Credit card disputes, explained.

Card disputes for someone who has never handled one

The life of one disputed charge, in five steps

1. The cardholder speaks upRachel Dunmore calls on September 29 and confirms in the app on September 30: three charges on two cards.
2. The bank logs it and names the ruleEach charge is split out and put under Regulation E or Regulation Z, with its deadlines counted on the bank's own calendar.
3. Someone investigates and decidesCard reads, device and location data, the merchant's answer, delivery records and the customer's history, charge by charge. This guide is about this step.
4. A letter goes outA correction notice, or an explanation of why the charge stands with the documents the cardholder may ask for.
5. The money is recovered, or notA chargeback to the merchant's bank under a network reason code, or a loss the issuer absorbs.

Step 3 is the subject of this guide. The people, bank, merchants and figures in this example are fictional.

No required provisional credit, 62-day cycles: what surprises dispute teams

Billing error, billing error notice, chargeback and reason code

Fourteen terms are defined in the one-page summary.

Three rights one card complaint can invoke: billing error, unauthorized use, and claims against the merchant

In shortRegulation Z gives a credit cardholder three separate protections. The billing-error rule covers seven kinds of statement mistake and carries the deadlines. The unauthorized-use rule caps the cardholder's liability at $50. The claims-and-defenses rule lets a cardholder who could not settle a quality dispute with a merchant withhold payment from the issuer. One complaint often invokes two of them, and each has its own conditions.

The seven billing errors

Summarized from 12 CFR 1026.13(a) and comment 13(a)(3)-1.1,4 A quality complaint about goods the cardholder accepted falls outside the billing-error rule, and state law decides whether goods were accepted. A request for a receipt only for tax records starts no clock either.4

Which protections each kind of complaint gets

The commentary is explicit that these run side by side: a non-delivery complaint may be a billing error and a claim or defense at once, and "an assertion that a particular transaction resulted from unauthorized use of the card could also be both a 'defense' and a billing error".7 A cardholder who pays the disputed balance loses the claims-and-defenses right but keeps the billing-error right if the notice came in time.7

Which card dispute rules apply in October 2026, and when each was last changed

In shortThe deadlines date from 1974 and the regulation text from 2011, last amended in 2016. Nothing in 2024 to 2026 changed them. What changed was around them: the CFPB withdrew its buy-now-pay-later interpretation in 2025 and stepped back from supervision, New York proposed dispute rules for pay-over-time lenders, and Visa revised its dispute rules twice a year.

What changed in 2025 and 2026, and what did not

How 60 days, 30 days, two billing cycles and a 90-day cap fit together on a credit card dispute

In shortThe 60-day window runs from the day the issuer sent the first statement showing the charge. The 30-day acknowledgment and 90-day cap run in calendar days from the day the issuer receives the written notice. "Two complete billing cycles" means the rest of the current cycle and the next two full ones, so the real deadline lands on a statement date and is often well short of 90 days.

The commentary settles how to count: "two complete billing cycles means two actual billing cycles occurring after receipt of the billing error notice, not a measure of time equal to two billing cycles". A notice received mid-cycle leaves "the remainder of that cycle plus the next two full billing cycles".4 The statute's "in no event later than ninety days" then caps it.2 For an account whose statement closes on the 18th, that gives a different number of days for every receipt date.

The worked example, autumn 2026

Rachel Dunmore's credit card statement closes on the 18th. The bookcase (August 21) and the ticket (September 9) both first appeared on the September 18 statement, so her 60-day window ran to November 17 if the statement went out on its closing date. Her phone call on September 29 is not a billing error notice, because the rule asks for writing; her message through the app on September 30 counts as written if the bank's billing-rights statement says it accepts electronic notices.1,4

What the issuer may and may not do while the clock runs

After the issuer finds the cardholder owes the charge

If the issuer finds the cardholder owes the amount, it must say so promptly in writing, allow the grace period the cardholder was entitled to, and wait at least 10 days, or the disclosed grace period if longer, before reporting the amount as late. If the cardholder writes again within that time still disputing it, the issuer may report it as delinquent only if it also reports it as disputed and tells the cardholder whom it reported to.1,4

One more rule bites hard: once the resolution period is over, the issuer may not reverse a credit it gave, "even if the creditor obtains evidence after the error resolution time period has passed" that there was no error.4 A late investigation is a lost investigation.

