Shopify fraudulent win tool: real vs friendly fraud

Two people file the same dispute this week. Both tell their bank the charge on your store was "fraudulent". One really did have a card number stolen, and a stranger bought $310 of electronics with it. The other is a regular customer who has ordered from you four times, and whose partner placed this order without telling her. The bank sees one reason code. You are expected to treat them as one case. They are not.

A Shopify chargeback fraudulent win tool is meant to tell them apart. It checks the order against the signals that separate real card fraud from a customer who forgot, a family member who ordered or a descriptor nobody recognized, scores the evidence and drafts a response only for the cases where your records support one. This guide explains what those signals are, how Visa's Compelling Evidence 3.0 rule works, when to accept a fraud dispute, how Shopify Protect fits in and what a tool can honestly promise.

This guide is for you if:

You sell physical products on Shopify with Shopify Payments and receive "fraudulent" or "unrecognized" disputes.
You want to know which fraud disputes are worth fighting and which are lost before you start.
You are weighing a tool and want to see what a sensible verdict looks like.

Last updated: 30 October 2026. Written by the ChargeFix team. Reviewed against sources on 30 October 2026.

A note on bias: we make ChargeFix, so we gain if you try a tool. Some fraud disputes are genuine and should be accepted, and we say so plainly. Every dollar figure and win chance in the worked examples is an assumption, not a customer result. Card network rules change, so check current terms before relying on any threshold below.

The 30-second answer (TL;DR)

A fraud dispute can mean three different things: genuine card fraud, "friendly fraud" where the cardholder or a household member made the purchase, or an unrecognized charge the customer simply did not connect to your store.
Genuine card fraud is usually a loss. The honest move is to accept it and tighten your screening. Friendly fraud and unrecognized charges are where evidence wins.
Visa's Compelling Evidence 3.0 rule applies only to reason code 10.4. It looks for two earlier undisputed transactions 120 to 365 days old with two matching data elements, one of which must be the IP address or device ID.
Shopify Protect covers fraudulent and unrecognized disputes only for eligible orders, and it needs Shop Pay, physical goods and prompt shipping. If an order is covered, you may not need to fight at all.
A tool can score the signals and draft a response from real records. It cannot know who really used the card.
Never claim facts your records do not show. A false claim is checkable and the evidence is final once submitted.

Quick note: The most useful question on a fraud dispute is not "can I win?" but "do my records suggest the cardholder, or someone close to them, made this order?" If yes, build the case. If the records point to a stranger, accept it and spend your time on prevention.

At a glance

Type of "fraud" dispute	What is really happening	Signals in your records	Usual call
Genuine card fraud	A stranger used a stolen card	New account, AVS or CVV fail, shipping differs from billing, forwarder address, odd IP	Accept, then tighten screening
Friendly fraud	The cardholder or household made the order	Prior orders, same address and email, delivered to billing address, matched device	Fight with history
Unrecognized charge	The customer did not recognize your name on the statement	Real order, delivered, normal history	Fight, and fix the descriptor
Covered by Shopify Protect	Eligible order, covered reason	Shop Pay, physical items, shipped in time	Check Protect first

What is a Shopify chargeback fraudulent win tool?

It is a tool that reads the order, payment, fulfillment and customer records behind a "fraudulent" or "unrecognized" dispute, checks them against the signals a bank looks for and returns a verdict plus a drafted response built only from real records.

The word "win" describes the aim, not a guarantee. No tool controls what an issuing bank decides, and ChargeBackWiz's own site says no tool guarantees wins. What a good fraud tool does is stop you fighting cases that your own data already lost and put the strong cases in front of the bank properly.

A fraud tool differs from a general evidence generator in that the key question is identity, not delivery. For the wider picture of how evidence is assembled, see our guide to the Shopify chargeback evidence generator.

What are the three kinds of "fraud" dispute?

The reason code is the same, and the stories are very different.

Genuine card fraud. Someone obtained a card number and used it. The real cardholder did not authorize the purchase and has every right to dispute it. If the signals in your records point this way, the bank is likely to side with the cardholder, and you should too.

Friendly fraud. The cardholder, or someone in their household, made the purchase and then disputes it. The cardholder may have forgotten, may be embarrassed, may be hoping for a free product or may genuinely not know a family member used the card. The term covers a mix of motives, and you rarely know which one applies.

