Friendly Fraud: What It Is and How to Prevent It

Short answer: friendly fraud is a chargeback filed by the real cardholder for a purchase they did make. Sometimes it is an honest mistake, like not recognizing the name on the statement or forgetting a renewal; sometimes it is deliberate, like keeping the goods and claiming they never came. You prevent most of it with recognizable billing, fast refunds and clear policies, and you fight the rest with evidence: proof of delivery and a history of earlier undisputed orders from the same customer, which Visa's Compelling Evidence 3.0 rules are built around.

Friendly fraud at a glance#

The table is the reason friendly fraud needs its own plan. Most anti-fraud tools are built to stop strangers using stolen cards. Friendly fraud comes from a real customer whose payment looks fine at checkout, so the work moves to after the sale.

What is friendly fraud?#

Stripe's documentation defines it plainly: friendly fraud, "also known as 'first-party misuse' or 'first-party fraud'", occurs "when a legitimate cardholder makes a purchase, but then disputes it at a later date." It adds that this "can either be accidental, because they didn't recognize the transaction on their statement, or deliberate (for example, due to buyer's remorse or as an attempt to fraudulently obtain merchandise without paying)."

In practice a store sees four patterns:

1. "I don't recognize this." The statement shows a company name the customer does not connect with your shop, so they assume fraud.
2. "Someone in my house used my card." A partner or child placed the order. The cardholder reports it as unauthorized.
3. "I canceled" or "I forgot to cancel." A subscription renewed and the customer went to the bank instead of to you.
4. "It never arrived" or "it's not what I ordered" when it did arrive and matches the listing. This is the deliberate kind.

The first three are fixable with better communication. The fourth is the one you fight.

Which reason codes does friendly fraud hide behind?#

There is no "friendly fraud" reason code. The cardholder's bank files the dispute under whatever reason the cardholder gives. Stripe's reason code reference lists the ones that matter most:

Stripe also has an "Unrecognized" category and says it "is effectively indistinguishable from the Fraudulent reason." For defending 10.4, Stripe's reference suggests AVS and CVV match results, device and IP address data showing a known device or a consistent location, the customer's earlier successful purchases, any contact they made with support first, and proof they agreed to your terms.

Whatever the code, a dispute costs money. On Stripe's pricing page on 26 October 2026, each dispute carries a $15.00 fee, and countering one manually costs another $15.00 that is refunded only if you win. WooPayments' docs say dispute fees are debited as soon as a dispute arrives, you usually have 7 to 21 days to respond, and the bank usually takes 60 to 75 days to decide.

Visa Compelling Evidence 3.0: the main friendly fraud tool#

Compelling Evidence 3.0 (CE 3.0) is Visa's rule set for showing that a "fraud" dispute came from a real customer. We could not load Visa's own rule text on 26 October 2026, so the criteria below come from Stripe, which applies them for its merchants.

Per Stripe's support article, a dispute can qualify when:

• it is a Visa dispute with reason code 10.4 (card absent fraud);
• you can show two prior transactions with the same cardholder;
• each prior transaction was processed more than 119 and fewer than 366 calendar days before the disputed one;
• no fraud was reported on those prior transactions;
• the same payment credential was used;
• at least one of these matches across both prior transactions and the disputed one: customer email, delivery address, device ID or fingerprint, or IP address.

Stripe adds that "issuing banks still have discretion" over the result, and that a missing required field makes the dispute ineligible.

CE 3.0 can also stop a dispute before it is filed. Stripe's dispute prevention docs say that when you are enrolled in Visa's Order Insights and an issuer looks up a charge, Stripe can send prior transaction data. If at least two prior transactions with complete product descriptions have matching IP addresses and at least one matching email or delivery address, "the issuer must block the dispute", so you pay no dispute fee and your dispute rate does not rise. Stripe lists $15.00 per Visa CE 3.0 block on its pricing page.

The lesson for any store, on any gateway: CE 3.0 only works if every order carries the IP address, email, delivery address and product description, and if returning customers' earlier orders went through the same processor. Stripe's best practices say it "can't determine eligibility or submit evidence for externally processed transactions."

Evidence to keep in WooCommerce#

You do not need special software to start. You need to keep what WooCommerce and your gateway already record, and stop deleting it.

• The order itself. WooCommerce core saves the customer's IP address and browser user agent on each order, both from the classic checkout and from the Store API that the Checkout block uses (we read this in the WooCommerce 11.2.1 source). Do not strip or anonymize these fields earlier than your privacy policy requires.
• Gateway results. AVS and CVC match results and 3D Secure outcomes are on the charge in your gateway dashboard.
• Delivery proof. Tracking numbers, carrier delivery scans and, for high-value orders, a signature. Stripe notes that card issuers do not follow links, so save screenshots.
• Digital delivery proof. Download logs, license activations, logins and course progress tied to the customer's account.
• Customer contact. Order emails, support tickets and chat logs, especially any where the customer confirmed receipt.
• Policies as shown. Stripe's best practices say issuers can reject a checkbox that only links to your terms, and recommend showing the full policy at checkout and requiring agreement.
• Order history. Earlier undisputed orders from the same email, address or IP are your CE 3.0 evidence. A guest checkout with a different email each time makes them harder to match, so consider encouraging accounts for repeat buyers.

