Most Shopify chargebacks are process failures, not fraud rings. Answer each one inside your processor’s due date (often 7 to 21 days, and Visa’s US network window is now 9), fight only when evidence and break-even math agree, and fix descriptors, delivery proof and subscription consent before paying for alerts.
Winning a chargeback gets your money back. It does not erase the dispute from the count Visa and Mastercard use to judge you. Only prevention does that.
Last updated: October 6, 2026
Roughly 45% of chargeback volume worldwide is fraudulent, first party and third party combined, according to the 2025 State of Chargebacks report from Mastercard and Datos Insights. The majority are something else: a late package, an unrecognized charge, a forgotten renewal, a slow refund. The same report projects global chargebacks growing from 261 million in 2025 to 324 million in 2028, with value rising from $33.79 billion to $41.69 billion.
When we first published this playbook in January, the thesis was that most disputes are confusion, impatience, and process gaps. That still holds. What the original lacked was the clock: it set a 48 hour target without saying what the banks actually allow, said nothing on evidence retention, and ignored chargeback alerts. This update fixes all three and adds the math for deciding which disputes deserve your time.
Whether it’s your third dispute or your three hundredth, the loop is the same: prevent, answer on time with tight evidence, and accept the rest without guilt.
Most Shopify chargebacks happen because a customer believes one of three things: they didn’t buy it, they didn’t get it, or it wasn’t what they expected. Add “I canceled” and “I got charged twice” and you’ve covered most of the dispute inbox. Only some of those are true fraud, and the fix for each is different.
Stage matters. Early stage stores lose disputes because they can’t produce clean records fast: the tracking link is buried in a 3PL portal, the return policy was edited last month. Scaling brands lose for the opposite reason: evidence for one order is split across Shopify, the helpdesk, the subscription app, and the carrier with no single source of truth.
Here’s the conviction I’ve held since my years as a Senior Merchant Success Manager at Shopify: the merchants with the healthiest dispute numbers weren’t the ones with the most fraud tools. They were the ones whose customers could recognize the charge, track the package, and cancel without a fight. For the broader baseline, our guide to payment verification, red flags, and record keeping for fraud and chargebacks covers the habits that stop many disputes before they start.
The playbook runs as a four stage loop: prevention before the order, order signals between checkout and fulfillment (AVS and CVV mismatches, billing and shipping mismatches on high value first orders, velocity spikes, missing delivery scans), the evidence packet, and a monthly review by reason code. The rest of this piece walks that loop with deadlines and dollars attached.
The real deadline is the due date your payment processor shows you, not the card network’s window, and on Shopify Payments that date is typically 7 to 21 days after the chargeback is filed. Card networks give acquirers a longer window, and processors keep part of it for themselves to package and forward your response.
The network windows changed recently, and Visa’s got much shorter. Adyen’s published dispute timeframes list Visa at 9 days for disputes on payments processed locally in the United States and Canada from July 21, 2025, and 18 days everywhere else. Mastercard is 40 calendar days, American Express 14, and Discover 25. Shopify’s help center on managing chargebacks in the Shopify admin says the due date varies from 7 to 21 days, is set per case, and defaults to 11:59 PM in your store’s timezone. After it passes, you can’t submit anything. Shopify says there are no exceptions. Stripe’s dispute documentation gives the same “usually 7 to 21 days” range.
Network windows are as listed by Adyen, measured from the notice of chargeback. The 48 hour figure is our recommended internal standard, not a network rule.
Why 48 hours? Your processor due date can be as short as 7 days, and a dispute landing before a long weekend loses three of them before anyone looks. Deciding within 48 hours leaves the rest of the window for the one piece of evidence you don’t have handy, usually a delivery photo or support transcript. It also matters because you get one shot. Both Shopify and Stripe state that once evidence is submitted, you can’t edit it or add more. Shopify’s tools populate available data and send a response by the due date, so make the fight or accept call deliberately in the admin rather than letting the calendar make it for you.
Then expect to wait: Shopify’s overview of the chargeback process says review can take up to 75 days, Stripe says up to three months.