Visa's 2025 figures put friendly fraud at about 20 percent of fraudulent disputes globally and up to 30 percent for high volume online merchants. Javelin Strategy and Research's 2025 estimate has merchants at 20 percent and issuers at 19 percent, and Juniper Research expects 22 percent of chargebacks in 2026 rising to 28 percent by 2031. None of these are specific to the US or to Shopify stores, so treat them as a rough scale.

Unrecognized charge. The customer did make the order but does not recognize the name on the statement. A store called "Moonlit Candles" that bills as "MCS*BRANDHOLD" invites this. The charge is legitimate and the fix is a clearer descriptor.

A tool cannot know which of the three applies. It can only read the signals in your records.

Which signals separate real fraud from friendly fraud?

The signals sit in your order data. Here are the ones worth checking, and what each suggests.

Prior history. An email or account that bought from you before, with orders that were not disputed, is the strongest argument against a stranger. A new account with a first order is the opposite.

Address match. Delivery to the billing address suggests the cardholder, or someone at their address, received the goods. Delivery to a different address is not proof of fraud, since gifts are normal, but a first order shipped to a new address with a failed address check is a classic pattern.

AVS and CVV results. The address verification and card security code checks recorded at payment. A pass on both does not prove the cardholder bought, since stolen data can include both. A fail is a warning.

IP and device. Does the IP location fit the billing area? Has this device been used on earlier orders from this customer? A match with earlier undisputed orders is useful. A mismatch with a distant country is not.

Email and name. An email that looks auto-generated, a name that does not match the card or an account created minutes before the order are common signs of fraud. They are signs, not proof.

Order shape. Unusually high value for your store, rush shipping on a first order, multiple units of a resellable item and several cards tried in a row all raise risk.

Delivery detail. A signature from someone at the billing address, or a photo at the billing address, supports a household explanation. A forwarder address or a hold-at-carrier pickup supports the opposite.

Customer contact. Did the customer write to you about this order before disputing? A friendly message after delivery can close the case. A message saying "I did not order this" is the opposite.

A good tool shows you each signal and its result, so you can see why it reached a verdict.

How does Visa Compelling Evidence 3.0 work?

Compelling Evidence 3.0, often called CE 3.0, is a Visa rule that lets a merchant show that a disputed transaction fits a pattern of earlier undisputed ones. It is the most specific tool a merchant has against friendly fraud, and many stores miss it.

The conditions, as Redo's guide and other sources summarize them, are these.

Reason code. It applies only to Visa reason code 10.4, which is the fraud, card-absent environment code. It does not help with not received, credit not processed or other reasons.

Earlier transactions. You need two earlier transactions that were not disputed and that are between 120 and 365 days old at the time of the disputed one.

Matching data. The earlier transactions and the disputed one must share two matching data elements, and one of them must be the IP address or the device ID. The other can be a data point such as the shipping address, account ID or email.

Subscriptions. Merchants with recurring billing can use the data from the initial transaction. This helps subscription stores more than one-off sellers.

Automatic qualification. Visa began automatically qualifying some transactions from 17 October 2025. How that applies to a given Shopify store is worth checking in your admin and with Shopify.

When a case meets the conditions, the effect can be to move liability away from the merchant. When it does not, the rule gives you nothing. A tool that checks the conditions in seconds is worth having for this alone.

Note two limits. A first-time buyer can never qualify, because there are no earlier transactions. And an order placed in the last 120 days cannot be used as one of the two prior transactions.

Does Shopify Protect cover fraud disputes?

For some orders, yes. Shopify's Protect terms say it covers two reasons only: unrecognized and fraudulent. No other chargebacks receive the warranty.

The conditions are strict.

The merchant must operate in the US, hold a US bank account and be enrolled in Shopify Payments.
Protect must be activated in the admin before a chargeback notice arrives.
The order must be card-not-present and authorized through Shopify Payments, and Shop Pay is required.
It covers only orders made entirely of physical items that need shipping. Any digital item excludes the order.
You must ship with a supported tracking number within 7 days of the order, and the carrier must mark it in transit within 10 days.
The chargeback notice must arrive within 12 months of the order date.
Changing the shipping address after checkout voids coverage.
For subscriptions, only the initial order is covered.
Protect pauses if a merchant is in a card network chargeback monitoring program.

When an order is covered, Shopify pays the chargeback amount and waives the fee. It is not insurance, and Shopify can change or stop the program, though existing warrantied transactions stay covered.

The practical rule: before you build a response to a fraud dispute, check whether the order is protected. If it is, you may not need to. For the many orders that fall outside it, you do. Our post on what Shopify Protect does not cover lists the gaps.

When should you accept a fraud dispute?

Accepting is a legitimate choice, and sometimes the right one. Accepting means the amount goes to the customer and the fee is not refunded, and there is no appeal.

Accept when the signals point to a stranger. A typical profile: a first order, a failed AVS check, a shipping address that differs from billing, a mismatched IP, a freight forwarder or hold address and no history. Fighting this case means arguing the cardholder made an order that almost certainly they did not.

Also accept when the proof is missing. If you cannot show anything beyond the order itself, you are asking the bank to rule on nothing. The default response Shopify sends contains order data and is not much different.

Fight when the signals point to the cardholder or household: prior undisputed orders, matched device, delivery to the billing address, a signature or a friendly message after delivery.

Accepting does not end the matter. A genuine fraud dispute is information. Look at what the order had in common with earlier ones, tighten screening, add a manual review step for similar profiles and consider requiring a signature on high value parcels.

How does fraud screening fit in?

A win tool works after the dispute. Screening works before. They do different jobs, and you need both.

Shopify shows an order risk analysis on many orders, and you can add rules, review high risk orders by hand and cancel before shipping. A card check such as AVS and CVV is a start, and 3-D Secure authentication, where it applies, can shift liability for some fraud disputes to the issuer. How that works for your store depends on your region and settings, so check with Shopify.

Third-party fraud tools and guarantee services exist as well. Some reimburse chargebacks on approved orders for a fee. They are a separate purchase, and they do not replace a response process. We compare options in our post on chargeback insurance vs a chargeback app.

Screening matters because prevention is the only thing that lowers your dispute count. Card network programs count disputes whether you win or lose. Under Visa's acquirer monitoring program, the excessive threshold fell to 1.5 percent from 1 April 2026 once a merchant reaches 1,500 fraud and dispute cases in a month. Most small stores will not reach that volume, but the principle is the same at any size: fewer disputes beat more wins.

Illustration: a returning customer, a household order

Priya runs a stationery shop. A customer who has bought four times, with no disputes, files a fraud dispute on an $85 order. The order shipped to the same address as the previous four and was delivered with a photo. The IP address matches two of the earlier orders. Priya values her time at $30 an hour. All numbers are assumptions.

Item	Calculation	Result
Swing per win	$85 + $15	$100
Review time with a tool	8 min at $30 an hour	$4
Break-even win chance	$4 / $100	4.0%
Assumed win chance	strong history, matched IP, assumption	70%
Expected gain	70% x $100	$70
Expected result	$70 - $4	+$66

This is a fight. The letter should name the prior orders by date, state that the address and IP match and attach the delivery photo. Priya should not call the customer a fraudster. She should say what her records show and let the bank connect the dots.

If the earlier orders also fit the Compelling Evidence 3.0 conditions, the response should say so in specific terms, with dates and matched data.

Illustration: a stranger, a stolen card

A new customer places a $310 order for headphones. It ships to an address that differs from the billing address. AVS fails. The IP comes from another country. The delivery address turns out to be a freight forwarder. Three weeks later the real cardholder disputes it. All numbers are assumptions.

Item	Calculation	Result
Swing per win	$310 + $15	$325
Review time with a tool	8 min at $30 an hour	$4
Break-even win chance	$4 / $325	1.2%
Assumed win chance	no history, failed checks, assumption	1%
Expected gain	1% x $325	$3.25
Expected result	$3.25 - $4	-$0.75

The numbers say accept, though only just. The better argument is not financial. The records suggest a stranger used a stolen card, and the real cardholder is right to dispute. Fighting would mean arguing against your own data, and any claim you made about the purchaser would not be supported.

The loss here is bigger than $325, because the goods are gone. The useful response is to change what produces such orders: require a manual review for first orders above a threshold, flag forwarder addresses and hold high value first orders until the address passes. The tool's verdict is the start of that conversation, not the end.

Illustration: checking Compelling Evidence 3.0 on dates

A customer disputes a $64 order placed on 20 October 2026 as fraudulent. The customer has three earlier orders. The tool checks whether they fit the 120 to 365 day window. The dates and the day counts are made up for illustration.