How to prevent friendly fraud#

Prevention matters more than winning, because a dispute you win still costs time and, on most gateways, a fee. Here is the order we would work in.

1. Make the charge recognizable#

Stripe's first tip for both fraud and unrecognized disputes is a statement descriptor customers recognize. Its best practices recommend your website domain or business name; descriptors are 5 to 22 characters. Send a receipt on every payment so the customer can search their inbox when the charge appears.

2. Make a refund easier than a chargeback#

Put your contact details on the receipt and the order page. Answer quickly. If a customer is about to dispute, a refund usually costs you less than a dispute fee plus the time to respond. Stripe also points out that a fully refunded payment cannot be disputed, but a partially refunded one can, for the full amount.

3. Handle subscriptions with care#

Make it clear at signup that the payment repeats, tell the customer before renewals, and let them cancel without a phone call. Canceled recurring is its own reason code on Visa (13.2) and Mastercard (4841), and it is almost always avoidable.

4. Ship and confirm#

Send tracking as soon as it exists, and keep delivery confirmation. For high-value orders, consider signature on delivery. Stripe suggests shipping to an address that passed AVS where possible, because otherwise you cannot show the goods went to the cardholder.

5. Use your gateway's pre-dispute tools#

If you are on Stripe, its dispute prevention integrates Visa's Order Insights and Mastercard's Consumer Clarity, which send order details to the issuer when a cardholder asks about a charge. That is often the moment a confused customer realizes the charge is theirs. The cost and coverage of these tools, and how they compare with paid guarantees, are covered in our chargeback protection guide.

6. Consider 3D Secure for risky orders#

Stripe's docs say payments successfully authenticated with 3D Secure "might be protected from most fraudulent disputes" through liability shift, though it "isn't guaranteed for any specific payment or dispute", and it does not apply to disputes for other reasons such as product not received. It helps with "I didn't authorize this", not with "it never arrived".

7. Know your PayPal limits#

If you also take PayPal, Seller Protection covers unauthorized payments and Item Not Received claims on eligible transactions, but PayPal's help page excludes claims that an item was "significantly not as described" and Item Not Received claims a buyer files directly with their card issuer. Keep the same evidence for PayPal orders.

What to do when a friendly fraud dispute arrives#

1. Read the reason code and match it to the table above. The code decides the evidence.
2. Contact the customer. If they simply did not recognize the charge, a quick conversation may end it. Ask your gateway how a refund interacts with a dispute that is already open before you send one.
3. Look for CE 3.0 eligibility on Visa 10.4 disputes. Stripe flags eligible disputes in its dashboard and email.
4. Assemble evidence: the order, IP and device, AVS and CVC results, delivery proof, customer messages, policies shown at checkout and earlier undisputed orders.
5. Submit before the deadline. WooPayments says the window is usually 7 to 21 days.
6. Record the outcome. If one customer disputes again and again, stop selling to them.

Where ChargeWarden fits, and where it does not#

Be clear about this: ChargeWarden is mostly a card-testing and stolen-card tool. It is built to stop strangers, and friendly fraud comes from your real customers, whose orders usually look normal at checkout. A low risk score does not mean an order cannot turn into a friendly fraud dispute.

What it does not do:

• It does not file or answer disputes, and it does not submit CE 3.0 evidence.
• It does not connect to Verifi, Ethoca, Order Insights or any other network alert.
• It does not set your statement descriptor, send receipts or manage refunds.
• It does not read chargebacks from your gateway to score customers.

What it can help with, according to its order risk scoring docs:

• Holding orders that deserve a second look. Points for a first order at or above your high-value amount (default 500 in your store currency), billing and shipping countries that differ, an IP country that differs from the billing country, and many cards tried in 24 hours can put an order in the review queue or on hold before you ship. That is when a phone call or an email confirming the order is cheapest.
• Stopping a repeat abuser. When you reject an order as fraud, you can tick "block this email, browser and IP", and the "Prior fraud match" rule adds 40 points to later orders with the same email, browser or IP. You decide who goes on that list; ChargeWarden does not decide for you.
• Reading your gateway's warnings. It reads WooPayments' fraud outcome and early fraud warning, PayPal's security code, address and 3D Secure results, and Stripe Radar reviews, and turns them into written reasons on the order. See gateway risk data.
• A written record. Every order gets its score and every reason in an order note, which helps you see later why an order shipped.

If friendly fraud is most of your dispute problem, start with the prevention steps above and your gateway's dispute tools. If you also see stolen-card orders or bursts of failed payments, that is the part ChargeWarden is built for. See WooCommerce card testing, and for a wider view of tools by store size, our ecommerce fraud prevention software guide.

How ChargeWarden helps alongside your dispute process#

Look at the review queue, held orders and written risk reasons on the live demo, and read the product page for what it covers and what it needs. On our pricing page on 26 October 2026, ChargeWarden is $129 a month for a single store, $199 for 5 stores and $349 for unlimited stores, billed monthly, with a 14-day store credit return if it is not right for you. Pick a plan.

This guide is general information, not legal or financial advice. Card network rules, fees and programs are from public provider pages on 26 October 2026 and change over time; confirm details with your payment provider. Visa, Mastercard, Stripe, PayPal and WooCommerce are trademarks of their owners. PluginLoom is not affiliated with or endorsed by any of them.