Why the same complaint runs on two clocks when a debit card and a credit card are both involved

In shortRegulation E protects money already taken from a checking account, so it moves faster: oral notice counts, the bank has 10 business days to decide or give the money back provisionally, and 45 days to finish, 90 for point-of-sale, foreign and new-account transactions. Regulation Z protects credit not yet paid, so it waits for written notice and allows up to 90 calendar days. Business days follow the bank's own calendar.

"Business day" in Regulation E is a day the bank's offices are "open to the public for carrying on substantially all business functions".22 A bank that closes for Columbus Day, a Federal Reserve holiday on October 12, 2026, does not count it.21,23

A team that counts in a spreadsheet with weekends but no holidays will post provisional credit a day early, which is harmless, or count a day it should have skipped, which is a violation. Federal Reserve examiners list late provisional credit, late or incomplete notices and generic explanations among the Regulation E error-resolution violations they cited most in 2024.20

Investigating a disputed charge well enough to deny it: what the commentary asks and what today's records add

In shortAn issuer may correct an error as asserted without investigating. To deny, it must investigate reasonably, explain its reasons in writing and send the documents on request. The commentary lists what a reasonable investigation of unauthorized use can include. Non-delivery may be denied only if the goods were actually delivered, mailed or sent as agreed. Signals that a customer is disputing their own purchase can start questions; they cannot be the decision.

What the commentary says an investigation of unauthorized use may include

1. Compare the purchase with the cardholder's usual spending, where it was made and where it was delivered.
2. Look at signatures on sales slips against the issuer's records.
3. Ask for documents, or a written, signed statement, but never an affidavit or statement under penalty of perjury as a requirement.
4. Request a copy of a police report if one was filed.
5. Ask what the cardholder knows about who used the card and whether that person had authority.4,7

The same comment draws the line that the CFPB later litigated. The issuer "may not automatically deny a claim based solely on the consumer's failure or refusal to comply with a particular request, including providing an affidavit or filing a police report". It may end an investigation for lack of information only if it "otherwise has no knowledge of facts confirming the billing error".4 In 2020 the CFPB sued a bank for denying claims automatically when a fraud affidavit was not returned; the case closed in May 2023 with a $9 million penalty.6

Today's records go further than the commentary's list

How much of what is disputed is paid back

The CFPB does not explain the gap between card types. Its data show private-label disputes cluster in "cancelled or credit not issued" and "services not received", where the store issuing the card is often the merchant too.24 Measure your own approval rate by dispute reason and by customer group: a gap you cannot explain is a finding waiting to happen.

Subscriptions, no-shows and unrecognized names: what cardholders disputed in 2024

In shortCardholders disputed $9.8 billion of credit card charges in 2024 and got $5.9 billion back, about $3 disputed for every $1,000 spent. Cancelled recurring charges were the biggest reason on general-purpose cards, at 40% of disputes. Dispute rates rose in 2020 and fell back to 2019 levels by 2024 once spending is taken into account.

Two findings matter for an operation. Recurring charges dominate, and most are not fraud: the cardholder cancelled and the merchant kept billing, which is a question of evidence about the cancellation. And a share of disputes start in confusion: the CFPB cites a survey in which up to 24% of consumers who disputed a charge did so because they did not recognize the merchant's name on the statement.24 A clear answer on the first call, with the merchant's real name and the order, settles some of those before a clock starts.

