Mastercard reason code 4837: No Cardholder Authorization

Quick answer: Mastercard reason code 4837 is No Cardholder Authorization. The cardholder says they did not make or approve the purchase. It is Mastercard's equivalent of Visa 10.4, and on Shopify it appears as Fraudulent. The cases you can win are the ones where the order is tied to the real cardholder: the customer completed 3-D Secure, the address and security-code checks matched, the goods went to the billing address, or the customer has earlier undisputed orders and activity after the sale.

Last reviewed 8 October 2026. Card network rules and Shopify's process change, so always check the due date and instructions on your own dispute.

Mastercard 4837 at a glance

Network and code	Mastercard 4837, No Cardholder Authorization
Shopify label	Fraudulent
What the customer claims	"I did not make or approve this purchase."
Who it affects	Any store selling online, by phone or by mail order to Mastercard holders
Your response window on Shopify	Usually 7 to 21 days, shown on the dispute page
Bank decision time	Up to 75 days after you submit, per Shopify
How many times you can submit	Once
Strongest evidence	3-D Secure completed, matching address and security-code checks, delivery to the billing address, earlier undisputed orders
Default call	Fight if the order is linked to the cardholder. Accept if it is a first-time buyer with failed checks and a new delivery address.

What Mastercard 4837 means

Mastercard groups its disputes by code number, and 4837 is the main fraud code for card-not-present sales. The cardholder tells their bank that they did not authorise the transaction, or that someone else used their card. The bank raises a chargeback to the merchant's bank, and the merchant is asked to prove otherwise.

As with other fraud disputes, the claim is not always true fraud. Some cardholders did place the order and later forget, do not recognise the name on their statement, or have a family member who used the card. The bank cannot tell the difference without evidence, which is why your response matters.

It is easy to confuse with Mastercard's other dispute code, 4853 (Cardholder Dispute), which covers consumer claims such as non-receipt or quality. See our 4853 guide. In a 4837 the customer is saying the purchase itself was not theirs.

Equivalent codes on other networks

Network	Code	Name
Mastercard	4837	No Cardholder Authorization
Visa	10.4	Other Fraud: Card-Absent Environment. See our 10.4 guide
American Express	F29	Card Not Present. See our F29 guide
Discover	UA02	Fraud: Card-Not-Present

How a 4837 dispute unfolds on Shopify

Shopify's help pages describe the sequence:

Stage	What happens
Day 0	The customer's bank raises the dispute. Shopify withdraws the disputed amount and the chargeback fee from your balance straight away.
Days 1 to 21	You gather evidence. Shopify says you usually have 7 to 21 days, and the exact deadline is on the dispute page.
Submission	You submit your response, which can be done once.
Review	The bank reviews it. Shopify says this can take up to 75 days.
Outcome	If you win, the amount is returned, and the fee may be too, depending on your country. If you lose, the money stays with the customer.

Mastercard disputes can pass through later stages if neither side accepts the first decision. Shopify manages those for you and tells you what it needs. The practical point is that your first response should contain everything, because evidence can be submitted only once.

Two checks before you write anything

1. Was 3-D Secure used? On Mastercard this is the authentication step the customer completes with their bank, often called Mastercard Identity Check. When a customer completes it, responsibility for a fraud dispute generally moves to the card issuer. If you have an authenticated order and a 4837, say so at the top of your response.
2. What did Shopify's fraud analysis say? If the order was flagged as high risk and you shipped anyway, your position is harder. If the risk was low and the checks matched, say that.

What the bank actually checks

The reviewer is asking whether the real cardholder was behind the order. The signals are the same family as for any card-not-present fraud dispute.

1. Authentication. Did the customer complete 3-D Secure?
2. Payment checks. Did address verification and the card security code return a match?
3. Delivery. Was the order delivered to the billing address, or to an address in the customer's history?
4. History. Does the customer have earlier orders with the same card that were never disputed?
5. Technical match. Do the IP address, device and email fit earlier orders from the real customer?
6. Behaviour after the sale. Did the customer contact you, log in or use the product?

The more of these you can show, the less likely the reviewer is to believe a stranger used the card.

Signals that point to friendly fraud and to true fraud

Signal	Points to the real cardholder (friendly fraud)	Points to a stolen card (true fraud)
Authentication	3-D Secure completed	Not attempted, or failed then retried
Address checks	Both matched	Failed, or billing address in a different country
Delivery	To the billing address, signed for or photographed	To a new address, freight forwarder or distant parcel locker
History	Earlier orders, no disputes	First order, account created minutes before
Contact after sale	Tracking emails opened, customer wrote in	No contact
Order pattern	Normal basket	High-value items, express shipping, repeated attempts

Where most signals sit in the left column, fight. Where most sit in the right column, accept and prevent. Where they are mixed, use the break-even maths below.

