Fraud, sourced
Chargeback and Refund Fraud in 2026: A Merchant's Defense Playbook
Fraud is climbing and AI is lowering the cost of attacks. Every figure sourced and dated: the true cost per dollar, the three attacks that need three defenses, the new Visa VAMP thresholds, and a playbook that fights fraud without wrecking your checkout.
Chargeback and refund fraud have quietly become a tax on selling online. Merchant losses from online payment fraud are forecast to exceed $362 billion globally across 2023 to 2028, with $91 billion in 2028 alone (Juniper Research, 2023). And the sting is worse than the sticker price: LexisNexis puts the total cost at $4.61 for every $1 lost to fraud for US ecommerce and retail merchants (True Cost of Fraud Study, 15th edition, April 2025).
This is a playbook, not a panic piece. Every number below carries its source and date, we flag which figures are ecommerce-specific and which come from broader financial-services panels, and the last section is a defense method you can run without strangling your own checkout. Because the fastest way to lose money to fraud is to lose more money fighting it.
The short version: fraud is a growth tax now
TL;DR Online payment fraud losses are forecast to top $362 billion globally from 2023 to 2028 (Juniper Research), and each dollar lost costs US merchants $4.61 in total (LexisNexis, April 2025). The order value is the smallest part of the bill.
Every merchant knows the headline: fraud is up. What the headline hides is the shape of the loss. Fraud is not a line item equal to the face value of the bad orders. It is a multiplier on top of them.
LexisNexis surveyed 569 fraud and risk executives in late 2024 and early 2025 for its fifteenth annual True Cost of Fraud Study, and found that US ecommerce and retail merchants pay $4.61 in total cost for every $1 of fraud, with Canadian merchants at $4.52 (LexisNexis Risk Solutions, April 2, 2025). That 4.61x is the number to internalize. A $1 fraud loss is a $4.61 problem because you also lose the merchandise, the shipping you already paid, the processing and chargeback fees, and the staff hours spent disputing it.
The same study found the damage does not stop at the balance sheet. 63% of respondents said fraud increases customer churn and 64% said it hurts conversion rates (LexisNexis, April 2025), because the friction merchants add to stop fraud, extra verification steps, declined-but-legitimate orders, slow checkouts, drives real buyers away too. That tension, fraud control versus conversion, is the thread running through this whole post, and it is why fraud defense is a conversion problem as much as a security one.
One honest caveat before we go further: LexisNexis is a survey of risk executives, self-reported and directional, not a ledger audit. It is the most-cited public figure on the true cost of fraud, and we quote it as what it is, a large industry survey, not a law of physics.
The three kinds of fraud eating your margin
TL;DR Friendly fraud (a real customer disputes a real order), true fraud (a stolen card), and refund fraud (returns-process abuse) are three separate problems. Confuse them and you will aim the wrong defense at the wrong attacker.
“Fraud” is a bucket word. Inside it are at least three distinct attacks, and each one wins against a different weak spot in your store. Naming them correctly is the first move.
| Type | Who does it | How it works | What actually stops it |
|---|---|---|---|
| Friendly / first-party fraud | Your real customer | Disputes a legitimate purchase through their card issuer and keeps the goods | Delivery evidence, clear billing descriptor, responsive support, representment |
| True (third-party) fraud | A stranger with a stolen card | Uses card details they do not own to place a card-not-present order | AVS/CVV checks, device and IP signals, 3-D Secure, fraud scoring |
| Refund / return fraud | A real or fake customer | Abuses your returns process: empty-box returns, “item not received,” wardrobing | Returns policy, serial/label tracking, delivery proof, repeat-abuser flags |
These categories overlap at the edges (a stolen-card order can also become a “not received” claim), but the defenses are genuinely different, which is why a single “anti-fraud app” rarely covers all three.
Card networks now treat friendly fraud, which they call first-party fraud, as a major category in its own right. In the Mastercard and Datos Insights 2025 State of Chargebacks report, roughly 45% of all chargeback volume was reported as fraudulent, spanning both true fraud and first-party fraud (as reported by Tearsheet, April 2025). Mastercard considered first-party abuse serious enough to launch a dedicated First-Party Trust program in 2023 and expand it in June 2025 to Canada, Latin America, the Caribbean, and the Asia Pacific region (PYMNTS, June 25, 2025).