On private-label store cards the pattern differs: "cancelled or credit not issued" (28%) and "services not received" (27%) lead, and recurring charges are 14%.24 General-purpose cards were more than 85% of disputed dollars in 2024.24

The base keeps growing. Credit card balances stood at $1.26 trillion at June 30, 2026, up $21 billion in the quarter,25 and 38% of consumers said in 2025 that they prefer to pay in person by credit card, against 24% in 2016.26 More card spending means more disputes at the same rate.

Chargebacks, reason codes and Visa's time limits: getting the money back from the merchant

In shortVisa sorts disputes into four categories: fraud (10), authorization (11), processing errors (12) and consumer disputes (13). Most conditions give the issuer 120 calendar days from processing to dispute. The merchant's bank then has 30 days to answer, and each later stage has 30 days more. The network's deadlines and the law's deadlines run separately, and the law protects the cardholder whether or not the merchant pays.

The network rules are contracts among banks. Visa publishes its rulebook; the edition of October 24, 2026 is current.13 If the merchant's bank answers and the issuer still disagrees, the case moves to pre-arbitration, the stage in which one bank contests the other's answer before asking the network to decide. Mastercard publishes a chargeback guide too, but it refused automated reads when this guide was researched, so its time limits are not stated here.

Visa's time limits for the three conditions in the example

Visa Core Rules, October 24, 2026, sections 11.3, 11.8 and 11.11.13 The processing date of the preceding event is not counted as one day.13

The two tracks do not wait for each other. The issuer owes the cardholder an answer within two cycles even when the merchant's reply is still due, and an approved claim cannot be reversed after the period because the merchant later wins.4 The CFPB made the point in January 2025, finding that a payment company "used the card network chargeback process as a substitute for fulfilling its obligations" to investigate consumers' disputes under Regulation E.27

Compelling Evidence 3.0

Visa lets merchants answer a card-absent fraud claim (10.4) with a history of the same customer. Visa's October 2026 rules ask for at least two earlier transactions on the same card, processed more than 120 days and no more than 365 days before the dispute, not reported as fraud, with a matching device ID, device fingerprint or IP address and another identifier such as the account login or delivery address.13,28

If the merchant's evidence meets those conditions, Visa's rules list the fraud dispute as invalid.13 In April 2026 Visa made the check available to merchants before a dispute is filed, inside its order-information service.29

When cardholders dispute their own purchases: first-party fraud, evidence and the limits of a score

In shortSome disputes are filed by the person who made the purchase: forgetting it, regretting it, or knowingly. A Mastercard-sponsored study estimated that 45% of chargebacks in 2024 were fraud of some kind. The issuer still owes every cardholder a reasonable investigation and a written explanation, and a risk score cannot replace either. What wins is evidence the cardholder can be shown.

The study does not split the 45% between cardholders and criminals in what was published, and no regulator publishes the share of disputes filed by the cardholder who made the purchase. The rule of thumb in the trade, that first-party fraud is a quarter of chargebacks or more, traces to vendor summaries. Measure your own: the share of fraud claims you denied after investigation, by channel and merchant type.

Signals that justify a closer look

Regulation Z defines unauthorized use as use by someone without "actual, implied, or apparent authority" from which the cardholder "receives no benefit", and leaves authority to state law.7 A boarded flight in the cardholder's name is evidence of benefit; a model's score that she is risky says nothing about benefit. The denial letter has to give reasons the cardholder can test, and the documents behind them on request.1

Card dispute complaints to the CFPB reached a record in 2026

In shortComplaints about "a purchase shown on your statement" are now the largest issue in credit card complaints to the CFPB: 19,810 in 2025 and 24,925 in January to September 2026 alone, 80% more than in the same months of 2025. Most say the issuer "isn't resolving a dispute". Issuers answer on time almost always, and more than a quarter of 2025's complaints ended with money back.

