Infrastructure and regtechSoftware only

Chargeback management software testing

FintechAssuranceLabs engineers test chargeback management and dispute prevention software, the category of products like Chargeflow and Sift. Chargeback software testing covers reason code mapping, evidence package assembly, network deadline calculation, pre-dispute alerts and refunds, win-rate reporting, and dispute ratio monitoring, with test evidence that merchants and acquirers can check against Visa and Mastercard rules.

What breaks in dispute evidence, deadlines, and win-based fees

A vendor paid a percentage of chargebacks won loses its share, and the merchant the disputed amount, on each case below. Tables cited are from the Visa Core Rules and Visa Product and Service Rules of 18 April 2026, checked on 2026-09-16.

Response deadline counted from the webhook. The deadline job starts a 30-day clock when the processor's webhook arrives, days after Visa processed the dispute. Table 11-2 gives the acquirer 30 calendar days from the Dispute Processing Date for a Dispute Response under categories 12 and 13, and 2 business days for a domestic transaction in Nigeria. A response scheduled past that limit is never sent, and the debit stays with the merchant on a case the evidence could have won.
Compelling Evidence 3.0 (CE 3.0) built from hashed or out-of-window data. Table 11-28 makes a condition 10.4 (Other Fraud, Card-Absent Environment) dispute invalid when the same payment credential was used in two previous transactions the issuer did not report as fraud, processed more than 120 calendar days before the dispute and no more than 365 calendar days before its Processing Date. The evidence describes the goods or services and matches a device ID, device fingerprint, or clear-text IP address plus one more element. A pipeline that hashes IP addresses at ingestion, or picks the two latest purchases, fails qualification, and the issuer keeps the funds. From 24 October 2026, device ID and device fingerprint count as similar elements that cannot be supplied together, so a qualifier pairing them fails.
Refund and Rapid Dispute Resolution credit on the same sale. A support agent refunds after an Order Insight inquiry, and the Rapid Dispute Resolution (RDR) rule engine accepts the dispute without reading refund status. Table 11-152 lets the acquirer recover the double credit through Compliance with certified dates and amounts, and Table 11-146 sets 29 calendar days from the Dispute Processing Date for the pre-Compliance attempt. A monthly duplicate credit report finds the case after that window, the merchant pays the sale twice, and the uncontested RDR case carries no win fee.
Win billed at the Dispute Response, lost at pre-Arbitration. The billing job invoices the vendor's percentage when Dispute Response funds return to the merchant. Table 11-2 still lets the issuer make a pre-Arbitration attempt within 30 calendar days of the Dispute Response Processing Date and file for Arbitration within 10 calendar days of the pre-Arbitration response. A loss at either stage leaves a fee on a lost case, an overstated win rate, and a credit note owed.
Ratio monitor with the wrong denominator. Section 8.3.1 of Mastercard's Security Rules and Procedures, Merchant Edition (3 February 2026) computes Excessive Chargeback Program (ECP) basis points as a merchant ID's chargebacks in a calendar month divided by its Mastercard transactions in the preceding month, times 10,000. The Visa Acquirer Monitoring Program (VAMP) fact sheet divides TC40 fraud reports plus TC15 disputes by TC05 settled card-not-present transactions, excluding disputes resolved through pre-dispute solutions and fraud reports qualified for CE 3.0, subject to data extract timing. A dashboard that uses the same month's sales or counts RDR-resolved disputes misstates both ratios. Understated, the merchant crosses a threshold unwarned, and Mastercard may assess the acquirer (section 8.3.2); overstated, winnable disputes go to pre-dispute acceptance and earn no fee.

Licence flag and the evidence merchants, acquirers, and card networks ask for

Chargeback management carries licence flag "no": the software submits evidence through the merchant's acquirer or processor.

Merchants and acquirers

Dispute tools receive order records and often cardholder data. PCI DSS requirement 12.5.2 includes chargeback and refund data flows in the scope an entity confirms, so buyers ask where card numbers enter the evidence store, and they request a SOC 2 report. Evidence packages carry IP addresses, device IDs, and delivery addresses, and a vendor processing them for an EU merchant acts as a processor bound by a GDPR Article 28(3) contract or other legal act. Evidence we produce:

data flow tests showing card numbers masked or tokenised before attachments are stored
CE 3.0 field checks: IP address in clear text, device ID of at least 15 characters, device fingerprint of at least 20 characters
deadline logs per dispute condition with the Dispute Processing Date and the computed due date

Card network rules

The Visa Rules define RDR as a pre-dispute service that lets merchants and payment facilitators automate the acceptance of liability for a disputed transaction, with no pre-Arbitration step after an RDR acceptance (Table 11-1). Order Insight gives the cardholder's bank merchant, transaction, and order details when a customer does not recognise a charge, and can carry CE 3.0 evidence since an April 2026 update. For merchants of an acquirer not itself identified, the VAMP Excessive Merchant threshold is 150 basis points from 1 April 2026 in Asia Pacific, Canada, the EU, and the US, with at least 1,500 fraud reports and disputes a month. An acquirer that terminates a merchant for excessive chargebacks lists it in Mastercard's MATCH Pro under reason code 04 (section 11.14.1): chargebacks over the previous three months above 1.5% of its Mastercard sales transactions in that month, totalling at least USD 5,000. Acquirers read RDR decisions with refund status at decision time and ratio recalculations per merchant ID.

United States issuer dispute timers

For card issuer deployments, US rules set the clocks. Under Regulation Z, a billing error notice arrives no later than 60 days after the first periodic statement showing the error (12 CFR 1026.13(b)(1)) and is resolved within two complete billing cycles, no later than 90 days (1026.13(c)(2)). Under Regulation E, the institution determines an error within 10 business days (1005.11(c)(1)), or takes up to 45 days if it provisionally credits the account within 10 business days (1005.11(c)(2)(i)), informs the consumer within two business days after that credit, and gives full use of the funds (1005.11(c)(2)(ii)). The 45 days become 90 for a point-of-sale debit card transaction (1005.11(c)(3)(ii)(B)). Visa's 120-calendar-day limit for condition 10.4 runs from the Transaction Processing Date (Table 11-29), so each case log carries both clocks.

Chargeback process test scenarios

These scenarios feed the dispute lifecycle test suite per card network and the deadline and reason code rule checks from chargeback and dispute testing:

Map processor reason strings to Visa conditions 10.4, 12.6, 13.1, 13.2, and 13.6, and check the next action: a Dispute Response for categories 12 and 13, a pre-Arbitration attempt for categories 10 and 11.
Compute due dates in UTC for disputes processed at month end, across a daylight saving change, and on a Nigerian domestic transaction.
Qualify CE 3.0 with previous transactions at 119, 121, 365, and 366 days, one reported as fraud, a hashed IP address, a 14-character device ID, and device ID plus fingerprint before and after 24 October 2026.
Build evidence for a delivered order with an AVS result of Y or M (Table 11-6) within each processor's file limits, with no full card number in any attachment.
Refund after an Order Insight inquiry, send an RDR decision on the same transaction, and confirm the duplicate credit alert fires within 29 calendar days.
Drive each outcome, as the chargeback simulation guide describes: no pre-Arbitration, pre-Arbitration accepted or declined, and Arbitration, with the fee invoice or credit note for each.
Recalculate win rate inputs: contested cases, full and partial wins, and RDR acceptances left out.
Recalculate ECP basis points per merchant ID and the VAMP ratio with its exclusions, across the 1 April 2026 threshold change.
Open issuer cases before a federal holiday, on a point-of-sale debit card transaction, and 3 business days before an autopay date (1026.13(d)(1)).

Integrations and protocols to cover

Processor dispute APIs and webhooks: lifecycle events, evidence upload, signatures, ordering, and replay.
Visa systems: Visa Resolve Online (VROL) dispute actions, Order Insight inquiries, and RDR rule sets.
Authorization and authentication data: ISO 8583 CVV2, AVS, and ECI values, and EMV 3-D Secure CAVV results, which decide whether a condition 10.4 dispute is valid under Table 11-28.
Network data for ratios: Visa TC05, TC15, and TC40 counts, and Mastercard clearing records keyed by the DE 42 merchant ID.
Order and identity sources: order APIs, carrier tracking, login events, and device fingerprint SDKs.

Standards

Services

Guides

Blog posts

Agentic Commerce Protocol 2026-04-17: what merchant and PSP integrations now have to test

Sample deliverable

Sample, synthetic data

rule and threshold test matrixRule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules

Rule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules
Rule ID	Rule and reference	Test values below, at, and above the boundary	Expected outcome	Actual outcome	Result
TM-STR-01	Transaction monitoring structuring rule: open an alert when one customer makes two or more cash deposits on one business day, each below USD 10,000.00, that total more than USD 10,000.00. Built on 31 CFR 1010.313(b): multiple currency transactions shall be treated as a single transaction if the institution knows they are by or on behalf of any person and total more than $10,000 during any one business day	Below: two cash deposits totalling USD 9,999.99; at: two cash deposits totalling USD 10,000.00; above: two cash deposits totalling USD 10,000.01	The USD 9,999.99 and USD 10,000.00 totals open no structuring alert; the USD 10,000.01 total opens a structuring alert and a currency transaction report flag	The USD 9,999.99 and USD 10,000.00 totals opened no structuring alert; the USD 10,000.01 total opened a structuring alert and a currency transaction report flag	Passed, 3 of 3 test values, run 2026-09-14
SAN-SCORE-01	Sanctions name-match score threshold: open a screening alert and hold the payment when the name match score against a sanctions list entry is 85 or higher. Configured screening policy; no regulation sets the score	Below: match score 84; at: match score 85; above: match score 86, each for a synthetic customer name against a synthetic list entry	Match score 84 opens no alert; match scores 85 and 86 open a screening alert and hold the payment	Match scores 84 and 85 opened no alert and released the payment; match score 86 opened a screening alert and held the payment	Failed: the comparator uses greater than 85 instead of 85 or higher; defect DEF-2210, critical severity, blocks release
CBK-DL-13.1	Chargeback response deadline for Visa Dispute Condition 13.1 (Merchandise/Services Not Received): block submission of the response package after the network time limit. Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition, section 11.2.3, Table 11-2: the Dispute Response time limit is 30 calendar days from the Dispute Processing Date, with listed regional exceptions for some domestic transactions	Below: calendar day 29 after the Dispute Processing Date; at: calendar day 30; above: calendar day 31, all dates counted in UTC	Calendar days 29 and 30 accept the response package for submission; calendar day 31 blocks submission and marks the dispute case as expired	Calendar days 29 and 30 accepted the response package for submission; calendar day 31 blocked submission and marked the dispute case as expired	Passed, 3 of 3 test values, run 2026-09-14
COL-CALL-01	Regulation F call frequency: block a further collection call to a person about a particular debt after seven calls within seven consecutive days. 12 CFR 1006.14(b)(2)(i)(A) and (b)(2)(ii): subject to the exclusions in (b)(3), a debt collector is presumed to comply if it places a telephone call to a particular person about a particular debt not more than seven times within seven consecutive days, and is presumed to violate the rule if it places calls in excess of that frequency	Below: sixth call to one person about one debt within seven consecutive days; at: seventh call; above: eighth call	The sixth and seventh calls are placed; the eighth call is blocked by the dialer and rescheduled after the seven-consecutive-day period	The sixth and seventh calls were placed; the eighth call was blocked by the dialer and rescheduled after the seven-consecutive-day period	Passed, 3 of 3 test values, run 2026-09-14
EXP-RCPT-01	Expense policy receipt threshold: require a receipt before submission of a non-lodging expense of USD 75.00 or more. 26 CFR 1.274-5(c)(2)(iii)(A)(2): except as provided in (c)(2)(iii)(B), documentary evidence is required for any expenditure other than lodging of $75 or more, except that documentary evidence for transportation charges is not required if not readily available	Below: meal expense of USD 74.99; at: meal expense of USD 75.00; above: meal expense of USD 75.01	The USD 74.99 meal expense submits without a receipt; the USD 75.00 and USD 75.01 meal expenses are blocked until a receipt is attached	The USD 74.99 and USD 75.00 meal expenses submitted without a receipt; the USD 75.01 meal expense was blocked until a receipt was attached	Failed: the rule uses greater than USD 75.00 instead of USD 75.00 or more; defect DEF-2213, medium severity, fix scheduled for the next release and does not block this release
MD-ENT-01	Market data non-professional subscriber entitlement: grant the non-professional entitlement only to a natural person who is not registered or qualified in any capacity with the SEC, the CFTC, any state securities agency, or any securities exchange or association; not engaged as an investment adviser under Section 202(a)(11) of the Investment Advisers Act of 1940, whether or not registered; and not employed by an exempt bank or organization to perform functions that would require registration. Nasdaq Equity 7, Section 147(d)(4)(A), as quoted in SEC Release No. 34-94466 of 18 March 2022	Below: natural person with no registration and no adviser role; at: natural person acting as an unregistered investment adviser; above: subscriber account opened in a company name	Only the natural person with no registration and no adviser role receives the non-professional entitlement; the unregistered investment adviser and the company account receive the professional entitlement	The natural person with no registration and the unregistered investment adviser received the non-professional entitlement; the company account received the professional entitlement	Failed: the status attestation checks registration only, so subscriber counts reported to the exchange are wrong; defect DEF-2211, high severity, blocks release
CLM-AUTO-01	Claim auto-approval limit: approve a claim without adjuster review when the payable amount after the deductible is XTS 2,500.00 or less. Configured claims authority limit; no regulation sets the amount	Below: payable amount of XTS 2,499.99; at: payable amount of XTS 2,500.00; above: payable amount of XTS 2,500.01	The XTS 2,499.99 and XTS 2,500.00 claims are approved automatically and queued for payment; the XTS 2,500.01 claim goes to adjuster review with no payment queued	The XTS 2,499.99 and XTS 2,500.00 claims were approved automatically and queued for payment; the XTS 2,500.01 claim went to adjuster review with no payment queued	Passed, 3 of 3 test values, run 2026-09-14

Rule IDs, defect IDs, customers, claims, and run dates are synthetic, USD appears only where a regulation states the threshold in USD while configured limits use XTS (the ISO 4217 test code), and rule references were checked on 2026-09-16 against eCFR, the Visa Core Rules and Visa Product and Service Rules of 18 April 2026, and SEC Release No. 34-94466.

Questions

What is a chargeback?

A chargeback is the reversal of a card transaction that the cardholder's issuer starts through the card network, which returns the disputed amount from the acquirer to the issuer. The acquirer then debits the merchant under the merchant agreement. The Visa Rules call this step a Dispute and allow it only when every condition of the chosen dispute condition is met, including its time limit.

What is chargeback representment?

Chargeback representment is the merchant's challenge to a chargeback, sent through the acquirer to the issuer with evidence that the transaction was valid. Under the Visa Rules of 18 April 2026, the acquirer sends a Dispute Response for processing error and consumer dispute conditions, or a pre-Arbitration attempt for fraud and authorization conditions, within 30 calendar days of the Dispute Processing Date, with regional exceptions.

What are the potential outcomes of chargeback representment?

Under the Visa Rules of 18 April 2026, a Dispute Response on a processing error or consumer dispute ends the case unless the issuer makes a pre-Arbitration attempt within 30 calendar days of the Dispute Response Processing Date. The acquirer accepts or declines that attempt within 30 calendar days. After a decline, the issuer may file for Arbitration within 10 calendar days, and Visa decides the case.

How do chargebacks affect merchants?

A chargeback moves the disputed amount back to the issuer, and the acquirer debits the merchant, who keeps the loss if the dispute is not won. Chargebacks also count toward network monitoring: the Visa Acquirer Monitoring Program ratio adds disputes and fraud reports over settled card-not-present transactions, and the Mastercard Excessive Chargeback Program divides a month's chargebacks by the preceding month's transactions.

Scope testing for your chargeback platform

Send your processor integrations, reason code mapping, evidence templates, and fee model, and we return a test scope with the evidence merchants and acquirers ask for.

Scope your testing