Worked example 1: a winnable case

A store selling skincare receives an order for £96.00 on 2 September from a customer in Bristol. The customer completes 3-D Secure, the address check and the security-code check both match, and the parcel is delivered to the billing address on 5 September. On 12 October the bank raises a 4837 dispute.

The merchant looks through the order and finds:

• A note that 3-D Secure was completed at checkout.
• A match on the address and security-code checks.
• Delivery to the billing address, scanned on 5 September.
• Three earlier orders from the same email and card (£38, £54 and £71) over the last year, none disputed.
• A customer account login on 8 September.

The letter opens with the authentication, lists the checks, shows the delivery and then the order history in a small table. The reviewer sees every signal pointing to the cardholder. This is a strong case, and may be one the bank should not have raised at all.

Worked example 2: a case to accept

The same store receives an order for £312.00. It is a first purchase from a new email. The billing address is in Glasgow, the delivery address is a parcel locker in Plymouth, the address check failed, 3-D Secure was not used, and Shopify flagged the order as high risk. The merchant shipped it anyway. Two months later a 4837 arrives.

There is nothing connecting the order to the cardholder. Accepting costs the same money as losing and saves the time. The useful work comes afterwards: review orders with this profile before shipping, and cancel those you cannot verify.

The break-even maths

The disputed amount and the fee are already withdrawn whether you fight or not, so the only extra cost of fighting is your time.

Break-even win chance = value of your time ÷ money you would recover if you win.

Order value	Time to respond (45 min at £20/hour)	Break-even win chance
£40	£15	37%
£96	£15	16%
£312	£15	5%
£800	£15	2%

On higher-value orders, even weak links to the cardholder can justify the time. On small orders, fight only with strong proof. Use our Should I Fight This Chargeback? calculator for your own figures.

Should you fight it or accept it?

What your records show	What to do
3-D Secure completed by the customer	Fight. Lead with it.
Delivered to the billing address, checks matched	Fight. Add the delivery scan.
Repeat customer with undisputed earlier orders	Fight. List them in a table.
Customer logged in or contacted you after the sale	Fight. Show the activity with dates.
First-time buyer, new shipping address, failed checks	Usually accept. Chances are low.
Shopify flagged high risk and you shipped anyway	Usually accept, then tighten rules.
Order not yet shipped	Cancel and refund.

How to respond to a Mastercard 4837 dispute, step by step

1. Read the dispute and note the deadline. Open the dispute in Shopify and check the reason, the amount and the due date.
2. Check authentication and fraud analysis. Look for 3-D Secure, the address and security-code results and the risk level.
3. Compare billing and shipping addresses. Put them side by side.
4. Search for earlier orders. Search by email and address. Note dates, amounts, delivery status and any disputes.
5. Collect delivery proof. Tracking number, carrier, status, date and time, and any signature or photo.
6. Gather activity after the sale. Account logins, tracking emails opened, messages, downloads.
7. Write a short, factual letter. One page. Lead with the strongest fact and use the template below.
8. Attach the proof and submit once. Check every attachment opens, and remember you cannot add anything afterwards.

The evidence checklist

Evidence	Where to find it
Order number, date, items, amount and currency	The order page
Whether 3-D Secure was completed	The order's payment details and fraud analysis
Address verification and security-code results	The order's payment details
Billing and shipping address side by side	The order page
Tracking number, carrier, delivery status, date and time	The fulfilment section and the carrier
Delivery photo or signature	The carrier's tracking page, if provided
A table of earlier orders from the same customer	Search the orders list by email
Logins, downloads or product use after the sale	Your account system or logs
Customer messages about the order	Support inbox or chat
Your refund and shipping policy	Your store policies

A letter you can adapt

To the issuing bank,

We ask that this dispute for order [ORDER NUMBER], [AMOUNT] placed on [DATE], is reversed. The evidence shows the order was placed by the cardholder.

Authentication and checks. [3-D Secure was completed on this order.] The address verification check and the card security code check both returned a match.

Delivery. The order was shipped with [CARRIER] under tracking number [NUMBER] and delivered on [DATE] at [TIME] to [ADDRESS], which matches the billing address.

History. The same customer placed [N] earlier orders, none of which were disputed: [DATE, AMOUNT], [DATE, AMOUNT].

