Chargebacks and fraud in game payments

A chargeback on a $4.99 gem pack costs you the $4.99, a dispute fee that is often three times the sale, and a mark against a ratio that Visa and Mastercard use to fine or cut off merchants. Games are exposed because what they sell is delivered instantly, used up and hard to prove. This page covers why disputes happen, how the card networks count them, who carries them under each payment model, and how to win the ones worth fighting.

Why games draw chargebacks

Game chargebacks fall into four patterns.

Friendly fraud is a dispute over a purchase the cardholder, or someone in their household, made or allowed. Chargebacks911, a dispute management vendor, reports from a 2026 merchant survey that friendly fraud accounts for 43.8% of chargebacks across industries, and that 83.4% of enterprise merchants saw it rise. Chargeflow, another vendor, puts friendly fraud at 79% of gaming chargebacks. Both companies sell chargeback services, and neither figure comes from card network data. In a game the item is credited in seconds, spent within minutes, and there is nothing to send back, so a “not recognized” or “not received” claim is easy to file and hard to rebut.

When a child makes the purchase, it is family fraud. The FTC’s complaint against Epic alleged that children could buy V-Bucks “by simply pressing buttons without requiring any parental or card holder action.” If the parent then disputes the charge with the bank, it reaches you as a fraud claim.

In an account takeover, a stolen game account is used to spend a stored card, or a stolen card loads a stolen account that is then sold. The real cardholder reports fraud, and the issuer files a fraud report against you.

Card testers run batches of stolen card numbers through a cheap checkout to see which ones work. A $0.99 item with no login is an easy target. Visa tracks this separately, as enumeration.

No first-party source publishes an average chargeback rate for games, so this page doesn’t give one. The limits that do exist are the card networks’ thresholds below and the providers’ own, such as Paddle’s acceptable chargeback rate of “Below 0.65% of transaction volume”.

Visa VAMP: the ratio and the 2026 thresholds

Visa merged its fraud and dispute monitoring programs into the Visa Acquirer Monitoring Program (VAMP) in 2025. Thresholds took effect on 1 June 2025, with an advisory period that ended on 30 September 2025. Visa defines the ratio this way:

It covers card-not-present transactions, which is every web shop sale. It counts transactions, not dollars, so a $0.99 dispute weighs the same as a $99.99 one.

Four counting rules catch studios out:

• A transaction reported as fraud and then disputed counts twice. Stripe: “Any transaction that appears in both reports will be counted twice”.
• Refunding does not remove a fraud report already filed, and outcomes don’t matter. Stripe’s docs say “monitoring programs don’t consider dispute outcomes”.
• Disputes resolved through pre-dispute tools, and fraud reports that qualify under Visa’s Compelling Evidence 3.0 rules, are left out.
• The count floor protects small merchants from Excessive status only. A studio needs 100,000 Visa card-not-present sales a month before 1,500 events equals 1.5%. Below that, the ratio can run higher without reaching Excessive, but your acquirer is still watching. Visa rates acquirers as “Above Standard” at 0.5% across their portfolio and “Excessive” at 0.7%, and Stripe describes a merchant “Non-Compliant” level of 0.5% at which Visa “may assess fees”.

Visa does not publish its fine per transaction. Stripe’s summary is that “Visa assesses fees to merchants that exceed the Excessive threshold and may assess fees to merchants that exceed the Non-Compliant threshold.” Figures of around $8 per dispute circulate on vendor sites; we could not trace them to Visa or an acquirer, so we don’t use them. Acquirers set these charges in their own contracts, so ask yours.

Card testing has its own enumeration threshold: a ratio of 20% or more with at least 300,000 events. Stripe says “Visa doesn’t assess fines for VAMP enumeration monitoring”, though the test charges still cost you processing fees. In the US, the Visa Secure Excessive Fraud Program applies at USD 75,000 of fraud and a 0.9% fraud rate on 3D Secure-authenticated transactions; the penalty is losing the fraud liability shift that 3D Secure gives you.

Mastercard: ECM, HECM and EFM

Mastercard runs separate chargeback and fraud programs. Its chargeback ratio divides this month’s chargebacks by last month’s sales transactions, and counts a chargeback “regardless of whether it was hidden due to a refund … and regardless of its outcome.”

A merchant leaves a program after three consecutive months below the threshold. The fine schedule comes from Stripe’s documentation and a J.P. Morgan acquirer guide dated December 2019; Mastercard’s own rules are not public, so confirm current amounts with your acquirer.

