Gaming chargebacks: friendly fraud, reason codes, and representment

Many gaming chargebacks are not stolen cards. They are real deposits that a player, or someone in the player's household, later calls unauthorized, usually after losing. Operators win these disputes by proving the deposit is tied to the account holder, using login, device and wager records, Visa Compelling Evidence 3.0 where it applies, and clear terms the player accepted before depositing.

This guide covers why losses turn into fraud claims, the Visa and Mastercard reason codes gaming operators see, what Compelling Evidence 3.0 actually requires, the evidence that works for each kind of dispute, and the monitoring thresholds that decide whether you keep your merchant account.

Why gaming losses turn into fraud claims

There is no reason code for "I lost." A player who wants a deposit back has to fit the request into a category the card networks recognize, and the one that fits most easily is fraud: "I did not authorize this." For a card-absent deposit, that claim costs the player nothing to make and puts the burden on you to show otherwise.

That is the core of friendly fraud, or first-party misuse, in gaming. The deposit was made by the cardholder or with their knowledge, the money was used to wager, and the dispute arrives after the outcome is known. Sometimes it is deliberate. Sometimes it is a household member who used the card, or a player who genuinely does not recognize the descriptor on a statement weeks later.

Gaming has one structural advantage here: you know far more about your customer than most merchants do. Licensed operators verify identity and age at registration, check location before wagers, and log every session and bet. That data is exactly what wins fraud disputes, if you keep it in a form you can produce quickly.

The disputes gaming operators actually see

Gaming disputes cluster into a few recognizable stories. Knowing which story you are dealing with tells you which evidence to pull.

• Deposit regret. The player deposits, loses, and disputes the deposit as unauthorized.
• Household use. A spouse, roommate or child used the cardholder's card, sometimes on the cardholder's own account and sometimes on a separate one.
• Funds not credited. The player says the deposit never showed up in the wallet, often after a failed or delayed load.
• Withdrawal frustration. A player whose withdrawal is slow or blocked disputes the deposits that funded the account.
• Terms disputes. A bonus was voided, winnings were confiscated, or a withdrawal limit was applied that the player says was not disclosed.
• Duplicates and errors. A double deposit from a retry, or a refund that was promised but not processed.
• True third-party fraud. Stolen card details used to open or fund an account.

Only the last is classic fraud, but many of the others arrive coded as fraud anyway, because that is the easiest claim for the cardholder to make.

Visa reason codes to know

Visa groups disputes into four categories: fraud (10), authorization (11), processing errors (12) and consumer disputes (13). Visa's dispute guide for merchants, current as of October 2026, sets out each condition. The ones gaming operators see most often are below.

Two details matter for gaming. Visa's guide says 13.1 covers digital goods and services as well as physical goods, so a deposit that never reaches the wallet can be disputed there as a service not received. And the guide's examples for 13.5 include investment services where the customer cannot withdraw their money. Gaming is not named there, but the principle carries over: withdrawal terms have to be clear before the deposit, not explained afterward.

Mastercard reason codes to know

Mastercard has consolidated its chargeback reasons into a smaller set of message reason codes. The ones that matter for an online operator:

• 4837, No Cardholder Authorization. Mastercard's main card-absent fraud code, and the closest counterpart to Visa 10.4.
• 4853, Cardholder Dispute. The broad consumer dispute code, covering services not provided, not as described, and credits not processed.
• 4834, Point-of-Interaction Error. Processing problems such as duplicate transactions.
• 4849, Questionable Merchant Activity. Fraud disputes against merchants Mastercard has flagged through its compliance programs, which is a sign of a much bigger problem than one dispute.
• 4870 and 4871, chip liability shift. Card-present fraud at a cage, kiosk or retail sportsbook.

Older codes such as 4863 (Cardholder Does Not Recognize) still show up in some processor reports, because systems map codes differently. Your dispute workflow should key off the condition, not just the number.

