Guide · Fraud
Friendly fraud: when the real customer disputes the charge
Friendly fraud, also called first-party fraud, is when the real cardholder makes a purchase and later disputes it, sometimes by mistake and sometimes on purpose. It usually arrives labeled as fraud. You beat it by proving the customer took part in the purchase, not by proving what they intended.
Key takeaways
- The cardholder is real. Friendly fraud isn’t a stolen card. It’s your actual customer disputing their own purchase.
- Most of it isn’t malicious. Forgotten purchases, family members and confusing statement names cause a lot of it.
- It usually shows up as “fraud.” The reason code says the cardholder didn’t authorize the charge.
- Prove participation, not intent. Records that tie the customer to the purchase win. Accusations don’t.
What is friendly fraud?
Friendly fraud, also called first-party fraud or first-party misuse, is when a legitimate cardholder makes a purchase and then disputes it later. Stripe’s definition splits it two ways: accidental, because the customer didn’t recognize the transaction, or deliberate, such as buyer’s remorse or an attempt to get something without paying.
The “friendly” part is misleading. It costs you exactly what true fraud costs: the sale, the dispute fee and whatever you already delivered. And it counts toward your dispute rate the same way.
What friendly fraud looks like
- “I don’t recognize this.” The name on the statement doesn’t match the name on your door or website.
- A family member bought it. A spouse or teenager used the card, and the cardholder didn’t know.
- Buyer’s remorse. The customer regrets the purchase and finds the bank easier than your return policy.
- Subscription regret. A renewal goes through, and the customer disputes it instead of canceling.
- “Never arrived,” but it did. The carrier or your records show delivery.
- Double dipping. The customer gets a refund from you and a chargeback from the bank.
Service businesses see their own versions: the patient who disputes a completed treatment, the client who disputes a no-show fee they agreed to, the member who disputes months of a gym membership they used.
Friendly fraud vs true fraud
No single signal settles it. Signals tend to cluster.
| Signal | Points to friendly fraud | Points to true fraud |
|---|---|---|
| Purchase history | Earlier orders from the same customer, never disputed | First order, or a sudden burst of orders |
| Device and IP | Match earlier orders or the customer’s home network | New device, mismatched location |
| Delivery or service | Delivered to the customer’s known address, or the customer showed up | New address, or no one showed |
| Use after purchase | Logins, downloads, appointments attended | None |
| Contact with you | Thank-you notes, follow-up questions, a refund request you declined | Silence, or an angry real cardholder who never heard of you |
Insight: a fraud claim that arrives right after you declined a refund request is one of the clearest friendly-fraud patterns there is. Keep that conversation. It shows the customer knew exactly who you were.
How Visa’s rules handle it
Visa built a specific defense for online friendly fraud, known as Compelling Evidence 3.0. Under Visa’s rules for card-absent fraud (condition 10.4), the merchant’s side can point to two earlier transactions on the same card that were never reported as fraud, processed more than 120 days before the dispute and within 365 days. At least two details must match the disputed purchase, and one of them must be the device ID, device fingerprint or IP address. The other can be, for example, the customer login or the full delivery address. Each transaction needs a description of what was bought.
Visa updated the rule for disputes processed on or after 24 October 2026: the earlier transactions can now come from the same card at one or more merchants. Your processor decides how you submit it. Stripe, for example, checks your history and pre-fills the data when a dispute qualifies.
Visa also puts a duty on banks. An issuer whose cardholder files five or more fraud disputes within 12 months must formally review the account to see whether first-party fraud abuse is happening.
How merchants fight friendly fraud
The winning question is simple: did this customer take part in this purchase? Records that answer yes are what work.
- Proof the customer received or used what they paid for: a delivery record, a signed form, an attendance log, account activity.
- Proof they agreed to the terms, and when.
- Their own messages to you about the order.
- Earlier undisputed purchases from the same customer.
What doesn’t work: calling the customer a liar. Banks lean toward their own cardholders, and an accusation reads as an attack. State facts. Let the records do the arguing. More in how to fight a chargeback.
Cutting friendly fraud before it starts
- Use a recognizable statement name, ideally with a phone number customers can call.
- Send clear receipts that say what was bought, when and from whom.
- Get agreement to your terms before payment, with a checkbox or signature you can show later.
- Remind before renewals and make canceling easy. Stripe suggests reminders about 7 days before a yearly renewal.
- Keep records for at least 18 months. Disputes on services can arrive long after the sale.
Dispute Daddy builds the response from the records you already have and keeps it factual, never accusatory. You approve it before you submit it. See how the Dispute Daddy Method works.