Earlier order	Date	Days before 20 Oct 2026	In the 120 to 365 day window?
Order A	14 Feb 2026	248	Yes
Order B	3 Jun 2026	139	Yes
Order C	5 Sep 2026	45	No, too recent

Orders A and B fit the window. The next test is the data: the disputed order and each earlier order need two matching elements, and one must be the IP address or device ID. Suppose both A and B share the customer's email and device ID with the disputed order. That satisfies the rule: two earlier undisputed transactions in the window, two matching elements and one is a device ID. Order C is irrelevant to the CE 3.0 test, though it still counts as history in the letter.

If only the email matched, the rule would not be met, because neither the IP nor the device ID matched. The tool should say that clearly instead of implying the rule is satisfied. A response that claims CE 3.0 without meeting it will fail, and it spends your credibility.

What does a tool do with a fraud dispute?

A good one works through a short sequence.

Reads the order. Payment checks, addresses, device and IP data Shopify holds, delivery details.
Reads the history. Earlier orders from the same customer and whether any were disputed.
Tests CE 3.0. Counts qualifying prior transactions and checks matched elements.
Checks Protect. Notes whether the order might be covered.
Scores the evidence. Combines the signals into a strength rating and a worth-fighting verdict.
Drafts a response only from what exists. Prior orders by date, matched elements, delivery detail. No invented history.
Waits for you. The draft is yours to edit and approve.

If step 6 produces very little, that is the answer. A thin draft on a stranger order means accept.

What can a fraud tool not do?

It cannot see inside the cardholder's life. Records show orders, not who held the card.

It cannot create history. A first-time buyer has none.

It cannot override a bank. The issuer decides, and fraud disputes are among the hardest to reverse.

It cannot lower your dispute count. Winning returns money, not ratio.

It cannot cover processors it does not support. ChargeFix works with Shopify Payments only.

It cannot guarantee that a CE 3.0 claim will be honored. The rule sets conditions, and the bank applies them.

How does ChargeFix handle fraud disputes?

ChargeFix reads the order, payment, fulfillment and customer records in Shopify when a dispute arrives and checks them against the signals above.

It shows the signals. History, address match, delivery detail and the payment checks Shopify holds, so you see why a verdict was reached.

It scores the evidence. Each case gets an evidence strength score and a worth-fighting verdict. A returning customer with a matched address and a photo scores very differently from a first order shipped to a forwarder.

It drafts from your records. The letter cites real prior orders and dates. It does not invent history, claim a signature or accuse the customer.

You stay in control. Manual mode is the default, so nothing goes to the bank until you review it. Automatic mode is available on Starter and above for stores that want routine cases handled with less touch. Because evidence is final once submitted, we suggest Manual mode for fraud disputes on higher value orders. See our post on automatic vs manual chargeback response.

Flat pricing, no cut of wins. Free includes 2 filings, Starter is $19 for 25, Growth is $49 for 100 and Scale is $99 for unlimited, with a 14-day trial on paid plans. A dispute counts as one filing the first time its evidence is saved or filed, and usage resets on the 1st of each month.

It has limits. It works with Shopify Payments only, does not screen orders, prevent disputes or send alerts and is new, with no public reviews. Customer data is read during review and is not saved.

How do you reduce fraud disputes before they happen?

Use a clear billing descriptor. Make it match the store name customers know.
Review first orders over a threshold. A short manual check on high value first orders catches most obvious fraud.
Flag forwarder and hold addresses. They are overrepresented in fraud, though not all use is fraudulent.
Require signature or photo on expensive parcels. It strengthens household-delivery cases.
Keep order notes and customer messages in one place. They become evidence.
Send a clear shipping confirmation and a delivery confirmation. Customers who see both are less likely to say they do not recognize the order.
Respond to "who ordered this?" emails fast. A customer who gets an answer rarely calls the bank.
Watch repeat patterns. The same card testing across orders, or the same address across names, is worth blocking.

None of these show up as a win, but they lower the number of cases you see.

Common mistakes with fraud disputes

Fighting genuine card fraud. If your data says stranger, accept and fix the screen.
Accusing the customer. State what your records show. Let the bank decide what it means.
Claiming CE 3.0 without meeting it. Check the dates, the window and the matched elements.
Relying on AVS alone. A pass on address and security code does not prove the cardholder bought.
Forgetting Shopify Protect. If an order is covered, you may not need to respond.
Ignoring the descriptor. Unrecognized charges are often a naming problem.
Attaching history without dates. "He's a repeat customer" is a claim. A list of order numbers and dates is evidence.
Missing the due date. Shopify sends thin order data in your place.
Treating a win as the end. The same pattern will come back.

