Friendly Fraud: Preventing Disputes From Real Customers

The recurring-billing requirements do most of the work

Under the 18 April 2026 Visa Core Rules, a merchant taking recurring transactions must provide a simple cancellation procedure and, if the order was initially accepted online, at least an online cancellation procedure; must include the fixed dates or intervals on which transactions will be processed; and must, at least 7 days before a recurring transaction, notify the cardholder by email or another agreed method if a trial period, introductory offer or promotional period is about to end. That notice must include the transaction amount and the transaction date of subsequent recurring transactions, and a link or other simple mechanism letting the cardholder cancel easily online or by SMS. In the US, ROSCA separately requires a seller using negative option marketing online to disclose all material terms clearly and conspicuously before obtaining billing information, obtain express informed consent before charging, and provide “simple mechanisms for a consumer to stop recurring charges.” Between them, these cover the single largest category of disputes from real customers.

When a cancelled-recurring dispute is not valid

Visa's Dispute Condition 13.2 (Cancelled Recurring Transaction) applies where the cardholder withdrew permission to charge the credential, or where the acquirer or merchant was notified before the transaction was processed that the account was closed. The rules limit the dispute amount to the unused portion of the service or merchandise. They also make the dispute invalid in defined situations, including an installment transaction, an unscheduled credential-on-file transaction, a cardholder-initiated transaction, a transaction the cardholder states is fraudulent and — effective for disputes processed on or after 18 April 2026 — a transaction where the cardholder's cancellation came after the date of the transaction. The issuer must also certify particulars: the date permission was withdrawn, the contact details used to reach the merchant, and any other form of payment provided. Keeping a timestamped cancellation log is what lets you test those certifications.

What an acquirer may send in response

For a 13.2 dispute, the rules list the evidence an acquirer may provide, including that a credit or reversal the merchant issued was not addressed by the issuer, that the cardholder requested cancellation for a different date and services were provided until that date, that the merchant posts charges after services are provided and the cardholder received services until the cancellation date, or that the cardholder used the service after the withdrawal-of-permission date and before the dispute processing date. Usage logs and the cancellation date you recorded are therefore the response, not an afterthought.

The “I did not make this purchase” version

Some friendly fraud arrives as a fraud dispute rather than a service dispute. Visa's compelling evidence table for card-absent fraud allows, among other items, evidence that three or more of the following were used in an undisputed transaction — customer account or login ID, delivery address, device ID or device fingerprint, email address, IP address, telephone number; evidence that the transaction was completed by a member of the cardholder's household or family; evidence of one or more non-disputed payments for the same merchandise or service; and, for a recurring transaction, all of a contract between merchant and cardholder, that the cardholder is using the merchandise or services, and a previous transaction that was not disputed. That list is a data-retention specification. If your systems do not keep login IDs, device fingerprints, IP addresses and the history of undisputed charges against the same customer, you cannot assemble it later.

Make yourself easier to reach than the issuer

For a non-receipt dispute under Dispute Condition 13.1, the issuer's supporting documentation includes, as applicable, certification that the cardholder attempted to resolve the matter with the merchant. The rules also require a cardholder letter where the cardholder has disputed three or more transactions for non-receipt at the same merchant on the same card within a single 30-calendar-day period. A visible phone number, a monitored inbox and a refund path that takes minutes routes the complaint to you rather than to the bank, and a refund you process yourself costs the sale without the dispute fee or the ratio damage.

Why the dispute arrives months later

Cardholders have a statutory route of their own. Under Regulation Z, a billing error notice must reach the creditor no later than 60 days after the first periodic statement reflecting the error, the creditor must acknowledge it in writing within 30 days, and must complete the resolution procedures within two complete billing cycles and no later than 90 days. That is the lag. It is also why a billing descriptor the customer recognises on a statement prevents more disputes than any evidence package assembled afterwards. This is general information, not legal advice (September 17, 2026).