Who carries the risk: merchant of record or payment service provider

The card networks count disputes against the merchant account the sale went through. Most of the table below follows from that.

A merchant of record takes the network exposure because it pools many sellers’ sales under its own merchant account. FastSpring describes itself as “responsible for monitoring fraud rates and chargebacks to remain within thresholds set by card networks.” In return it polices your rate, and a studio that pushes the pool’s numbers up can lose its account. Stripe Managed Payments also reserves the right to settle rather than fight: “If we determine that you’re unlikely to win a dispute, we might accept it”. The merchant of record vs payment service provider guide covers the rest of the trade.

What each dispute costs in fees

Stripe’s Smart Disputes service charges 30% of the disputed amount for each dispute it wins. On a $4.99 order, a fought and lost Stripe dispute costs $30 in fees plus the $4.99. Responding adds $15 that comes back only if you win, so at a 40% win rate fighting recovers more than it costs only on orders above about $22.50. Winning does not lower your Visa or Mastercard count either way. The hidden fees guide lists every provider’s other fee lines.

The evidence that wins a game chargeback

Issuers decide game disputes on whether you can show the cardholder, or their account, got and used what they paid for. Build the chain before the first dispute arrives:

1. Payment ID from your provider, linked to the player’s account ID.
2. The item or currency granted, with the server timestamp of the grant.
3. The IP address, device ID and login for the purchase session.
4. Consumption logs: when the currency was spent, on what, and the sessions played after the purchase.
5. The player’s purchase history, including earlier undisputed orders on the same card.

Visa’s Compelling Evidence 3.0 rules turn on the last item. A fraud dispute (reason code 10.4) can be reversed if you show at least two earlier undisputed transactions on the same card, made 120 to 364 days before the disputed one. The disputed and earlier transactions must share two of Visa’s main data elements (purchase IP address, device fingerprint or device ID), or one main element and one secondary one (email address, account ID or shipping address). A game with logins and device IDs has most of this already, if it keeps the logs for a year. Fraud reports that qualify are also excluded from the VAMP ratio.

Pre-dispute tools settle a claim before it becomes a chargeback, which keeps it out of the VAMP count. Stripe charges $15 per Visa resolution, $15 per Compelling Evidence 3.0 block and $29 per Mastercard resolution. Paddle charges its $20 chargeback fee on alerts it refunds.

Why you shouldn’t lock accounts over chargebacks

In the US, banning an account because its owner filed a chargeback is now an enforcement risk. In December 2022 Epic agreed to pay $245 million in refunds over what the FTC called dark patterns and billing practices, and a separate $275 million penalty under the children’s privacy rule. Among the FTC’s allegations was that Epic locked the accounts of customers “who disputed unauthorized charges”.

The order also bars Epic from charging players without their “affirmative consent”. In June 2025 alone the FTC sent 969,173 refund payments totaling more than $126 million, with more payments expected in 2026. The order binds Epic only, but it shows where the FTC draws the line. The safer controls sit before the purchase: a confirmation step, parental spending controls, a visible refund route that is quicker than calling the bank, and a clear statement descriptor so the parent recognizes the charge.

What fraud costs beyond the chargeback

The dispute fee and the lost sale are the visible cost. LexisNexis Risk Solutions’ 2025 study of US and Canadian retail and e-commerce merchants found US merchants incur “an average cost of $4.61 for every $1 of fraud”, counting staff time, fees and replacement. It surveyed 569 executives and does not cover games specifically, so treat it as a sign of scale. For a studio, the unmeasured parts are support time, the team that assembles evidence, and players lost when a legitimate purchase is declined by an over-tight fraud rule.

Checklist

1. Measure your dispute rate as Visa and Mastercard do: count of disputes plus fraud reports per settled transaction, each month, per card network.
2. If you run your own merchant account, find your acquirer’s action thresholds and fees in writing. They may start below Visa’s 1.5%.
3. Log payment ID, account ID, item granted, timestamps, IP, device ID and consumption for every purchase, and keep them for at least 13 months so Compelling Evidence 3.0 can use them.
4. Turn on pre-dispute alerts or resolution tools, and compare their price with your average order and win rate.
5. Add a purchase confirmation step and parental spending controls, and make your statement descriptor match your game’s name.
6. Remove any automatic account ban on chargeback until your lawyers have reviewed it against the FTC’s Epic order.
7. Ask each provider on your shortlist who pays the dispute fee and the lost sale, and whether the fee comes back when you win.