need completely different answers.

The first is card-absent fraud. Visa files this as dispute condition 10.4, and it means the cardholder says the transaction was not made by them. Somebody used card details online, or somebody says they did.

The second is non-delivery. Visa's condition 13.1 covers the customer who admits they made the purchase but says the goods or services never arrived. The rules describe it plainly: the cardholder took part in the transaction, but did not receive what was bought because the merchant was unwilling or unable to provide it ^[1].

Read that second one again, because there is a detail in it worth money to you. Under Visa's rules, before an issuer may raise a 13.1 dispute, the cardholder must first attempt to resolve it with the merchant ^[1]. Attempt. Not succeed. An unanswered contact form, a voicemail nobody returns, a support address that lands in a folder you check on Sundays: that is how an ordinary "where is my order" question gets promoted into a scheme dispute with a fee attached. The dispute you never receive is the cheapest one you will ever handle.

The Evidence That Wins, and the Evidence That Quietly Fails

Now to the part that surprises everyone. Not all proof of delivery counts.

For a non-delivery dispute, Visa's rules require proof of delivery containing the full delivery address, and they say explicitly that tracking with a partial address is not permitted ^[1]. A tracking page showing "Delivered" against a town name is not evidence. It is a screenshot. Where the order was collected rather than posted, the rules want an acknowledgement from the cardholder or an authorised person: a signature, a PIN, a collection code.

I have told business owners in the past that a courier tracking number would cover them. That was lazy advice on my part, and the scheme rules have said otherwise for years. What covers you is a delivery record that names the address in full and can be produced in one piece, months later.

One more change is worth knowing, because it moved in your favour. For dispute responses processed on or after 18 April 2026, where you have supplied evidence of delivery or collection, the issuer is now required to certify that it reviewed that information with the cardholder and to address what you sent, including a photo or a signature specifically ^[1]. Documented evidence has become harder for a bank to skim past. Vague evidence has not improved at all.

Consider a workwear supplier in Carlow shipping a pallet of site boots to a building contractor. The pallet goes to a site office, somebody in a hi-vis signs the courier's handheld, and eleven weeks later the cardholder disputes the charge because the boots never reached the person whose card paid for them. If the delivery record shows the full site address that was entered at checkout, that dispute is arguable. Should it show only a town and a squiggle, the money is gone and so are the boots.

The Sentence in EU Law That Decides Who Pays for Fraud

Fraud disputes work differently, and one sentence in the second Payment Services Directive governs them. Article 74(2) reads: "Where the payee or the payment service provider of the payee fails to accept strong customer authentication, it shall refund the financial damage caused to the payer's payment service provider" ^[2].

In plain terms: if your checkout does not put the customer through strong customer authentication, the 3D Secure step where the bank app asks for a fingerprint or a code, the loss on a fraudulent transaction can be pushed back to you. Accept authentication and the liability for most card-absent fraud generally sits with the issuer instead. That one setting in your payment gateway is worth more than any dispute-fighting service you could buy.

The data behind it is not subtle. In the joint payment fraud report the European Banking Authority and the European Central Bank published in December 2025, remote card payments accounted for roughly 83% of all card fraud by value in 2024, while remote transactions made up only about 28% of card payment value overall ^[3]. The annual fraud rate for remote card payments came in around 0.091% of value against roughly 0.007% for payments made in person, so about thirteen times higher.

Card fraud losses on EU and EEA-issued cards reached €1.329 billion in 2024, up somewhere near 29% year on year, and the report notes that fraud rates on remote card payments where authentication was skipped or exempted ran between 0.01% and 0.17%, against an overall card fraud rate closer to 0.033%.

There is an Irish wrinkle in the same report. In Ireland, payment providers absorbed over 80% of reported card fraud losses in 2024, one of the highest shares in the EEA ^[3]. Your customer is very likely to be made whole. That does not mean the cost evaporates. It means it moves, and for card-absent sales it moves in your direction unless authentication and evidence say otherwise.

The Purchase History You Already Own

If the disputed transaction was fraud, there is a route that most small sellers never use, and it runs on data you may already be storing.

Since 15 April 2023, Visa's compelling evidence rules let a merchant contest a card-absent fraud dispute by showing a purchase footprint. You supply two previous undisputed transactions from the same customer credentials, each at least 120 days old and no older than 365 days at the dispute date. At least two of four data elements must match across the prior transactions and the disputed one, from user ID, IP address, shipping address and device fingerprint, and one of the two matches has to be the IP address or the device ID. Get it right and liability shifts back to the issuer ^[4].

Two practical consequences follow. First, a regular customer who disputes a charge is the easiest dispute to defend, provided you kept the history. Second, you get one attempt: Visa's guidance is blunt that an incomplete or incorrect submission will be declined ^[4]. Guest checkout that stores nothing beyond an email address throws this defence away before you know you needed it, and so does a site that quietly discards order data every few months.

What Your Website Has to Be Able to Produce

Strip away the scheme jargon and a dispute defence is a filing exercise. A site that is set up properly hands you the file in ten minutes. A site that is not sends you rooting through a courier's portal and a payment dashboard while the clock runs.

You want to be able to produce, for any order from the last eighteen months:

• The order record itself, with a timestamp, the items, the amount and the delivery address exactly as the customer typed it
• Proof of delivery or collection carrying that full address, or the signature, PIN or collection code
• The terms, delivery timescales and refund policy as they were published on the day of the sale, not as they read today
• The email or message thread showing you answered the customer before the bank got involved
• The authentication result from your payment gateway, where your provider exposes it
• A billing descriptor on the customer's statement that resembles your trading name, because "unrecognised charge" is a dispute reason all by itself

Most of that is a hosting and records question rather than a legal one. Your order history has to survive plugin updates, a botched theme change and the day you break your own checkout. On Web60 that means nightly backups with one-click restore, staging to test checkout changes, and a database manager, included in the €60 a year, so the order from last spring is still there when a bank asks about it.