Activity after the sale. [The customer logged in on DATE / wrote to us on DATE regarding the order.]

The attachments show the order, delivery confirmation and order history. We ask the bank to reverse the dispute.

Keep it to one page. State facts only and point to the attachments. Do not accuse the customer.

Common mistakes

• Forgetting to mention 3-D Secure. It can change who is responsible. Put it first.
• Not showing the billing address next to the shipping address.
• Leaving out earlier orders. They are often the clearest proof of a genuine customer.
• Writing about your company instead of the order. Reviewers read many responses; keep to the facts.
• Fighting with no links to the cardholder. You will pay the fee and lose the sale.
• Adding documents after submitting. You cannot.
• Missing the deadline.

How to reduce 4837 disputes

1. Use 3-D Secure. It is the single most effective step against card-not-present fraud disputes.
2. Review higher-risk orders before shipping and cancel those you cannot verify.
3. Be careful with different billing and shipping addresses, especially on first orders.
4. Send clear order and shipping emails so the cardholder remembers the purchase.
5. Use a clear billing descriptor that matches your trading name.
6. Verify high-value first orders with a short email before dispatch.
7. Keep an eye on your dispute rate. Mastercard runs monitoring programmes that look at chargeback counts and ratios. Our Mastercard excessive chargeback calculator and the guide to chargeback rate and thresholds show where you stand.
8. Keep order history searchable so repeat-customer proof is easy to find.

Glossary

• Issuer. The bank that issued the customer's card.
• Acquirer. The bank or provider that processes your payments.
• Mastercard Identity Check. Mastercard's 3-D Secure service.
• Chargeback. A reversal of a card payment started by the issuer after the customer disputes it.
• Representment. Your response with evidence, sent back to the bank.
• Arbitration. A later stage in which the card network decides if the parties cannot agree.
• Friendly fraud. A dispute in which the genuine cardholder made the purchase.

How ChargeFix handles it

ChargeFix reads the order, payment and shipping records from Shopify. It shows the billing and shipping addresses side by side, includes the address and security-check results the payment returned, and pulls the delivery status and tracking events. If something is missing, it says so rather than writing around it. It scores the evidence, tells you whether the case looks worth fighting, and drafts a letter using only facts found in your records. You review it before anything is saved or filed. Install it free.

Frequently asked questions

What does Mastercard reason code 4837 mean? The cardholder says they did not authorise a purchase. On Shopify it shows as Fraudulent.

Is 4837 the same as Visa 10.4? They cover the same claim, no cardholder authorisation in a card-not-present sale, on different networks. The evidence you gather is similar.

Does 3-D Secure protect me from 4837? In most cases it moves responsibility for the fraud dispute to the card issuer when the customer completed authentication. If you receive a 4837 on an authenticated order, state this and ask your payment provider.

What evidence wins a 4837 dispute? Authentication, matching address and security checks, delivery to the billing address, earlier undisputed orders and activity after the sale.

How long do I have to respond on Shopify? Shopify says you usually have 7 to 21 days, and the exact date is on the dispute page. Evidence can be submitted only once.

How long does the bank take to decide? Shopify says the review can take up to 75 days after you submit.

Can a 4837 go to arbitration? Mastercard disputes can proceed to later stages. Shopify manages them, but your first response should contain all your evidence because it can be submitted only once.

Should I fight a first-time order shipped to a new address? Usually not. Without a link to the real cardholder, the chances are low.

What if the customer's family member placed the order? From the bank's view it is still unauthorised if the cardholder says so. Evidence of delivery to the cardholder's address and use of the product can still help.

What is the difference between 4837 and 4853? 4837 is a fraud claim: the purchase was not the cardholder's. 4853 is a consumer dispute: the cardholder made the purchase but has a complaint.

How many 4837 disputes will put me in a monitoring programme? Thresholds change and depend on your volume, so use the calculators on this site and your provider's guidance.

Do I get the chargeback fee back if I win? It depends on your country and payment provider. Check Shopify's help page for your region.

Sources and review

• Shopify Help Centre, Overview of the chargeback and inquiry process: response window, decision time, fees and accepted evidence.
• Shopify Help Centre, Chargeback reasons: how Shopify groups dispute reasons
• Stripe, Dispute categories and reason codes: the card network code and the category it falls under
• Adyen, Dispute reason codes and defense requirements: what each code covers
• Mastercard's published reason code lists, as summarised by major payment providers. Card network rules change, so confirm current details with your payment provider.

Written by the ChargeFix team. We update this page when Shopify or the card networks change their rules.