The CFPB's own reading of 2025 complaints describes what cardholders wrote: billing errors "typically resolved in favor of merchants despite documentation provided", returns not credited, unauthorized charges tied to identity theft, and "having to contact credit card issuers multiple times to resolve disputes".31 In 93% of credit card complaints, consumers said they had first tried to solve the problem with the company.31 A complaint to the CFPB is a public record within weeks, searchable by company.5

Six failures that repeat in card dispute exams and enforcement actions, 2020 to 2026

In shortThe failures repeat across a decade: deadlines missed, affidavits demanded, denials without an investigation, adverse credit reports on disputed amounts, disputes lost between a bank and its card partner, and chargebacks used in place of an investigation. Civil penalties since 2023 range from $9 million to $55 million, and one 2025 order added at least $75 million of redress. The quieter cost is the forfeiture and damages a single cardholder can claim.

Company names are left out; each case links to its public record.

What one mishandled dispute can cost

Where software helps a dispute desk, where an analyst must sign, and what the 2026 model guidance covers

In shortSoftware can read every channel, split a complaint into charges, name the rule, count the days on the bank's calendar, gather the card reads, device data, merchant answers and delivery records, and draft the letter and the chargeback. The decision, the denial and the signature stay with people. No regulator has approved or barred AI in dispute handling; the CFPB has warned that scripted systems miss disputes, and the 2026 model guidance leaves generative AI to each bank's own controls.

What supervisors have said about automated dispute handling

For a bank that means a deadline calculator falls outside the model definition, a statistical first-party fraud score probably falls inside it, and a drafting tool built on a language model sits under the bank's own AI policy. The CFPB's 2025 card market report notes AI already "being used in connection with streamlining credit card dispute resolution procedures", and Visa launched AI tools for issuers in 2026 that summarize merchants' documents.24,29 None of that changes who answers to the cardholder.

Four tests that show a dispute tool works

Test four things on past claims whose outcomes you know. Recognition: of complaints a reviewer counted as disputes, how many the tool also caught, separately for those that never use the word. Clock accuracy: due dates on a sample that spans holidays and statement dates. Evidence: whether the records the tool attached are the ones your analysts used. Decisions: where the tool's recommendation differs from the final decision, and why. Fifty claims prove little; several hundred across reasons and both card types begin to.

Inside a card dispute desk: who takes the call, who investigates, who files the chargeback

In shortCustomer service takes the call, a dispute analyst classifies and investigates, a fraud investigator handles unauthorized use, a chargeback specialist works the network, and a dispute operations manager watches the queue and answers the examiners. Most of an analyst's time goes to gathering records from separate systems before anyone decides.

From the service rep to the chargeback specialist: five dispute roles

Four hands and two tracks for one disputed charge

Pulling records and reading merchant answers fill a claim's hours

Fifty elapsed hours is mostly waiting between systems and people, which is why a ten-business-day debit deadline is tight and a two-cycle credit deadline slips. The work repeats: the same authorization screens and merchant portals for every claim.

Three ways issuers staff it

Rachel Dunmore's claim on screen: three charges, four deadlines and two signatures before the debit card's day 10

In shortThis is the example from the top of the page, inside the product. Six agents read her call note and app form, split them into three charges under two laws, keep four deadlines, gather 41 pieces of evidence and draft the decision, the letter and the chargebacks. Alicia Moreno, the senior dispute analyst, decides and signs; Marcus Belcourt, a fraud claims investigator, co-signs because the denial is above $1,000.

1

The claim drawn as a timeline against its deadlines

Tuesday, October 13 at 8:40 a.m., the morning after Columbus Day. Alicia's home screen shows Rachel Dunmore's claim as three lanes, one per charge, from the purchase to the deadline it must meet. Weekends are shaded, Columbus Day is hatched as a day that does not count, and business days 1 to 10 run along the top for the debit card.

The records hang from the step they support: the two card reads under "Authorizations pulled", the device, earlier purchases and boarding record under the travel seller's answer, the carrier record under the furniture store's "delivered Aug 28". The later deadlines sit in a rail on the right: Sunday, November 8 for the network, Friday, December 18 for the credit card, Monday, December 28 for the debit card's final answer.

