Chargeback
PCIComplianceHubLast updated
A forced reversal of a card transaction, initiated by the issuer on the cardholder behalf, typically because the transaction is disputed as fraudulent, unauthorized or not as described. Chargebacks carry fees and, above brand thresholds, can put a merchant into a monitoring program or cost it card acceptance. Sustained chargeback volume is often the first outward sign of a card data compromise, which is why chargeback trends are watched as a fraud indicator rather than purely as a finance matter.
Applies to. PCI DSS v4.0.1 names chargebacks once, in Requirement 12.5.2, as one of the payment stages whose data flows the entity must identify when it confirms its scope, alongside authorisation, capture, settlement and refunds. That is the standard's only interest: dispute handling often pulls account data into systems nobody treated as payment systems, such as a finance mailbox that receives dispute notices carrying card details or a CRM note where staff paste a card number, and 12.5.2 asks for those flows to be found, diagrammed and either brought into the CDE or cut off. The dispute process itself, and any monitoring programme a brand runs on chargeback rates, belongs to acquirer and payment brand rules.
Limits. Requirement 12.5.2 asks only that the chargeback data flow be identified and diagrammed in the scope review; PCI DSS sets no rules on how disputes are handled, what ratio triggers brand monitoring, or the fees involved.
In PCI DSS v4.0.1. 12.5.2
Sources. PCI DSS v4.0.1 (June 2024)