The independent identity-verification data tells the same story from a different angle. In Sumsub's 2024 Identity Fraud Report, the top five identity-fraud types were forged documents at 50% of attempts, chargebacks at 15%, account takeovers at 12%, deepfakes at 7%, and fraudulent networks at 4% (Sumsub, 2024). Chargebacks are the second-largest identity-fraud category in that panel, behind only forged documents.
Source: Sumsub 2024 Identity Fraud Report, share of identity-fraud attempts. Chargebacks (coral) are the merchant's line here, the second-largest category. This is an identity-verification panel across many industries, not ecommerce-only; read it as direction, not a store-level rate.
The practical takeaway from the split: buying a single tool that scores stolen-card risk does nothing about a customer who genuinely bought your product and then disputes it, and a lenient returns policy that delights honest buyers is exactly the door refund fraud walks through. You need a posture for each, which the playbook section lays out.
Why AI is supercharging it
TL;DR Generative AI lowers the cost and raises the quality of attacks. Deloitte projects US generative-AI-enabled fraud losses could reach $40 billion by 2027, from $12.3 billion in 2023, and Sumsub detected 4x more deepfakes in 2024 than 2023. Both are cross-industry figures, flagged as such.
The reason this is a 2026 story and not a 2016 one is that the tools of attack got cheap. Writing a convincing dispute letter, generating a fake ID, spinning up a thousand synthetic accounts, or cloning a voice used to take skill and time. Now it takes a prompt.
Deloitte's Center for Financial Services estimated that generative AI could push fraud losses in the United States to $40 billion by 2027, up from $12.3 billion in 2023, a compound annual growth rate of about 32% (Deloitte, 2024). Be precise about what that number is: it covers fraud across US financial services, not ecommerce chargebacks specifically, and it is a projection, not a measured loss. We cite it because the mechanism, cheaper and better attacks at scale, applies directly to online stores even though the dollar figure is broader.
The identity data shows the mechanism already landing. Sumsub reported that deepfakes detected worldwide roughly quadrupled from 2023 to 2024 and made up 7% of all fraud attempts in its panel (Sumsub, 2024), and the same report tracked the overall fraud rate rising from 1.10% of verifications in 2021 to 2.50% in 2024. The now-canonical cautionary tale sits outside retail but makes the capability vivid: an employee at engineering firm Arup wired $25 million to fraudsters after a video call with deepfaked avatars of company executives (widely reported; cited in Deloitte's 2024 analysis).
For an ecommerce merchant, the AI threat is less about Hollywood deepfakes and more about volume and polish: automated account creation that defeats simple velocity checks, synthetic identities that pass basic verification, and dispute narratives written well enough to win representment. The defense is not a single silver-bullet AI detector. It is layered signals, delivery evidence, and honest statistics about which orders are actually risky, the same disciplined, source-checked posture we argue for when deciding what an AI should and should not be trusted to decide in testing. A model is good at spotting patterns and terrible at being handed the final verdict unchecked.
What a $60 chargeback really costs
TL;DR A single disputed $60 order is not a $60 loss. Add the lost goods, the shipping you already paid, the chargeback fee, and the labor to fight it, and the LexisNexis 4.61x multiplier stops looking abstract. Fraud is a margin problem, not a revenue problem.
The most expensive misunderstanding in fraud is treating a chargeback as a refund. A refund returns the money. A chargeback takes the money, often keeps the goods, adds a fee, and dents the ratio that keeps your payment account alive.
Walk a single $60 physical order through a friendly-fraud dispute, and price each layer.
| Cost layer | What happens | Illustrative amount |
|---|---|---|
| Face value reversed | The $60 is pulled back from your account | $60 |
| Goods gone | The customer keeps the product; you eat COGS | + your COGS |
| Shipping sunk | Outbound shipping and fulfillment already spent | + shipping |
| Chargeback fee | Your processor charges a per-dispute fee | + ~$15–$25 |
| Labor | Staff time gathering evidence and filing representment | + hours |
| Ratio damage | The dispute counts toward your monitoring ratio (see VAMP) | + program risk |
The dollar figures are illustrative; the fee band and the multiplier direction are not. LexisNexis measured the aggregate at $4.61 per $1 of fraud for US merchants (April 2025). Your own number depends on your COGS and margin.