First-party Trust

Mastercard announced its First-party Trust program in October 2023, with the US rollout beginning in 2024. It lets merchants share extra transaction data, such as purchase history, device, identity and location details, either with the transaction or later in the dispute process. Mastercard describes chargeback protection for disputes that meet the program's data sharing requirements. Enrollment and data paths run through Mastercard's Ethoca services and your acquirer, so ask whether your setup supports it.

Visa Compelling Evidence 3.0, applied to gaming

Compelling Evidence 3.0 (CE 3.0), introduced in April 2023, lets a merchant answer a 10.4 card-absent fraud dispute with transaction history instead of only arguing about the disputed transaction. If the disputed deposit matches earlier undisputed activity by the same cardholder, Visa can treat the fraud claim as unsupported. It applies only to 10.4.

Based on Visa's current merchant guide, you need at least two prior transactions that:

• Used the same payment credential as the disputed transaction.
• Were not reported as fraud by the issuer before the disputed transaction.
• Fall within Visa's timing window: within the past 365 days, and generally more than 120 days old. Visa says the 120-day requirement does not apply when the prior transactions were original credit transactions.
• Share a matching device ID or device fingerprint, or IP address, with the disputed transaction, plus additional identifiers such as the customer account or login ID.

You also describe the goods or services in each transaction. For gaming, that means a clear line such as "deposit to player wallet" with the player's account ID, rather than a generic label.

Why gaming fits CE 3.0 well

Gaming has no guest checkout. Every deposit is tied to a logged-in account, so the login identifier is always there, and most operators already capture device and IP data for fraud and geolocation. Repeat depositors build exactly the history CE 3.0 looks for.

The original credit exception matters too. If you paid a player's winnings to the same card through a push-to-card payout, Visa's guide indicates those credits are not held to the 120-day requirement. Ask your acquirer how it treats them. Our post on paying out winnings covers how those payouts work.

Where it falls short

Visa notes that an email address or phone number counts as an account identifier only if you use it to authenticate the cardholder. A brand-new player with no history will not qualify, and CE 3.0 does not help with 13.x consumer disputes. It is one tool, not a blanket defense.

Evidence that wins representment

Visa's guide makes the same point repeatedly: evidence works when it addresses the specific dispute condition, and more documents do not make a stronger case. Match the package to the claim.

Unauthorized deposit (10.4, 4837)

• CE 3.0 data, where the history qualifies.
• 3-D Secure authentication results for the deposit.
• Identity verification showing the account holder is the cardholder, with the name match.
• Login history for the session, with device and IP matching prior activity.
• The geolocation check your licensed platform ran for that session.
• Wager history showing the deposited funds were played, and any earlier withdrawals paid to the same card or to a bank account in the cardholder's name.

Deposit not credited (13.1, 4853)

Show the wallet ledger entry that credited the deposit, with timestamp and transaction ID, followed by wagers that drew on that balance. A balance history that ties the card transaction to the wallet credit is usually the whole case.

Terms disputes (13.5, 4853)

Produce the exact version of the bonus terms or withdrawal policy shown before the deposit, how it was displayed, and the timestamp of the player's acceptance. Visa's guide is direct about this: later explanations do not count, only what the cardholder saw before paying.

Duplicates and refunds (12.6, 13.6, 4834)

Show that two deposits were separate and each credited separately, or show the refund with its date, amount and the reference number that links it to the original transaction.

How representment works in practice

When an issuer raises a dispute, your acquirer notifies you and gives you a deadline that is shorter than the network's, because it needs time to file. You submit your response, and the issuer either accepts it or contests it. For Visa, the stages depend on the dispute type: for fraud and authorization disputes such as 10.4, your response is itself filed as a pre-arbitration, while for consumer disputes and processing errors the issuer can answer your response with a pre-arbitration. A dispute still unresolved after that can go to network arbitration, where fees apply and the stakes rise.

A few habits improve results:

1. Never miss a deadline. Visa's guide says a missed response window can lose the case even when the evidence is strong.
2. Lead with a short summary. One paragraph naming the dispute condition, the transaction and why the evidence answers it.
3. Label each exhibit and refer to it by name in the summary.
4. Provide evidence in English, or with an English translation, as Visa requires.
5. Automate the package. Gaming disputes repeat. Templates that pull ledger, login, device and wager data on demand turn a long manual task into a quick review.

