Reason code · Mastercard
Mastercard 4837: no cardholder authorization
4837 is Mastercard’s main fraud code: the cardholder says they didn’t make or allow the purchase. The bank has 120 days from the transaction to file. You win it by tying the real cardholder to the purchase, not by showing the card was approved.
What 4837 means
4837, No Cardholder Authorization, is Mastercard’s main fraud code. The cardholder says they didn’t make the purchase and didn’t let anyone else make it. It’s the code you’ll see on disputed online, phone and keyed-in sales. Fraud on in-person chip cards often runs under 4870 or 4871 instead.
Some older codes point the same way. 4863 (does not recognize) and 4840 don’t appear in Mastercard’s current Chargeback Guide; fraud claims now run through 4837 and a few chip-specific codes.
What the customer told their bank
“That wasn’t me.” “My card was used without my permission.” Sometimes it’s real fraud. Sometimes it’s a family member, a forgotten order or a customer who wants their money back. That last one is called friendly fraud.
Time limit
The bank has 120 calendar days from the transaction for most transactions. It must also report the fraud to Mastercard on or before the day it files.
Your deadline is shorter: the due date on your notice. Mastercard gives your bank 45 days to send your response, which Mastercard calls the second presentment, and your processor keeps part of that.
What proof matters
Proof that ties the real cardholder to the purchase: authentication such as 3-D Secure, delivery to their verified billing address, or a registered account with earlier purchases they never disputed.
An account alone isn’t enough
Mastercard is strict about “we know this customer” evidence. A registered account by itself doesn’t count, and a guest checkout doesn’t count at all. The account needs something more, like earlier undisputed purchases or the same device and network.
It counts even when you win
Mastercard’s monitoring programs count every chargeback, win or lose. Stripe says fraud chargebacks coded 4837 feed Mastercard’s Excessive Fraud Merchant program, which also looks at how often you use 3-D Secure. Authentication helps twice: it’s proof in the dispute and it counts in your favor with the program.
The common mistake
Sending the approval code as proof. An approval means the card was valid and had funds. It says nothing about who used it.
Dispute Daddy builds this for you
Dispute Daddy pulls the order, account and delivery facts from your records into a response you review and submit. See how the method works.
