I Built an AI System to Catch + Fight Chargeback Fraud

So check this out, man. I've been getting these charge back notifications on my, my credit card account, and most of the time, what I'll do is I just, we'll just accept the charge back because honestly, I don't want to deal with it.

The juice isn't worth the squeeze, and that phrase is doing a lot of work, because the squeeze is real. Every chargeback comes with a non-refundable fee from your processor, usually somewhere between fifteen and fifty dollars depending on your risk profile, and you eat that fee whether you win the dispute or lose it. So on a sixty dollar order, you can spend forty minutes assembling evidence, pay the fee anyway, and still walk away worse off than if you had just let it go.

That math is exactly why chargeback fraud works, and the people doing it know the math better than most merchants do.

Before I explain what I built, you need the whole pathway in your head, because almost everybody misunderstands where in the process they actually are when the email lands.

A cardholder calls their bank and says they didn't get the product, or they don't recognize the charge, or the product wasn't what was described. The issuing bank, which is the bank that gave them the card, makes a fast judgment call and in most cases issues a provisional credit right there, meaning the customer has their money back before anyone has looked at a single shred of evidence. The bank then assigns the dispute a reason code, which is a numbered category that defines what the customer is actually claiming, and pushes the debit through the card network to your acquiring bank, and your acquirer pulls the money out of your account and sends you a notice with a deadline.

So by the time you find out, the money is gone, the customer already has it, and instead of filing a complaint, you are appealing a verdict that's already been handed down.

Your appeal is called representment, which just means you are re-presenting the transaction to the issuer with evidence attached, and the issuer decides whether to reverse it. If they rule against you and you still think you're right, you can escalate to pre-arbitration and then arbitration, where the card network itself makes the call and the losing side pays fees that can run past five hundred dollars, which is why almost nobody escalates a small order.

There's a second clock running underneath all of this that matters more than any single dispute. Visa puts merchants into its dispute monitoring program at 100 disputes and a 0.9 percent chargeback ratio in a month, and Mastercard's excessive chargeback threshold sits at 100 chargebacks and 1.5 percent, and once you're in one of those programs you're looking at fines, forced remediation plans, and eventually losing your ability to process cards at all.

Which means every chargeback you quietly accept counts against your ratio exactly the same as one you fight and lose, and accepting it doesn't make it disappear, it just makes it invisible to you while it stays visible to the network.

So what I did instead today is I built a machine that basically analyzes the charge back to make sure that if we actually delivered the product in this person is like trying to file charge back fraud, we can actually dispute automatically with the evidence to the bank so that we don't lose that money.

The reason a machine works here is that representment amounts to document retrieval under a deadline rather than persuasion, and the thing that kills most merchant disputes is that the evidence submitted doesn't answer the specific claim being made.

If the reason code is merchandise not received, the issuer is looking for proof of delivery to the address on file, and your beautifully written letter about your refund policy is irrelevant to that question and gets discarded. If the code is fraud in a card absent environment, meaning someone claims their card was used without permission, then delivery proof alone is weak and what you actually need is evidence tying the cardholder's own identity to the order, since a different claim requires a different file entirely.

So the first thing the system does is read the reason code and decide which evidence set the case requires, and then it goes and pulls that specific set.

For a not-received claim it pulls the carrier tracking number, the delivery scan with timestamp and geolocation, the shipping address as it appeared at checkout, and the address verification result from the moment of authorization. For a fraud claim it pulls the IP address the order was placed from, the device fingerprint, the account login history, the email address and whether that inbox opened the confirmation and shipping notices, and every prior order that same card ran through us without complaint.

That last piece is the one most merchants leave on the table, and it's now written directly into the network rules. Visa's compelling evidence 3.0 standard, which went live in April of 2023, says that if you can show two prior transactions from that cardholder that were at least 120 days old and never disputed, and those transactions share at least two matching data points with the disputed one such as device ID, IP address, delivery address, or account ID, the liability can shift back to the issuer before the dispute is even fully processed.

You can only produce that if you stored the IP and device data at the time of the order. Nobody can go back and retrieve it later, and that's the entire reason the machine exists on the collection side and not just the response side.