Fix three things before you pay for any chargeback tool: a statement descriptor customers recognize, delivery proof that holds up, and subscription consent and cancellation records that leave no doubt. Under roughly $2M in annual revenue, those three remove more disputes per dollar than anything you can buy, and they also make every dispute you do get easier to win.
Descriptor first. “I don’t recognize this charge” is the cheapest dispute to prevent. Your statement descriptor should read like the brand name on your packaging and order emails, not a legal entity or a parent company. Check it in your Shopify Payments settings, then look at a real card statement. Stripe’s guidance on monitoring programs and dispute prevention notes that a cluster of “general” or “duplicate” disputes often traces back to an unrecognized descriptor or a confusing receipt.
Delivery proof second. Item not received disputes are winnable when tracking shows delivery to the checkout address, and nearly unwinnable when it doesn’t. Show delivery timelines on the product page, cart, and confirmation email, and send delay notices before customers ask, the heart of reducing “where is my order” tickets with proactive tracking updates. Require a signature above a value threshold you set from your own dispute history.
Subscription consent third. Most subscription disputes are memory and cancellation friction. Capture explicit agreement to billing terms, send renewal reminders, and make cancellation take under a minute. Our guide to preventing chargebacks for Shopify subscription companies walks through the courtesy emails and descriptor checks in detail.
Then layer in tooling, starting with what’s free. Shopify Protect covers the order amount and chargeback fee on protected fraud based chargebacks for eligible Shop Pay orders from US based stores, provided the order ships with tracking from an approved carrier within seven days. It does not cover item not received, damaged, or not as described disputes, which Shopify’s help center on addressing chargebacks with Shopify Protect says go through the standard process. Shopify has also written about how its machine learning decides when to apply 3D Secure; our breakdown of how Shopify Payments uses machine learning to cut fraud chargebacks covers the reported results.
Chargeback evidence lives in at least seven systems, and you should keep it for at least 18 months, longer than most default log settings. Chargeflow’s chargeback evidence source map lays out the systems well, and its retention advice is the part most merchants miss: don’t assume a universal 120 day window, set retention from the longest dispute and escalation window you face plus an audit buffer.
Why 18 months? It’s our working floor, built from Visa’s own rule for fraud disputes. Under Visa Compelling Evidence 3.0, effective April 15, 2023, a card absent fraud dispute (reason code 10.4) can be answered by showing two earlier undisputed transactions on the same card that are at least 120 and no more than 365 days old. At least two of four data elements (user ID, IP address, shipping address, device ID or fingerprint) must match the disputed order, and one of the two must be the IP address or device ID. If your IP and device data rolls off after 90 days, you’ve thrown away the strongest friendly fraud defense Visa offers. Add the months a dispute can take to arrive and you pass 15 months quickly.
The other evidence killer is quiet change: tracking links expire, helpdesks get migrated, product pages get edited after the sale. Archive dated policy versions, then test the map by building full evidence packets for five recent orders. Whatever you can’t find is your integration backlog.
Keep each packet short and specific to the reason code. Stripe’s dispute evidence best practices note issuers won’t follow links or read your full terms, and cap evidence at 4.5 MB (19 pages for Mastercard).
Fight a chargeback only when three things are true: the customer’s claim is wrong, you have reason specific evidence that proves it, and the expected recovery beats the cost of responding. If any one fails, accept it, log why, and fix the upstream cause. Chargeflow’s five gate model for when merchants should fight a chargeback adds two gates worth keeping: confirm you’re still inside the deadline, and check whether a refund is already in flight before you do anything, so you don’t credit the customer twice.
The economics reduce to one formula. Break-even win probability equals your incremental cost to respond divided by what you recover if you win. Chargeflow’s illustrative table shows the shape: at $35 of added cost, a $25 dispute never pays back, while a $500 dispute pays back at a 7% chance of winning.
