Over the past three years, the rate of first-party fraud, also called friendly fraud, in the United States has risen dramatically, especially with online transactions. Unscrupulous cardholders are leveraging the favorable cardholder dispute resolution rules to get their goods or services for free. One vendor specializing in helping merchants with card disputes claims that at least 60 percent of all chargebacks stem from first-party fraud
. The major growth in the overall share of online purchases has made investigations of claims more difficult, but the industry is working on ways to battle these fraudulent chargebacks. (See my October 2019 post about this crime.)
Processing a dispute is expensive for both issuer and merchant. Fees are imposed to cover the exception handling of the claim and related documentation between the issuer and the merchant. If the issuer upholds a claim, the merchant suffers the loss of the value of the goods or services as well as the costs of handling the dispute. In addition, merchants that have more than 1 percent of their sales disputed through the chargeback process are subject to monitoring by the card brand and to fines that could lead to the termination of their ability to accept payment cards.
To help address this growing problem, Visa announced new rules that could help merchants "win" a chargeback dispute in a card-absent, or online, transaction. While the other networks have not announced similar provisions, they are expected to do so for competitive reasons. What are the new rules?
The Visa Compelling Evidence 3.0 rules are scheduled to go into effect on April 15, 2023. In a nutshell, the updated dispute rules expand the definition of "compelling evidence" and allow the merchant to provide additional data to prove that the cardholder "participated in the transaction, received the goods or services, or benefitted from the transaction." The merchant must provide at a minimum:
- Customer account/login ID or delivery address
- Device ID or device fingerprint or IP address
- Data from at least two undisputed transactions at least 120 days old that match elements of the data from the disputed transaction with one of the elements required to be either the IP address or the device ID
Previously, merchants could challenge a chargeback using just one previous transaction where the IP, email, physical address, and cardholder's telephone number matched. Even with that extra information, however, there was no guarantee that the chargeback would be reversed.
Is this expansion going to stop all first-party fraud? Of course not. Criminals have shown resourcefulness in circumventing the fraud defenses put in place by merchants, issuers, and the networks and that will be no different in this situation. It will be interesting to see what impact the new rules will have on the rate of first-party fraud.
By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed