Dispute guidelines - Cards

Overview of the Cards Dispute Process

When an account owner/cardholder raises a Cards dispute, the process typically follows a standard scenario as shown below :

If you as a merchant are using your own acquirer to process Cards payments with Xendit (Xendit as switcher), Acquiring Bank will forward the dispute directly to you and you will need to work the evidence together with the Acquiring Bank.

Dispute Reasons

Account owner/cardholder may choose to contact their issuing bank/card issuer directly instead of the merchant for various reasons. These situations commonly involve concerns about unauthorized or disputed transactions.

Account owner/cardholder may initiate disputes for various reasons, including:

• Fraudulent transactions: Unauthorized purchases, stolen cards, or identity theft.

• Product or service issues: Item not received, defective products, or significantly different from the description.

• Technical issues: Duplicate charges, incorrect amounts, or uncredited refunds.

• Friendly fraud: When a cardholder intentionally raises a dispute in an attempt to keep the goods/purchase without paying for them, or the customer forgot about the purchase, or a family member made an unauthorized purchase.

When an account owner/cardholder raises a dispute to their issuing bank, Xendit will get a notification from the acquiring bank about the dispute. And we'll let you know about the dispute details.

Understanding Your Liability

When you enter into an agreement to accept credit card payments, you also agree to abide by the rules and regulations set forth by the card networks (e.g Visa/Mastercard). These rules outline the rights, responsibilities, and procedures for handling disputes.

Dispute serves as a protective mechanism for account owner/cardholder, ensuring they can dispute unauthorized or problematic transactions. As a merchant, if a dispute is filed and validated, you are typically held liable for the disputed amount.

Here's a brief overview for clarity:

• 3D Secure (3DS) Transactions:

  • 3DS is an additional security layer for online credit and debit card transactions. When a transaction is authenticated using 3DS, the cardholder is prompted to provide a password or other form of authentication, ensuring that they are the legitimate cardholder.

  • A successful authenticated 3DS transaction typically shifts liability from the merchant to the issuing bank in most fraudulent dispute cases (merchant can still be responsible for reasons such as good/services not delivered, etc).

  • This means that if a fraudulent transaction is successfully challenged by the cardholder, the issuing bank usually bears the loss instead of you (the merchant).

• Non-3DS Transactions:

  • Transactions not authenticated using 3DS lack this extra layer of security. As such, liability for any subsequent dispute will remain with the merchant as you have agreed to take on the risk of processing non-authenticated transactions. In other words, without the protection of 3DS, you have a higher risk of bearing the financial burden of fraudulent transactions.

  • Xendit's advice for merchants wary of these augmented risks is to eschew all non-3DS transactions henceforth.

For more information on Authentication, please refer here

When using Xendit as Payment Facilitator, Xendit will place a hold* on the merchant’s balance responding to the chargeback amount related to the merchant (as stated in Xendit T&C**)

Xendit has the right to disable your cards channel

Upon receiving a high dispute count/ratio, Xendit has the right to temporarily or permanently stop merchants from processing Cards or payments altogether with Xendit, and merchants will also be responsible for any fines/penalty that is imposed by the card network.

* for QRIS, deduction will be made in bulk once the dispute is lost

**see table below

Dispute Reason Code and Defense Requirements

Arbitration

After the first two steps of evidence verification from the bank, there is a possibility that the issuing bank deems the evidence to still be not enough. If so, the issuing bank can then raise the dispute to arbitration.

Xendit will inform you about the arbitration step, and you'll need to make the decision whether you want to challenge the arbitration or not. If you want to challenge, then we'll require you to collect further evidence and submit it to us at the latest 7 calendar days from the 2nd chargeback / pre-arbitration notification, and we will send it to the acquiring bank, and then the issuing bank. If you win, you'll win the dispute. However, if you lose, the arbitration fee (USD 500 up to USD 600) on top of the amount of lost dispute.

The Card Scheme (i.e. VISA, Mastercard, etc) will be the deciding party of the final dispute status.

Dispute Withdrawal

If your customer wishes to withdraw their dispute, please collect the following information and documents:

• Full name (must match the cardholder name)

• Transaction date

• Transaction amount

• Reason for withdrawal

• Confirmation from their issuing bank / Copy of Retract Letter from Issuing Bank / Copy of Official Form from the Issuing Bank (mandatory)

Please submit / advise the customer to submit these documents directly to chargebacks@xendit.co.

Cards Dispute and Fraud Monitoring Programs

Each network has its own fraud and dispute monitoring programs which are imposed to control and minimize disputes as they want account owner/cardholder to be comfortable opening credit card accounts and using them to make purchases both in person and online.

While these monitoring programs can provide merchants with specific assistance in identifying dispute root causes and developing effective prevention plans, the fines and penalties are quite severe. For example, if you’re enrolled in a program for a certain period of time without improvements in your chargeback/dispute rates, you will be eligible for disqualification from processing the network’s payments.

Visa Acquirer Monitoring Program (VAMP)

Visa launched the Visa Acquirer Monitoring Program (VAMP) on 1 April 2025, combining the former VDMP (Visa Dispute Monitoring Program) and VFMP (Visa Fraud Monitoring Program) frameworks into a single global program.

The VAMP measures performance based on two key metrics:

• VAMP ratio

• VAMP enumeration ratio

VAMP Ratio and Threshold

• Ratio Formula: Count of [Fraud (TC40) + Disputes (TC15)] ÷ Count of Settled Transactions (TC05)

• VAMP Ratio has additional criteria:

  • Excludes disputes resolved through pre-dispute solutions, contingent on the timing of the data extract.

  • Excludes TC 40 fraud qualified for Compelling Evidence 3.0, contingent on the timing of the data extract.

• Dispute with reason codes 10 (except 10.5), 11, 12, and 13

• A single fraudulent transaction may be reflected in both the TC40 and TC15 reports. If a transaction appears in both reports, it will be recorded twice in the VAMP count.

A fine of USD 10 may be applied for each transaction that is deemed fraudulent or disputed, particularly in cases where Merchant got into the Excessive threshold.

VAMP Enumeration Ratio and Threshold

• Ratio Formula: Total number of confirmed cards not present (CNP) enumerated transactions (approved plus declined) divided by the total number of CNP transactions (approved plus declined).

• Ratio Formula: [Count of Enumerated Authorization Transactions (Approved + Declined)] ÷ [Count of Authorization Transactions (Approved+ Declined)], ≥ 2000 bps

• VAMP Enumeration Transaction Count, defined as Enumerated Transactions (Approved + Declined), ≥ 300,000

Mastercard Excessive Chargeback Program (ECP)

Mastercard’s Excessive Chargeback Program (ECP) consists of two levels: Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM), and it applies to users in all supported countries. The program's purpose is to exercise oversight regarding eCommerce merchants and prevent too many chargebacks from occurring on the Mastercard network.

Mastercard Excessive Fraud Merchant Program (EFM)

Mastercard EFM monitors fraud-related chargeback from e-commerce transactions at the merchant ID level. EFM is calculated based on dispute reason code 4837 - No cardholder authorization which indicates that the cardholder did not authorize the charge or reason code 4863 - Cardholder Does Not Recognize—Potential Fraud which indicates that the cardholder claims they don't recognize a card-not-present transaction.

A merchant will be identified as EFM if they meet or exceed all following four criteria: