Fraudulent Chargeback on Shopify: What to Pull, What to Build, and When to Walk Away

Start with the reason code, not the order

When a fraud-coded dispute appears in Shopify Admin under Payments → Disputes, the instinct is to pull the order and start assembling screenshots. Don't. The reason code tells you what the issuer is evaluating — and fraud disputes split into two operationally different cases depending on what's actually being claimed.

Visa 10.4 (Other Fraud – Card Absent) and Mastercard 4837 (No Cardholder Authorization) are the codes you'll see most often. Both say the cardholder is denying they authorized the transaction. That's the claim. But the evidence that moves an issuer on a $60 apparel order looks nothing like what moves them on a $400 electronics order — and the evidence that wins a true fraud case is often the same evidence that loses a friendly fraud case, because the signals point in opposite directions.

Before you touch the evidence queue, confirm three things in Shopify Admin:

• Dispute deadline — visible under Payments → Disputes → [order]. The window varies by network and acquirer. Confirm the exact date with your processor if you're outside Shopify Payments.
• Order risk level — under the order detail, check the fraud analysis score Shopify surfaced at the time of purchase. A high-risk flag you didn't act on is a liability in your response narrative.
• Fulfillment and delivery status — carrier, tracking number, delivery event timestamps. If the order shows delivered but the dispute was filed within 48 hours of the delivery scan, that's a pattern worth noting.

Triage first: true fraud or friendly fraud

Most lost fraud disputes are misclassified before the response is even built. A merchant submits a delivery confirmation and AVS match against what is actually a true fraud case — where a stolen card was used, the cardholder genuinely didn't authorize anything, and the package went to a reshipping address. That evidence doesn't help. It confirms the transaction happened; it doesn't address the authorization gap.

Friendly fraud looks operationally cleaner than true fraud. The billing and shipping addresses match. The email is real. The device fingerprint is consistent. The order history shows prior purchases. The cardholder disputes it anyway — sometimes weeks after delivery, sometimes after a return window closes.

Run this triage before building anything:

• Shipping address vs. billing address — a mismatch, especially to a freight forwarder or known reshipping ZIP, is a true fraud signal. A match is not proof of friendly fraud, but it shifts the probability.
• Order velocity — did this customer place multiple orders in a short window? Did the disputed order ship to the same address as a non-disputed order from the same account?
• IP and device data — Shopify surfaces IP at checkout. A billing address in Ohio with a checkout IP in Eastern Europe is a different case than a billing address in Ohio with a checkout IP two miles away.
• Dispute timing — true fraud disputes often come within days of the transaction. Friendly fraud disputes often come after delivery, after a return window closes, or after a high-value purchase cycle (holiday, back-to-school).
• Customer contact history — did the cardholder contact you before filing? A dispute filed with no prior contact, on an order that was delivered and never complained about, is a friendly fraud pattern.

You don't need certainty here. You need a working hypothesis that shapes what you submit.

Decision point: fight or accept

Path A — Submit a response. You have behavioral evidence (matching IP, device, prior order history, account login), delivery confirmation with a carrier event at the correct address, and no red flags in the fraud analysis. The dispute timing suggests post-delivery denial. Fight it.

Path B — Accept the dispute. The shipping address was a freight forwarder. The IP was flagged at checkout. The order was a first-time purchase with no account. AVS passed but the billing address was a P.O. box. You shipped anyway. Submitting evidence here doesn't change the authorization gap — it just delays the loss and costs you the dispute fee. Accept it, log the failure mode, and update your fraud rules.

The cost of fighting a losing case isn't just the chargeback amount. Repeated low-quality responses can affect your dispute ratio with your processor. Confirm thresholds with your acquirer — Visa's standard merchant threshold is 0.9% dispute ratio; Mastercard's is 1.0% — but processors may apply tighter internal limits.

What to pull from Shopify before you build the response

Pull these in order. Don't submit until you have all of them or have confirmed they don't exist.