2

Four deadlines on one claim, and the investigation in 85 seconds

The case page lists every deadline the claim carries: the debit card's day 10, met by the provisional credit; the Regulation Z acknowledgment, sent Thursday, October 1 against an October 30 deadline; the credit card resolution by December 18, with the 90-day cap of December 29 shown beside it; and the reply to the travel seller's network response by November 8.

Alicia starts the investigation. Six steps run in 1 minute 25 seconds in the sample data, each with what it found: the call note and app form read into three charges, four deadlines checked, three authorizations and 90 days of activity pulled, two merchant replies read, five first-party signals weighed, and a recommendation drafted. Three steps are marked amber where the records point to fraud, a merchant's proof that fails, or the cardholder's own purchase.

3

Reno: two card reads fifteen minutes and 1,950 miles apart

The authorization record for the Reno charge shows entry mode 90, a magnetic-stripe read, signature and no PIN. Fifteen minutes earlier the real chip card was read with a PIN at a corner market in Columbus for $38.62, and the call note records that the card "has been in her wallet the whole time". A copy of the card's stripe was used in Reno.

The recommendation is to make the provisional credit final: an error under Regulation E, found inside the 10 business days. The product also proposes a Visa 10.1 counterfeit-fraud chargeback.

4

The airline ticket: her phone, her internet connection, her boarding pass

The travel seller answered the chargeback on October 9 with Compelling Evidence 3.0: two earlier purchases on the same card, on January 6 and March 14, 2026, 246 and 179 days before the disputed one, from the same iPhone and home IP address she uses for her banking app, neither disputed. The travel record shows Rachel Dunmore checked in from that phone and boarded the flight from Columbus on Saturday, October 3, four days after she disputed it.

The bank's own records agree: the same device, 412 sign-ins since June 2023, a sign-in 18 minutes before the purchase. A checklist on the screen confirms the conditions for a denial: the investigation rests on the evidence, no affidavit or police report was asked for, she can ask for the documents, and no late reporting for 10 days.

5

The bookcase: delivered, to someone else

The furniture store replied on October 6 that order FH-882104, a five-shelf walnut bookcase, was "delivered Aug 28" with a tracking number. The carrier's record for that number ends at a front desk in Tacoma, Washington, ZIP 98402. Her order shipped to Columbus, Ohio 43215.

Regulation Z counts delivery to the wrong place as goods "not delivered as agreed", and the commentary lets the issuer deny non-delivery only if the goods were actually delivered as agreed.4 The recommendation is to credit $389.40 and file a 13.1 chargeback with the tracking mismatch.

6

Signed, co-signed and closed

The decision page sums it up: $1,002.15 credited as final, $1,284.00 denied with a written explanation, and two chargebacks to recover the $1,002.15. Alicia reviews each line, asks for the letter in plain language, and signs at 8:47 a.m.; the denial is above $1,000, so Marcus Belcourt co-signs. The credit posts, the letter goes to her app inbox and by mail, and the chargebacks are filed.

The letter tells Rachel what happened to each charge and why: a copy of her debit card used in Reno, a parcel delivered in Tacoma, and a ticket bought from her own phone and internet connection on a flight she boarded.

In the sample data the investigation took 1 minute 25 seconds, and the desk's median time from notice to evidence gathered fell from 46 hours in April to 12 minutes in September. The solution's design target is no missed Regulation E or Regulation Z deadline; it is a target, to be measured on your own claims.

The rest of the desk on screen: the provisional credit replay, first-party signals, the deadline monitor, chargebacks and settings

In shortOne claim is the story. These screens show the rest of the desk: how the provisional credit posted itself under a standing rule, the first-party signals with their sources, every running deadline by business day, the queue, the chargeback desk, the report for the operations manager and the settings that hold the bank's rules.

Select any screen to open it larger. The bank, cardholders, merchants, people and figures are fictional; network names appear only with their published reason codes.