This is why fraud is properly a margin conversation. A store running a 40% contribution margin has to sell roughly $150 of new product just to absorb the true cost of one $60 fraudulent chargeback, once the goods, shipping, fee, and labor are counted. If you are not tracking fraud against contribution margin rather than revenue, you are systematically underestimating what it costs you, in exactly the way a discount that lifts orders can quietly destroy profit.
The margin lens also disciplines the defense budget. Spending $2 of verification friction to prevent $1 of fraud loss is not a win, because that friction also costs you real conversions (recall LexisNexis: 64% of merchants say fraud controls hurt conversion). The goal is not zero fraud. The goal is the lowest total cost of fraud plus the cost of fighting it, which almost never sits at zero fraud.
The compliance clock: Visa VAMP and the shrinking ratio
TL;DR Visa merged its dispute and fraud monitoring programs into one Visa Acquirer Monitoring Program (VAMP). The merchant “excessive” dispute ratio is 2.2% through March 2026 and drops to 1.5% from April 2026, and both fraud and friendly-fraud disputes count toward it (Ravelin, 2025).
Beyond the direct loss, chargebacks carry a second penalty most merchants discover too late: cross too many and the card networks put your payment account on notice. The rules just got stricter and simpler at the same time.
Visa consolidated three prior initiatives, the Visa Dispute Monitoring Program, the Visa Fraud Monitoring Program, and the earlier VAMP, into a single Visa Acquirer Monitoring Program. It took effect in Europe on April 1, 2025, enforcement began October 1, 2025, and the stricter “above standard” enforcement for acquirers began January 1, 2026 (Ravelin, 2025).
| Period | Merchant “excessive” dispute ratio | Minimum cases |
|---|---|---|
| June 2025 – March 2026 | 2.2% | 1,500+ |
| April 2026 onward (US, EU, Canada, AP) | 1.5% | 1,500+ |
| Latin America / Caribbean | 1.5% throughout | 1,500+ |
Source: Ravelin, 2025. The ratio is calculated as total disputes (all TC40 fraud alerts plus TC15 disputes, fraud and non-fraud) divided by total sales. Disputes resolved through pre-dispute tools like Rapid Dispute Resolution are excluded. Acquirer-level thresholds differ; these are the merchant figures.
Two details in that table matter more than the headline number. First, the ratio counts both true-fraud alerts and ordinary disputes, so a wave of friendly fraud damages your standing exactly as much as a wave of stolen-card fraud, which is a strong argument for fighting friendly fraud rather than reflexively refunding it. Second, the denominator is total sales, so higher volume gives you headroom, and a sudden traffic drop can push your ratio up even if your raw dispute count is flat. If you run promotions or seasonal spikes, watch the ratio, not just the count.
Mastercard runs its own monitoring and, as noted above, launched First-Party Trust in 2023 and expanded it in June 2025. The through-line across both networks is the same: the industry is done treating friendly fraud as the merchant's private problem, and it is building the plumbing to score, flag, and share first-party-fraud signals. That is good news, but it also means your dispute ratio is now a number the networks watch as closely as you do.
The refund-fraud front: the leak that skips the card networks
TL;DR Refund and return fraud runs through your own policies, not the card networks. US retail returns were projected at $849.9 billion for 2025, with 9% of all returns fraudulent (NRF and Happy Returns, October 2025). A generous returns policy is a conversion asset and a fraud surface at the same time.
Not every fraud loss shows up as a chargeback. A large and growing share runs straight through the returns process you built to make honest customers comfortable.
The National Retail Federation and Happy Returns projected total US retail returns of $849.9 billion for 2025, with an estimated 19.3% of online sales returned, and found that 9% of all returns were fraudulent (NRF, October 15, 2025). Refund fraud takes forms a chargeback filter never sees: claiming an item never arrived when it did, returning an empty box or a different item, wardrobing (buying, using, and returning), and serial-refunder rings that industrialize all of the above.