What we checked, and what you should check

We read Shopify's Protect terms and help pages on Protect and the chargeback process, Redo's guide to how Visa Compelling Evidence 3.0 works for Shopify orders, chargeback.io's Visa reason code guide and its statistics page, Chargeback Gurus' article on merchant win rates and ChargebackWiz's site, all on 30 October 2026. Redo, chargeback.io and ChargebackWiz sell related products and Chargeback Gurus is a dispute management firm, so we treat their figures as claims. The friendly fraud shares are global and come from Visa, Javelin and Juniper as reported by chargeback.io, not from a primary read. The signals list and the accept or fight rules are our own reasoning.

The order values, win chances, hourly values and the 8 minute review time are our assumptions. Run your own figures in the chargeback cost calculator. Card network rules and Shopify terms change, so check the live pages before you rely on a threshold or a date.

Frequently asked questions

What evidence wins a fraudulent chargeback on Shopify?

The strongest is history: earlier undisputed orders from the same customer with a matched address, email, IP or device. Delivery to the billing address with a signature or photo helps, and so does a friendly customer message after delivery. For Visa reason code 10.4, Compelling Evidence 3.0 applies when two earlier undisputed transactions between 120 and 365 days old share two matching elements, one being the IP or device ID.

Should I fight a fraud dispute on a first-time customer?

Usually not, unless the signals are strong. A first order has no history and cannot qualify for Compelling Evidence 3.0. If AVS failed, the address differs from billing or the delivery went to a forwarder, the records point to a stranger and accepting is more honest. If the signals are clean and delivery proof is strong, a response is reasonable.

What is Compelling Evidence 3.0?

It is a Visa rule for reason code 10.4 that lets you show a disputed order fits a pattern of earlier ones. You need two earlier undisputed transactions between 120 and 365 days old with two matching data elements, one being the IP address or device ID. Subscription merchants can use the initial transaction data. It applies to Visa only.

Does Shopify Protect cover fraudulent chargebacks?

For eligible orders, yes. Protect covers only fraudulent and unrecognized chargebacks, and requires Shop Pay, physical items only, activation before the notice, shipping within 7 days and carrier acceptance within 10. Changing the shipping address after checkout voids coverage. Check whether an order is protected before you build a response.

What is friendly fraud?

It is a dispute where the cardholder, or someone in their household, made the purchase but tells the bank it was unauthorized. Reasons vary from forgetfulness to a family member's use of the card to deliberate abuse. Visa's 2025 figures put it at about 20 percent of fraud disputes globally and up to 30 percent for high volume online merchants.

Can I accuse the customer of fraud in my response?

You should not. You rarely know the customer's intent, and an accusation you cannot prove weakens the response. State what your records show, such as prior orders, matched addresses and delivery proof, and ask the bank to resolve the dispute in your favor. Let the facts make the point.

Will winning a fraud dispute lower my chargeback rate?

No. Card network monitoring counts disputes, including ones you win. Visa's acquirer monitoring program set its excessive tier at 1.5 percent from 1 April 2026 for merchants with 1,500 or more fraud and dispute cases in a month. Lowering the rate takes screening and prevention, not representment.

Is a fraud tool worth it for a small store?

If you see more than a few fraud disputes a month, usually yes, mostly for the time saved and the honest verdicts. The Free plan covers 2 filings a month, so very small stores can start there. Below that volume, better screening and a clearer descriptor may do more than any tool.

What should I do first?

Pull your last five fraud disputes and sort them into stranger, household and unrecognized. For household cases, check whether the customer had earlier orders you could have used. For stranger cases, look at what the orders shared and add a review rule. For unrecognized cases, check your billing descriptor. Then test a tool on live cases.

Start free trial with ChargeFix

If fraud and unrecognized disputes are costing you time, ChargeFix starts free and moves to flat monthly plans as your volume grows. It never takes a cut of what you win. It checks your order evidence item by item, tells you honestly whether a case is worth fighting and drafts a letter from your real records, so you review a draft instead of starting from nothing. Nothing goes to the bank until you say so, and paid plans include a 14-day free trial.

Start free trial

Shopify chargeback fraudulent win tool: telling real fraud from friendly fraud and when to accept