A chargeback is the forced reversal of a card payment, pushed back through the payment chain from the cardholder's issuer to the merchant's acquiring bank and then to the merchant. It is worth stating plainly at the start: chargebacks are creatures of private contract. Visa's and Mastercard's operating regulations — along with the rules of American Express and Discover for their own networks — define the reason codes, the evidence standards, the time limits, and the appeals. No federal statute creates a "right to a chargeback."
Sitting alongside that private system are genuine federal rights. The Electronic Fund Transfer Act and its Regulation E govern errors and unauthorized transfers on debit and prepaid accounts. The Truth in Lending Act and Regulation Z govern billing errors and unauthorized use on credit cards. Those two systems run in parallel, use different clocks, and produce different outcomes. Confusing them is the single most common mistake on both sides of a dispute.
Two systems running over one transaction
The network rulebook is private. Visa's Core Rules and Product and Service Rules, and the Mastercard Rules, bind every participant through a chain of contracts: cardholder to issuer, issuer to network, network to acquirer, acquirer to merchant. Those documents define dispute categories (fraud, authorization, processing errors, consumer disputes), the evidence a merchant may submit, the number of appeal rounds, and the fees each stage costs. Networks revise them on a published schedule, usually more than once a year, so any specific timeline should be checked against the current edition rather than a secondary summary.
The federal rulebook is statutory and covers the cardholder's relationship with the institution that issued the card. It does not tell the merchant anything directly. Regulation E gives a consumer error-resolution rights on electronic fund transfers; Regulation Z gives billing-error and unauthorized-use rights on credit accounts. A cardholder who wins under either regulation gets credit from the issuer whether or not the issuer ultimately recovers from the merchant.
Two consequences follow. First, "zero liability" advertising on debit cards is a network policy layered on top of Regulation E's statutory tiers — a voluntary promise, not the legal floor. Second, a merchant who wins a representment has not defeated the cardholder's federal claim against the issuer; those are different proceedings with different parties.
The lifecycle of a disputed transaction
- Cardholder contact. The consumer calls or files in-app. Well-run issuers first try a "retrieval" or good-faith merchant contact for non-fraud disputes, because that resolves a meaningful share without a formal case.
- Chargeback initiated. The issuer assigns a reason code and debits the acquirer. This is where the network clock starts; for many consumer-dispute codes the outer window runs about 120 days from the transaction or from the date services were expected, but the exact window varies by code and by network edition.
- Merchant representment. The acquirer forwards the case; the merchant has a short window — commonly around 30 days — to submit "compelling evidence" and reverse the debit. Missing this window is an automatic loss regardless of merits.
- Pre-arbitration. If the issuer rejects the representment, it can escalate. Both sides can add documents. Fees rise at each step.
- Arbitration or final ruling. The network decides and assigns costs. Because filing and ruling fees can exceed the transaction value, most low-ticket disputes end before this stage on economics alone.
Watch out: the transaction dollar amount is rarely the real exposure. Chargeback ratios drive network monitoring programs, and a merchant placed in an excessive-chargeback program faces per-dispute penalties, mandated remediation, higher processing costs, and in serious cases loss of acceptance. A merchant can win most of its cases and still be penalized for the volume.
Evidence that actually reverses a chargeback
Representment succeeds on documents, not explanations. A narrative letter without artifacts almost always fails. What the networks look for varies with the reason code, but a durable evidence file usually includes:
- Authorization records showing approval codes, AVS and CVV results, and any 3-D Secure authentication data — the latter often shifts fraud liability to the issuer entirely.
- Device and session data tying the order to the cardholder: IP address, device fingerprint, login history, and prior undisputed orders from the same account.
- Proof of delivery or access: signed carrier confirmation, tracking to the billing address, or for digital goods, timestamped download, activation, or usage logs.
- The terms the customer accepted — refund and cancellation policy, subscription renewal terms, and the checkout screen where those terms were displayed and affirmatively agreed to.
- The full customer service record: dates of contact, what was offered, and any partial refund already issued.
- For subscriptions, the enrollment record plus each renewal notice sent, because failure to give clear renewal notice is a frequent losing fact.
Digital and service businesses face the hardest evidence problem because there is no signed delivery receipt. Building the logging before disputes arrive is the only fix; you cannot reconstruct a session record after the fact.