Here is the trap. Free, generous returns are one of the strongest conversion levers in ecommerce, buyers hesitate less when the downside is covered, so tightening your policy to stop refund fraud can cost you more in lost sales than the fraud it prevents. The answer is not a blanket crackdown; it is targeting. Track returns at the label and serial level, flag repeat abusers rather than punishing everyone, require delivery confirmation before honoring “not received” claims, and reserve the strict rules for the accounts that earn them. Protecting the honest-buyer experience while closing the abuser's door is the same balancing act as fraud-versus-conversion, and it belongs in your broader Shopify conversion strategy, not in a security silo bolted on afterward.
The defense playbook: layered, targeted, conversion-aware
TL;DR Six moves in order: prevent before the order, verify at checkout, capture delivery evidence, fight friendly fraud with representment, use Shopify Protect where it applies, and monitor your dispute ratio. Each step is calibrated to protect conversion, not just block fraud.
Everything above compresses into a method. It is deliberately ordered from cheapest and highest-leverage (prevention) to most reactive (representment), because a dispute you prevent costs nothing to win.
- Prevent before the order is placed. The most common friendly-fraud trigger is not malice, it is confusion: a customer sees an unrecognizable charge on their statement and disputes it. Set a clear, recognizable billing descriptor, send order and shipping confirmations that name your store the same way, and make your support contact easy to find. A large share of “fraud” disputes are honest customers who could not connect the charge to a purchase.
- Verify at checkout, proportionally. Turn on the low-friction signals first: AVS (address) and CVV matching, plus device and IP checks, which cost the honest buyer nothing. Reserve heavier friction, 3-D Secure step-ups, manual review, for orders your scoring actually flags as risky. Blanket friction is where the 64% conversion penalty LexisNexis measured comes from. Verify the risky order, not every order.
- Capture delivery evidence on every shipment. Tracking numbers, delivery confirmation, and, for high-value orders, signature on delivery are the single most decisive evidence in both chargeback representment and “item not received” refund claims. Evidence gathered at fulfillment is nearly free; evidence reconstructed during a dispute is expensive and often impossible.
- Fight friendly fraud with representment, selectively. When a legitimate order is disputed, submit the evidence, the AVS/CVV match, delivery confirmation, IP and device data, and any record the customer used the product, to your processor. Do not fight every case; fight the ones where your evidence is strong and the amount justifies the labor. Reflexively refunding real orders trains the behavior and inflates the ratio the networks now watch.
- Use Shopify Protect where it applies, and know its edges. Shopify Protect covers eligible Shop Pay orders of physical goods against fraudulent and unrecognized chargebacks for free, reimbursing the transaction amount and the chargeback fee, and Shopify handles the dispute for you (Shopify Help Center). Eligibility requires fulfillment with a tracking number within seven days via an approved carrier. It does not cover other payment methods, product-not-received claims, or refund fraud through your own returns, so treat it as one layer, not the whole roof.
- Monitor your dispute ratio like a vital sign. Track disputes divided by sales against the VAMP thresholds (2.2% now, 1.5% from April 2026) and watch it weekly, not quarterly. The ratio moves with both fraud and traffic, so a sales dip or a friendly-fraud spike can push you toward the penalty line without any change in attacker behavior. Catching the trend early is the difference between a tune-up and an account review.
Run those six in order and re-check them quarterly, because the threat drifts, the AI tooling gets cheaper, the VAMP threshold tightens in April 2026, and your own traffic mix shifts under you. The measure of success is not zero chargebacks; it is the lowest total of fraud loss plus defense cost plus conversion lost to friction, which is a genuinely optimizable number rather than a fantasy of perfect safety.
A disclosure, since this post holds every source to a standard and should hold itself to one. We are building StorePilot, an AI CRO agent for Shopify. Fraud defense is not our product, but the discipline in it is exactly ours: layered signals over silver bullets, deterministic math over vibes, and a permanent respect for the conversion cost of every bit of friction you add. The playbook above works whether or not you ever use our tool.
Questions merchants keep asking
What is chargeback fraud?
Chargeback fraud is when a cardholder disputes a legitimate purchase to get their money back while keeping the goods. The card networks call it first-party fraud; merchants call it friendly fraud. It is distinct from true fraud (a stolen card used by a stranger), and it is harder to fight because the real account holder is the one filing the claim.
How much does a chargeback actually cost a merchant?