If you are still working out how card payments should run on your own site rather than a marketplace, our guide to taking payments on your own website covers the setup side, and the rules on what your website must show about delivery charges matter here too, because an undisclosed charge is a dispute you have already lost. Your published terms and returns pages are the document a bank reads when the customer claims the policy said something else.

The Four-Step Routine When a Dispute Lands

1. Verify the condition first. Read which numbered dispute you are actually answering, because the evidence for "I never got it" is nothing like the evidence for "that was not me".
2. Assemble before you write. Pull the order record, the full-address delivery proof, the message thread and the authentication result into one file. If a piece is missing, that gap decides your strategy, not your confidence.
3. Submit once, completely. You generally get a single attempt, and an incomplete response is declined rather than corrected. Slow down for twenty minutes.
4. Fix the cause, not the case. Log why it happened. Unrecognisable descriptor, no signature on high-value deliveries, a support inbox nobody watches: each one is a repeat customer of your dispute queue.

When Fighting It Is Not Worth Your Afternoon

Some disputes are simply lost, and pretending otherwise wastes a morning you could have spent selling.

If you posted an item with no signature and no full-address delivery record, and the customer says it never arrived, you have nothing a bank will accept. You will lose. The fee stands. Refund it, log the lesson, and start capturing signatures on anything above the value you would hate to lose twice.

It is also worth knowing where the scheme monitoring thresholds actually sit, because they get quoted at small sellers to frighten them. Visa consolidated its fraud and dispute monitoring into a single programme with thresholds effective from 1 June 2025, based on a ratio of fraud and dispute counts against settled card-absent transactions. In the EU, the excessive merchant threshold is a ratio of 220 basis points combined with at least 1,500 fraud and dispute cases in a month, tightening to 150 basis points from 1 April 2026 ^[5].

Fifteen hundred cases in a month. If you are running a shop, a clinic or a trade business, that programme is not your problem. Your problem is the per-dispute fee, the stock you will not see again, and the hour it takes you to answer.

And there is one genuine case for the other side of the argument. If you sell a handful of low-value items a month, and the prospect of assembling evidence files honestly does not fit in your week, a large marketplace with its own buyer-protection process will absorb this entire category of admin for you. You pay for it in commission on every order, forever, and you never own the customer relationship. For some sellers, that trade is the right one. Most businesses with a real order book are better off keeping the margin, because paying a percentage of every sale to avoid a handful of disputes a year is an expensive way to buy peace of mind.

What It Comes Down To

A dispute is decided on paperwork, not fairness. The card schemes have written down exactly what they will accept, they publish it, and they will not make allowances for the fact that you know you posted the parcel.

So the sale is not finished when the money lands in your account. It is finished when the record of it is complete enough to survive a bank asking, four months later, whether it ever happened at all. Have a look at the last order you shipped and ask whether you could put that file together this afternoon. If you could, the next one of these emails is an admin task rather than a bad day.

Frequently Asked Questions

How long after a purchase can a customer dispute a payment?

Longer than most sellers expect. Visa's published rules set a 120 calendar day limit from the transaction processing date for most dispute conditions, measured from the transaction or from the expected delivery date depending on the case, and for goods promised for a later delivery date the outer limit runs to 540 calendar days. Practical upshot: keep order records, delivery proof and customer correspondence retrievable for at least eighteen months.

Can I refuse a chargeback?

You cannot refuse the reversal itself. The funds are taken back first and the argument happens afterwards. What you can do is submit a dispute response with evidence through your payment provider, and if it meets the scheme's requirements for that dispute condition the money is returned to you. Whether it succeeds depends almost entirely on the quality of the records you kept at the time of the sale.

Does 3D Secure mean I am protected from fraud disputes?

It shifts the odds substantially rather than removing the risk. Under Article 74(2) of the second Payment Services Directive, a payee or payee's provider that fails to accept strong customer authentication has to refund the resulting damage, so switching authentication off is expensive. With authentication accepted, liability for most card-absent fraud generally sits with the card issuer. Exemptions, low-value transactions and sales outside the EEA still leave gaps, which is where the EBA and ECB found the highest fraud rates.

Is a courier tracking number enough proof of delivery?

Usually not. Visa's rules require proof of delivery containing the full delivery address and state that tracking with a partial address is not permitted. A tracking page showing a town and a delivery timestamp will not carry a non-delivery dispute. Ask your courier what a full delivery record looks like on their system, and use signed delivery for anything you would not want to lose twice.

What if the customer collected the order in person?

Collection can be defended well, provided you captured an acknowledgement. The rules look for a signature, a PIN or a collection code from the cardholder or an authorised person at pick-up. A note in a diary saying "collected Tuesday" is not evidence. If you run click and collect, make the acknowledgement part of the handover routine rather than something you remember to do on busy days.

Should I just refund straight away to avoid the hassle?

Sometimes, and it is a commercial decision rather than a moral one. Where the evidence is thin, refunding early avoids fees and keeps a customer who may well be honest. If you have complete records and the disputes are becoming a pattern from the same buyer, defending them is worth the time, and a customer with a normal purchase history is one of the easier cases to win. What you should not do is refund and also let the dispute run, because you can end up paying twice.

Sources