Here’s a worked version on Shopify Payments. This is an illustrative example, assuming a US store, an $80 order, the $15 USD chargeback fee Shopify lists for the United States, and 20 minutes of a team member’s time at $30 an hour, so $10 of incremental cost. Shopify returns the full amount plus the chargeback fee if you win, so you’re playing for $95. Break-even is $10 divided by $95, about 10.5%. With delivery proven on an item not received claim and an assumed 50% win chance, expected value is 0.5 times $95 minus $10, or $37.50. Fight it. Now take a $25 subscription renewal with no cancellation record and a generous 10% chance: 0.1 times $40 minus $10 is minus $6. Accept it. On Stripe, add the dispute countered fee times your chance of losing to the cost side; it’s refunded only if you win.
For calibration, Mastercard’s 2025 report puts the average representment win rate at 50% worldwide and 54% in the US. Treat that as a ceiling for well evidenced cases, not a default. Accepting a valid chargeback is not failure; Stripe notes it isn’t an admission of wrongdoing.
Item not received disputes with delivery proof and processing errors you can document are the easiest to win, while not as described and subscription cancellation disputes swing widely on the quality of your records. There’s no universal win rate chart for Shopify stores, because category, shipping method, and evidence discipline change outcomes fast. You can still predict direction by how provable the claim is.
The likelihood column is editorial judgment, not measured data. Stripe’s published model shows how hard the job is: its highest ranked disputes carry an expected 60% win rate, its lowest 5%. If one family keeps losing, the fix is upstream, in the product page, shipping promise, or cancellation flow.
Chargeback alerts are worth paying for when the disputes they deflect would otherwise be lost, or when your dispute ratio is close enough to a network threshold that every count matters. For most stores under roughly $2M, neither is true yet, and the per alert fee can cost more than the chargeback it prevents.
Alerts warn you that a cardholder has contacted their bank, so you can refund before a formal chargeback lands. The main rails are Ethoca Alerts from Mastercard and the Visa owned Verifi, whose Rapid Dispute Resolution (RDR) can resolve eligible Visa disputes automatically against rules you set, and whose CDRN network covers Visa and non Visa cards. Most merchants buy access through a reseller rather than directly. Chargeflow’s guide to choosing a chargeback alert provider makes a fair point that applies to every vendor, Chargeflow included: shared network access doesn’t mean identical service, so ask how each one handles unmatched alerts, orders already refunded, and duplicate billing.
The real benefit is monitoring math. Visa’s Visa Acquirer Monitoring Program (VAMP) fact sheet counts fraud reports plus disputes against settled transactions, and excludes disputes resolved through pre-dispute solutions. A won representment still counts. From April 1, 2026, the excessive merchant threshold in the US, Canada, the EU, and Asia Pacific is a 1.5% ratio with at least 1,500 fraud reports and disputes in a month. Mastercard’s Excessive Chargeback Merchant level starts at 100 chargebacks and a 1.5% rate, per Stripe’s summary of the program, and Mastercard counts chargebacks regardless of outcome.
Now run the numbers at a smaller store. Illustrative example, assuming an $80 order on Shopify Payments and an alert priced at $29 per deflected chargeback, which is one vendor’s published list price: deflecting costs the $80 refund plus $29, or $109. Losing the same chargeback outright costs $80 plus the $15 fee, or $95. Unless you’re near a threshold or would lose that dispute anyway, the alert costs more, and it can auto-refund disputes you’d have won with a delivery scan. Two exceptions pull that line earlier: your processor can hold funds or set a reserve well before any network program flags you, and a subscription store whose disputes are mostly unwinnable may find alerts pay sooner.
When you do reach that stage, compare options on the same scorecard. Shopify Protect covers eligible Shop Pay fraud for free. Stripe users get dispute tools and Visa CE 3.0 automation in the dashboard. Third party platforms include Chargebacks911, Justt, Disputifier, and Chargeflow, which mostly price on results or per alert. Disclosure: Chargeflow sponsors the eCommerce Fastlane podcast. That relationship doesn’t change the advice above.
What you do this month depends on volume: early stage stores build the evidence habit, growth stores assign an owner and a decision log, and scaling brands add monitoring and, only then, alerts. The common mistake at $500K to $2M is buying automation before the basics, which just automates a messy process.
