What it means
The cardholder told their bank they didn't make or authorise the payment. On Stripe the dispute shows the reason Fraudulent, with the network's own code in the details: most often Visa 10.4 (card-absent fraud), Mastercard 4837 or American Express F29 for online payments.
It's the most common dispute reason, and Stripe calls it one of the hardest to win, because often the claim is true: someone really did use a stolen card. If you believe that happened, accept the dispute and refund nothing more.
Why software, course and membership customers file it
For digital products a lot of "fraud" disputes aren't fraud. Common patterns:
- The customer bought the course or plan, used it, and then disputed the charge instead of asking for a refund.
- A family member or colleague bought with the cardholder's card, and the cardholder didn't know.
- The statement descriptor didn't match the product name they remember, so they reported it as fraud. (Unclear charges sometimes arrive as Unrecognized instead.)
These are the cases you can win, because the cardholder's own activity in your product contradicts the claim.
What wins it
You need to show that the real cardholder, or someone they authorised, made the payment and used what they bought. For digital products, Stripe recommends these fields:
| Evidence | Stripe field |
|---|---|
| The IP address used at checkout | customer_purchase_ip |
| The customer's name and email | customer_name, customer_email_address |
| Logins, lessons, downloads or feature use after the payment, with time, IP and device | access_activity_log |
| A short case summary, and anything else below | uncategorized_text, uncategorized_file |
The strongest facts for a software or course business:
- 3D Secure. If the payment was authenticated with 3D Secure, fraud liability usually shifts to the card issuer. Stripe adds the authentication result to your response automatically.
- Same IP or device before and after. Logins after the payment from the same IP address or device that made the purchase tie the cardholder to the account.
- Use after the purchase, and after the dispute. A customer who completed lessons or exported reports after paying, and kept logging in after they disputed, is hard to describe as a fraud victim.
- Earlier undisputed payments on the same card. For recurring plans, previous renewals the cardholder never disputed.
- Address and CVC checks. A matching billing address and CVC at checkout support the claim that the cardholder was present.
Visa 10.4 and Compelling Evidence 3.0
For Visa disputes with code 10.4, Visa's Compelling Evidence 3.0 rules can decide the case on their own. You qualify if you can show at least two earlier, undisputed payments on the same card, made 120 to 364 days before the disputed one, that match the disputed payment on two identifiers: the purchase IP address, a device ID, the customer account ID or email (at least one of the first two). Stripe checks eligibility and tells you when a dispute qualifies, and its own guidance is that qualifying disputes are significantly more likely to be reversed.
The hard part is usually the identifiers: Stripe knows each payment's IP address and email, but often only your product knows the account ID and device.
What doesn't work, and when to accept
- A receipt alone. It proves a payment happened, which nobody disputes.
- Arguing intent. "This customer is clearly lying" persuades no one. A dated login from the checkout IP does.
- Unrelated activity. Logins from a different country with a different device can weaken your case. Send what supports it, and nothing misleading.
- Visa 10.5. These come from Visa's fraud monitoring program, and Visa doesn't accept evidence for them.
If you have no activity data, no 3D Secure and no earlier payments, the case is weak. Accepting saves the counter fee.
How Flatfight handles it
Flatfight reads the payment's 3D Secure, address and CVC results from Stripe, matches your product activity to the customer by email, account ID or device, and checks for earlier payments that qualify for Compelling Evidence 3.0. It scores the case before you spend the counter fee, and builds a response where every sentence is backed by one of those facts. You review and submit it with one click.
FAQ
Can I win a fraud dispute without 3D Secure?
Yes. Usage after the purchase from the same IP or device, and earlier undisputed payments, are what usually win digital-product fraud disputes. 3D Secure helps, but it's not required.
Should I refund the customer as well?
No. The bank has already returned the money to the cardholder. Refunding as well would pay them twice.
Does Stripe's "Unrecognized" reason need the same evidence?
Almost. Stripe treats it as effectively the same claim, so the same evidence applies.