What each of the six agents does, and why the analyst's signature closes every claim

In shortEach agent has one job and limits it does not cross. None of them sends a letter, files a chargeback, moves a deadline or contacts a customer. The only money they post is Regulation E provisional credit under the bank's standing rule, which a person makes final or reverses. The analyst signs every decision; a fraud claims investigator co-signs fraud denials above $1,000.

Notice reader to resolution drafter: six agents on every claim

The dispute analyst signs; fraud denials above $1,000 need a co-signer

Agent steps and human decisions are kept apart on the audit trail, and every change to a setting is versioned.

Alicia Moreno's dispute team, from chargebacks to customer service

What the dispute desk feeds in, and the signed decisions, letters and chargebacks it gets back

In shortIt reads the notices you already receive and the card, account and network systems you already run, and leaves behind each charge on its legal and network deadlines, the evidence attached to the step it proves, a recommendation, a signed decision, a letter, chargeback packages and a report of deadlines and first-party trends. Your systems of record stay where they are.

Authorization, processor, core and network portals the desk reads

For each, check whether it has an API, a file feed or only screens, and who owns it, including any held by your card processor.

Your processor, network portals and letter templates stay put

Analyst hours, unrecovered credits and forfeitures: where a dispute desk loses money

In shortMost of the cost of a dispute operation is people's time spent gathering records, plus the money you credit and never recover, plus what a missed deadline forfeits. No regulator publishes these for a bank, so the numbers that matter are yours. Three published figures frame them.

Analyst hours, unrecovered credits and missed deadlines: what to count

A credit you cannot reverse, a denial that becomes a finding

The return on gathering dispute evidence automatically: time released and chargebacks recovered

In shortPut in your own numbers. The calculator starts from a published wage and the CFPB's average credit, and asks for the rest: claims a year, hours of work each takes now and after, the share you charge back, how much more often you might win with the merchant's evidence read first, and what the tool and your testing cost a year.

Six gains from gathered evidence and kept clocks

Analyst hours and extra chargebacks won on your yearly claims

With the defaults (24,000 claims, 1.5 hours down to 0.5, half charged back, 5 more points won, $250,000 a year) the calculator shows $1,344,000 of time released, $118,200 of extra recoveries and $1,212,200 after cost. Try 3,000 claims and 1 hour down to 0.5: the result is about −$151,200, which is the honest answer for a small card program whose processor already does most of the work.

Score your dispute desk's readiness: eight scored questions and one to reflect on

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

What a dispute desk at each score should test first

What to ask a dispute management software vendor about recognition, card-rule clocks, evidence and signatures

In shortAsk every vendor the same questions, us included. The answers show whether the tool recognizes disputes however they are worded, counts days the way each rule does, gathers your evidence or only tracks dates, keeps a score from deciding, cites what it found, keeps your people signing, and can be measured on your own claims.

We found no published independent test of any dispute vendor's recognition rate, deadline accuracy or chargeback win rate, as of October 2026. A blind test on your own closed claims is the fairest comparison, and it measures your current desk as well.

Ten weeks from baseline to decision: a pilot that starts on card claims you have already closed

In shortMeasure your desk, test the tool on past claims whose outcomes you know, then run it beside your analysts on live claims, and decide with four numbers. None of these steps commits you to a vendor.

1. Time ten claims by step, from notice to signed decision. That is your baseline.
2. Pull 400 closed claims with known outcomes: debit and credit, fraud, not received, recurring, duplicates, and some that span holidays and statement dates.
3. Test blind: the tool classifies, counts deadlines, gathers and recommends; your analysts compare.
4. Run in parallel on live claims for four weeks, with your people deciding and signing every one.
5. Decide with four numbers: deadline accuracy, evidence matched, decisions matched, analyst hours.

Dispute recognition, deadline accuracy and matched decisions

Credit card billing disputes and chargebacks: the questions people ask most

In shortThe questions cardholders, dispute teams and compliance officers search for most, each answered on its own.