If you’re under $500K, write the evidence packet template this week, confirm your descriptor on a real statement, and set a calendar rule that every dispute gets a fight or accept decision within 48 hours. If you’re between $500K and $2M, name one owner, keep a simple decision log (amount, reason code, deadline, decisive evidence, decision, outcome), set data retention to at least 18 months, and review losses by reason code monthly. Past $2M, track Visa and Mastercard ratios monthly, decide which reason codes alerts should auto-refund, and test vendors on your own exceptions rather than their headline percentages.
I fought chargebacks by hand back when I was selling online myself, long before any of these tools existed, and the core job hasn’t changed: know your deadline, know your evidence, and know when to let one go. What’s your most common reason code right now, and is it fraud, shipping, product expectations, or cancellation friction?
You typically have 7 to 21 days to respond to a Shopify Payments chargeback, and the exact due date is shown on each case in your Shopify admin. Shopify sets it per case, in your store’s timezone, with a default cutoff of 11:59 PM. After the due date passes, you can’t submit evidence, with no exceptions. The processor deadline is shorter than the card network’s window because Shopify needs time to forward your response. Visa’s network window for locally processed US and Canadian payments dropped to 9 days in July 2025, and Mastercard’s is 40 days. A good internal rule is to decide fight or accept within 48 hours of the notice, then use the remaining days to collect any missing evidence before you submit once.
It is worth fighting a chargeback when the claim is wrong, you have evidence that directly answers the reason code, and your expected recovery beats your cost to respond. Calculate break-even by dividing your incremental cost, mostly team time, by the amount you recover if you win. On Shopify Payments in the US, a win returns the order amount plus the $15 chargeback fee. Illustratively, $10 of labor on an $80 order needs about a 10.5% win chance to break even. Small disputes with thin evidence rarely clear that bar, while a delivered order with a matching carrier scan usually does. Accept the rest deliberately and fix the cause upstream.
Visa Compelling Evidence 3.0 is a rule that lets merchants defeat card absent fraud disputes, reason code 10.4, by showing the cardholder’s prior undisputed purchases. You need two earlier transactions on the same card that are at least 120 and no more than 365 days old and were never reported as fraud. At least two of four data elements must match the disputed order: user ID, IP address, shipping address, or device ID. One of the two matches must be the IP address or device ID. That is why you should keep IP and device data for at least 18 months. Stripe flags eligible disputes automatically, and it took effect in April 2023.
Chargeback alerts save money only when the deflected dispute would otherwise be lost or when your dispute ratio is close to a card network threshold. An alert lets you refund before a formal chargeback, which keeps it out of Visa’s VAMP count. But you still refund the order and pay the alert fee. Illustratively, an $80 order deflected at a $29 alert fee costs $109, while losing that chargeback on Shopify Payments costs $95. Alerts can also refund disputes you would have won. For stores under roughly $2M, fixing descriptors, delivery proof, and subscription consent usually removes more disputes per dollar first.
No, winning a chargeback does not lower your chargeback ratio, because card network monitoring programs count disputes received, not disputes won. Visa’s VAMP ratio counts fraud reports plus disputes against settled transactions, and only excludes disputes resolved through pre-dispute solutions and fraud reports that qualify for Compelling Evidence 3.0. Mastercard counts chargebacks regardless of outcome. Representment recovers your money but leaves the count untouched. That is why prevention and pre-dispute resolution matter more for ratio health than win rate. From April 2026, Visa’s excessive merchant threshold in the US, Canada, EU, and Asia Pacific is a 1.5% ratio with at least 1,500 monthly fraud reports and disputes.
Keep order, payment, delivery, support, and device records for at least 18 months as a working floor. Visa Compelling Evidence 3.0 looks back up to 365 days for prior undisputed transactions, and disputes themselves can arrive months after the order, so shorter retention quietly throws away your best fraud defense. Watch for evidence that disappears on its own: carrier tracking links that expire, IP and device logs that roll off, helpdesk tickets lost in a migration, and product pages edited after the sale. Archive dated copies of each policy version and key product pages. Test your setup by building full evidence packets for five recent orders and logging anything you can’t find.