Well, some fucking cocksucker, he's been ordering products from our store and then charging them back after they deliver. And I didn't even realize it because I honestly didn't think that it was possible for you to be that big of a piece of shit.

This pattern has a name in the industry, first party misuse, and estimates of how much of all chargeback volume it accounts for range from about a third to well over half, and the range is that wide because nobody can reliably measure intent. A customer who forgot a subscription and a customer who runs the same play on twelve stores a month produce identical entries in your dispute report.

The only thing that separates them is repetition, and repetition is invisible to a merchant who accepts every chargeback without logging it. If you never build the record, the second order from the same person looks exactly like a first order from a good customer, and you ship it, and you lose again.

So the system flags on identity fragments rather than on names, because names are the easiest thing in the world to change. It matches on card BIN and last four, on shipping address normalized down to unit number, on device fingerprint, on IP subnet, on email root before the plus sign, and on phone number, and if any of those touch a prior disputed order, the new order gets held before fulfillment instead of after.

Holding before fulfillment is the whole point, because a dispute you win still costs you the fee and the ratio hit, while an order you never ship costs you nothing.

So I was like, you know what? Initially I called the phone number and I'm like, let's get this fucking asshole on the phone and figure out what the hell's going on.

Of course it's a fake number.

And a fake number at checkout is a signal you can screen for automatically, because carrier lookup APIs will tell you in a few hundred milliseconds whether a number is a real assigned line, a voice over IP number, or a disconnected string of digits. Same with email age, same with whether the billing zip matched the issuer's records, same with whether the IP is coming through a commercial VPN or a data center range.

None of those on their own mean fraud, and plenty of honest people use VPNs and burner numbers, which is why you score them together rather than blocking on any single one, and you set the threshold at the point where holding an order for manual review costs you less than shipping it.

Now, obviously we need to cancel the order. But before we cancel that, hold on.

I'm like, Hey, text Cassie, my assistant, and tell her to get the biggest blackest girthiest suction cup dildo that you can find on the internet and have it sent over here.

So we're going to send this guy a big, huge black suction cup dildo for him to stick onto his shower wall so he can ram himself while he tries to rip small business owners off.

And then on top of that, we've already got a glitter bomb on its way to his house, so when he opens it, it's going to explode all over and destroy the inside of his living room.

He's actually not far from Hollywood. And it would be kind of funny if we went and, you know, hand delivered his package for him, if you know what I'm saying, we could find out real quick if Michael is willing to put the same energy behind his fraudulent ass in person that he's willing to try to do anonymously.

So anyway, I figured I'll give you a call and share that with you because I figured you'd get some entertainment from it.

The entertainment doesn't scale, though, and that's worth sitting with, because the glitter bomb handles one guy on one afternoon while the actual problem is a percentage that shows up every single month whether you're paying attention or not.

If you're running a store and you want to fix this without building anything complicated, start by storing the data you're already generating. Log the IP address, the device fingerprint, and the address verification and card security code results on every single order, and keep them attached to the order record for at least thirteen months, because that's the window disputes can arrive in.

Then get delivery confirmation on everything and signature confirmation on anything above whatever dollar amount your average fraud loss sits at, since a tracking number with a delivery scan is the single strongest document in a not-received dispute.

Then clean up your billing descriptor so it contains your actual store name and a working phone number, because a meaningful share of disputes are people who genuinely don't recognize a charge, and those never become chargebacks if the customer can identify the line item or reach you first.

After that, turning on the pre-dispute networks, Verifi's Order Insight and Ethoca's alerts, pushes your order details to the issuer's call center screen while the cardholder is still on the phone, and a lot of confused disputes die right there before a reason code ever gets assigned.

And build the repeat-offender hold, because that's the piece that turns a machine that recovers money into a machine that stops losing it.

The thing worth understanding about this whole system is that the bank never sees your business, it only sees a file. The customer tells a story to their bank, and if you don't tell a competing story with timestamps attached, the bank decides based on the only version it has, and it decides fast, and it decides against you.

So the machine isn't really about winning arguments with issuing banks. It's about making sure that six months from now, when somebody claims a box never arrived, the answer already exists in a database with a delivery scan and a device fingerprint and two prior undisputed orders sitting next to it.

Fraud like this only works on merchants with no memory.