Track win rates by reason code and by story. If you lose most deposit-regret disputes from new players, the fix is upstream, in onboarding and authentication.

When not to fight, and responsible gambling

Some disputes should be accepted, and some point to a compliance problem bigger than the chargeback.

• Genuine third-party fraud. Accept it, close the account, and work out which control failed.
• Underage play. If a minor used a parent's card, contesting the dispute is the wrong move. Treat it as a breach of your age verification, follow your state's rules on refunds and reporting, and fix the gap. See KYC, age verification and geolocation.
• Self-excluded players. A deposit from someone who should have been blocked is a regulatory issue first. Follow the rules of the state where they play.
• Clear errors. Duplicates and missed refunds should be fixed, not contested.

Responsible gambling tools also prevent disputes. Deposit limits, time-outs, reality checks and easy self-exclusion reduce the regretted deposits that become fraud claims. Our post on responsible gambling payment controls covers how to build them into the payment flow.

Stopping disputes before they are filed

The cheapest dispute is the one that never reaches the issuer.

• Accurate, recognizable descriptors that match the brand players know, coded correctly for gambling. Our post on gambling merchant category codes explains why that coding is not optional.
• Deposit confirmations by email or in-app message, with amount, time and the last four digits of the card.
• Self-serve deposit history in the player's account, so a confused player can check before calling the bank.
• Fast support and fast refunds where a refund is warranted.
• 3-D Secure on card deposits, at least for first deposits and new cards. Fraud liability shift rules have conditions and exclusions, so ask your acquirer what applies to your MCC.
• Card-to-account name matching, and blocking cards that belong to someone else.
• Reliable withdrawals. Players who get paid on time have less reason to dispute their deposits.

Pre-dispute tools are also available through acquirers and third-party providers, including Visa's Order Insight and Rapid Dispute Resolution and Mastercard's Ethoca services. Visa's guide warns that accepting a Rapid Dispute Resolution request already moves the liability, so issuing a separate refund as well can create a duplicate credit.

Monitoring thresholds: ECM, HECM and VAMP

Disputes cost you twice: once in lost deposits and fees, and again in your monitoring ratios. Exceeding them brings fines, remediation plans and, eventually, the loss of your merchant account.

• Mastercard Excessive Chargeback Merchant (ECM): a chargeback ratio of 1.5% or more with at least 100 chargebacks in a month.
• Mastercard High Excessive Chargeback Merchant (HECM): 3% or more with at least 300 chargebacks.

Both are measured against the preceding month's transaction count.

Visa has replaced its separate dispute and fraud monitoring programs with the Visa Acquirer Monitoring Program (VAMP), whose ratio counts card-not-present fraud reports and disputes together against settled transactions. A fraud dispute can therefore count twice, once as a fraud report and once as a dispute. Visa's thresholds have been revised since launch, so ask your acquirer which figure applies to you. The familiar 0.9% rule of thumb comes from Visa's older dispute program, which engaged at 0.9% with 100 disputes.

Winning a representment recovers the money but generally does not erase the dispute from these counts. Run your numbers with our chargeback ratio calculator, read our chargebacks guide, and see how dispute history shapes reserves in reserves, rates and settlement for gaming merchants. Network registration and monitoring are covered in Visa and Mastercard rules for gambling merchants.

How Flux fits

Flux reviews gaming and betting businesses case by case. Approval depends on your licenses, where your players are, and your controls. For approved accounts, Flux card processing uses hosted payment fields and tokenization, so card numbers never touch your servers, and fraud detection scores each transaction in real time and flags or blocks risky ones before they settle, using rules you control.

The evidence that wins gaming disputes lives in your platform: identity records, logins, devices, geolocation and wager history. Whatever processor you use, ask how that data reaches the acquirer for CE 3.0 and representment, and how quickly you will hear about a new dispute.

This post is general information, not legal advice. To talk through your dispute profile, visit our gaming and betting hub, apply here, or email sales@fluxpayments.com.