More than the order value. LexisNexis's 2025 True Cost of Fraud Study puts the total cost at $4.61 for every $1 of fraud for US ecommerce and retail merchants (15th edition, April 2025). A disputed $60 order can cost a multiple of $60 once you add the lost goods, lost shipping, the chargeback fee, and staff time.
What is the difference between friendly fraud, first-party fraud, and refund fraud?
Friendly fraud and first-party fraud are the same thing under different names: a real customer disputes a real purchase through their card issuer. Refund or return fraud runs through your own returns process instead of the card network, for example claiming an item never arrived or returning an empty box. The NRF found 9% of all returns were fraudulent in 2025.
Is AI making chargeback fraud worse?
It is lowering the cost of attacks. Deloitte projects generative-AI-enabled fraud losses in the US could reach $40 billion by 2027, up from $12.3 billion in 2023 (Deloitte Center for Financial Services, 2024). Sumsub detected four times as many deepfakes in 2024 as in 2023. Those figures span all of financial services, not ecommerce alone, but the direction is the same for merchants.
What are the new Visa VAMP chargeback thresholds?
Visa consolidated its dispute and fraud monitoring programs into one Visa Acquirer Monitoring Program (VAMP). The merchant 'excessive' dispute ratio is 2.2% from June 2025 through March 2026, dropping to 1.5% from April 2026 (Ravelin, 2025). The ratio counts fraud alerts plus disputes divided by total sales, so both true fraud and friendly fraud push you toward the penalty line.
Does Shopify protect merchants from chargebacks?
Partly. Shopify Protect covers eligible Shop Pay orders of physical goods against fraudulent and unrecognized chargebacks for free, reimbursing the transaction amount and the chargeback fee, and Shopify handles the dispute for you (Shopify Help Center). It does not cover friendly-fraud disputes on other payment methods, product-not-received claims, or refund fraud that runs through your own returns process.
How do I fight a chargeback and win?
Through representment: you submit evidence to your processor showing the transaction was legitimate. The evidence that wins is delivery confirmation, an AVS and CVV match, IP and device data, and a record the customer used the product. Prevention beats representment, though: order verification, clear billing descriptors, and responsive support stop most disputes before they are filed.
Sources
Every number in this post traces to one of the sources below, with its retrieval date. Figures that span all of financial services rather than ecommerce specifically are flagged as such in the text.
- Juniper Research – online payment fraud losses forecast to exceed $362 billion globally 2023–2028, $91 billion in 2028. Retrieved July 23, 2026.
- LexisNexis Risk Solutions, True Cost of Fraud Study (15th edition), April 2, 2025 – $4.61 per $1 of fraud (US), $4.52 (Canada); 63% churn and 64% conversion impacts; 569-executive survey. Retrieved July 23, 2026.
- Mastercard & Datos Insights, 2025 State of Chargebacks – ~324 million chargebacks and ~$41.69 billion value by 2028, ~45% of volume reported fraudulent, as reported by Tearsheet, April 15, 2025. Retrieved July 23, 2026.
- PYMNTS, June 25, 2025 – chargebacks projected to ~$42 billion by 2028; Mastercard First-Party Trust launched 2023, expanded June 2025. Retrieved July 23, 2026.
- Ravelin, 2025 – Visa VAMP consolidation, effective dates, and merchant dispute-ratio thresholds (2.2% to 1.5%). Retrieved July 23, 2026.
- Deloitte Center for Financial Services, 2024 – US generative-AI-enabled fraud losses projected at $40 billion by 2027 from $12.3 billion in 2023 (financial-services-wide); the Arup $25M deepfake case. Retrieved July 23, 2026.
- Sumsub, 2024 Identity Fraud Report – top-5 identity-fraud types (forged documents 50%, chargebacks 15%, account takeovers 12%, deepfakes 7%, fraudulent networks 4%); deepfakes 4x higher 2023–2024; fraud rate 1.10% (2021) to 2.50% (2024). Retrieved July 23, 2026.
- National Retail Federation & Happy Returns, 2025 Retail Returns Landscape, October 15, 2025 – $849.9 billion projected returns, 19.3% online return rate, 9% of returns fraudulent. Retrieved July 23, 2026.
- Shopify Help Center, Shopify Protect – free chargeback protection for eligible Shop Pay physical-goods orders; coverage, reimbursement, and eligibility rules. Retrieved July 23, 2026.