1. Order confirmation and transaction record — export from Shopify Admin. Include the order ID, transaction ID, amount, date, and the card's last four digits.
2. AVS and CVV result — visible in the payment details under the order. AVS Y (full match) and CVV match don't prove authorization, but their absence weakens your case. Their presence, combined with behavioral signals, strengthens it.
3. Shopify fraud analysis output — the risk indicators Shopify flagged at checkout. If the order was flagged high-risk and you fulfilled it anyway, acknowledge that in your narrative rather than omitting it. Issuers notice gaps.
4. IP address and geolocation — from the order detail. Screenshot it. If the IP matches the billing address region, include it. If it doesn't, assess whether it helps or hurts your case before including it.
5. Delivery confirmation — carrier tracking with the full event log, not just the final delivered status. Include the delivery timestamp, the city/state of the delivery scan, and — if available — a delivery photo or signature confirmation.
6. Customer account history — prior orders, login history, email address age. A cardholder who has placed four previous orders under the same account and is now disputing the fifth has a different profile than a first-time guest checkout.
7. Communication history — every email, chat, or support ticket associated with the order. If the cardholder contacted you post-delivery and didn't mention non-receipt, that's relevant. If they requested a return and then filed a dispute instead, that's very relevant.

Building the evidence narrative

Issuers read dozens of dispute responses. A wall of screenshots with no narrative loses to a concise, sequenced summary that tells the issuer exactly what happened and why the cardholder's claim doesn't hold.

Write one paragraph. Keep it under 150 words. Structure it as: what the cardholder ordered → how the transaction was authorized → how the order was fulfilled → what the delivery record shows → why the claim is inconsistent with the evidence.

Sample narrative (adapt to your case):

The cardholder placed order #[ORDER ID] on [DATE] for [PRODUCT] at [AMOUNT]. The transaction was authorized with full AVS match and CVV match. The order was shipped via [CARRIER] to the billing address on file and delivered on [DATE] at [TIME] per carrier tracking event [TRACKING NUMBER]. The cardholder's account shows [X] prior purchases with no disputes. No contact was made to our support team prior to this dispute. The claim of unauthorized transaction is inconsistent with the delivery record, the AVS/CVV match, and the account history attached.

Don't editorialize. Don't accuse the cardholder of fraud in the narrative — issuers don't respond well to it, and it doesn't change the outcome. State the facts in sequence and let the evidence carry the argument.

The case that looked winnable and wasn't

A merchant sold a $310 skincare bundle. Billing and shipping address matched. AVS returned Y. CVV matched. Shopify's fraud analysis flagged the order as low risk. The order shipped next day, delivered with carrier confirmation three days later. The cardholder filed a Visa 10.4 dispute eleven days after delivery.

The merchant submitted the full evidence stack — AVS, CVV, delivery confirmation, order history showing two prior purchases. The dispute was lost.

What the merchant didn't catch: the two prior purchases were also disputed, both resolved in the cardholder's favor before this order was placed. The issuer had a pattern on file. The merchant had no visibility into that history — but the issuer did. The response read as strong on its face and lost on context the merchant couldn't see.

The operational failure wasn't the evidence. It was the absence of a pre-fulfillment check against the customer's dispute history. That data isn't in Shopify natively — it requires a fraud tool or manual review flag. After the loss, the merchant added a rule to hold orders from accounts with any prior dispute flag for manual review before fulfillment.

What to log internally after you submit

Win or lose, log the following before you close the dispute in your internal system:

• Dispute reason code and network
• Evidence submitted (list, not screenshots)
• Triage classification (true fraud / friendly fraud / unclear)
• Outcome
• What failed operationally — was there a fraud signal at checkout that wasn't acted on? A fulfillment gap? A missing delivery confirmation?

This log is how you build pattern recognition. A single lost dispute is a data point. Ten lost disputes with the same fraud signal at checkout is a policy failure.

Internal note template:

Dispute [ORDER ID] — Visa 10.4 — [DATE FILED]. Classification: friendly fraud (post-delivery, prior account history, no support contact). Evidence submitted: AVS, CVV, delivery confirmation, account history. Outcome: [WON/LOST]. Failure mode: [e.g., no signature confirmation on order over $200 threshold]. Action: update fulfillment rules for orders over $[X] to require signature.

When automation fits and where it doesn't

DisputeDesk automates evidence assembly for fraud-coded disputes — pulling order data, AVS/CVV results, delivery confirmation, and account history into a structured response. That consistency matters: merchants who manually assemble evidence under deadline pressure routinely omit the fraud analysis output or submit delivery screenshots without the full carrier event log.

Automation improves consistency, not certainty. High-risk fraud disputes — orders with mixed signals, prior dispute history on the account, or IP/address mismatches — still require a human review before submission. DisputeDesk flags these for escalation rather than auto-submitting. The merchant still owns the decision on whether to fight or accept.

The disputes that benefit most from automation are the operationally clean friendly fraud cases: matching addresses, low-risk Shopify fraud score, delivery confirmed, prior account history, dispute filed post-delivery. Those cases have a repeatable evidence pattern. Automation handles the assembly; the merchant reviews the narrative before it goes out.