How the federal rights compare
| Feature | Credit card — Regulation Z | Debit / prepaid — Regulation E |
|---|---|---|
| Notice deadline | Written billing-error notice generally within 60 days after the first statement showing the error | Notice generally within 60 days after the statement or electronic history showing the error |
| Institution response | Acknowledge within 30 days; resolve within two billing cycles and not more than 90 days | Generally 10 business days to investigate, or up to 45 days with provisional credit; longer for new accounts, point-of-sale, and foreign-initiated transfers |
| Liability for unauthorized use | Capped at $50 for unauthorized credit card use | Tiered — the cap rises sharply with delay in reporting a lost card or an unauthorized transfer |
| Merchandise quality claims | Claims and defenses against the issuer are available, subject to conditions including a good-faith attempt to resolve with the merchant | No parallel quality-of-goods right; the claim is an "error" only if it fits the regulation's definition |
| Practical effect of delay | Rights weaken but the account is not debited in the meantime | Money already left the account, so provisional credit timing matters more |
The row that changes real outcomes is the last one. On a credit card, the disputed amount is a line on a statement. On a debit or prepaid card, the funds are gone from the consumer's balance while the investigation runs, which is why the provisional-credit rules exist and why prepaid programs need them built into servicing — a point covered in detail in our guide to the prepaid accounts rule.
Program agreements, state law, and who eats the loss
Between the network rules and the federal regulations sits the layer that most often determines who actually pays: the commercial contracts. Merchant processing agreements typically make the merchant liable for chargebacks plus per-item fees, allow the acquirer to hold reserves, and permit termination for excessive disputes. Marketplace and payment-facilitator agreements push that liability onto sub-merchants, sometimes with broader indemnities than the network rules contemplate. Where a fintech sits between a bank and end users, the allocation questions look like those in our article on who owns compliance risk in embedded finance.
State law adds a further layer that varies meaningfully. Every state has an unfair or deceptive practices statute, and states differ on what those statutes reach, what remedies they allow, and whether private plaintiffs can sue at all. Some states have specific rules on automatic renewals and cancellation flows; others do not. No single state's approach is the national rule, and a merchant selling across state lines should assume the most demanding applicable requirement rather than the most convenient one — our overview of state UDAP statutes explains how those claims are structured.
Practical step: merchants should reconcile chargeback data against refund data monthly. A rising share of "goods not received" disputes usually signals a fulfillment or carrier problem, while a rising share of "unauthorized" disputes usually signals either genuine card fraud or an unclear billing descriptor. The reason-code mix is a better operational diagnostic than the total count.
When the card system is not the right forum
Card disputes handle a narrow set of problems well: charges you did not make, goods that never arrived, duplicate or wrong-amount postings, and subscriptions billed after cancellation. Disagreements about service quality, breach of a substantial contract, or damages beyond the transaction amount are not chargeback questions. When the amount is meaningful and the dispute is contractual, the ordinary civil route may be better — see our guide to preparing a small claims case.
Consumers who believe an issuer mishandled a Regulation E or Regulation Z investigation can submit a complaint to the CFPB, which routes it to the institution and records the response. Supervisory expectations for dispute handling also appear in examination materials published by the OCC and the FDIC.
Quick answers
Is a chargeback a legal right?
Not by itself. Chargebacks exist because the card networks' private operating rules require issuers, acquirers, and merchants to honor them. The genuine legal rights are separate: Regulation E error resolution for debit and prepaid accounts, and Regulation Z billing-error and unauthorized-use protections for credit cards. A consumer usually experiences both at once because the issuer runs the network process while performing its statutory duties.
How long do I have to dispute a charge?
Two clocks matter. The federal clock is generally 60 days from the statement showing the problem, under either Regulation E or Regulation Z depending on card type. The network clock for the issuer's chargeback is set by the operating rules and commonly runs to about 120 days for consumer-dispute codes, measured from the transaction or expected delivery date. Report early; waiting shortens options under both.
If a merchant wins the representment, has the consumer lost?
Not necessarily. Winning a representment resolves the network case between issuer and merchant. It does not extinguish the consumer's statutory claim against the issuer, and it does not resolve any underlying contract claim against the merchant, which can still be pursued in court. The consumer's practical options narrow, but the forums are genuinely separate.
What is "friendly fraud," and how do merchants defend against it?
It describes a cardholder disputing a purchase they actually made and received — sometimes deliberately, often because a household member ordered it or the billing descriptor was unrecognizable. The defenses are unglamorous: a clear descriptor that names the business the customer recognizes, delivery and usage logs, a documented refund policy, and prompt customer service records showing the customer was offered a resolution first.
Do prepaid cards get the same dispute protections as debit cards?
Broadly yes, through Regulation E's prepaid account rules, but there are conditions — including that some error-resolution duties depend on whether the account has completed the issuer's identity-verification process. Program managers should confirm their servicing flows match the regulation's text rather than assuming their debit-card process transfers over unchanged.
Your next moves
If you are a merchant, treat disputes as an operations problem before a legal one: fix descriptors, log delivery and usage, publish and honor a clear refund policy, and build the evidence file automatically rather than case by case. Read your processing agreement for reserve and termination triggers before your ratio climbs.
If you are a cardholder, notify the issuer in writing inside the 60-day window, keep the merchant correspondence, and say clearly whether you are reporting an unauthorized transaction or a dispute about goods — those are different claims with different proof. For related payment-side questions and how funds flow through these systems, the banking, payments, and fintech pathway collects the surrounding guides, including our analysis of when a payment product needs money-transmission analysis.