How Banks Conduct Transaction Fraud Investigations (2024)

The process banks use to evaluate and investigate claims of fraud can be obtuse and frustrating, both for cardholders and for merchants. For cardholders who've fallen victim to credit card fraud, it can seem like the bank is taking forever to actually close the investigation, even when the fraud seems completely obvious. For merchants, the number of highly dubious fraud claims that result in chargebacks can make them wonder if the bank actually investigates claims of fraud at all.

Some of the basic rules for investigating fraud are established by the major card networks, but individual banks have a lot of leeway when it comes to actually carrying out the process. Fortunately, banks have their own incentives to fight fraud, and there are some standard procedures for them to follow. When banks receive claims of credit card fraud, what do they actually do to investigate them?

1. What Are the Different Types of Fraud?
2. What Happens When a Bank Gets a Fraud Claim?
3. How Do Banks Investigate Fraud?
4. How Do Fraud Victims Get Their Money Back?
5. Why Do Merchants Bear the Costs of Fraud?
6. How Long Does a Bank Fraud Investigation Take?
7. Do Banks Press Charges for Fraud?
8. Do Banks Really Investigate Disputes?

Banks, customers, and merchants don’t always speak the same language when fraud is the subject of discussion. For customers, fraud can be a catch-all term that refers to a wide range of complaints or issues they may have with transactions, many of which might not fall under the legal definition of fraud. In the realm of merchant chargebacks, we talk about “true fraud” and “friendly fraud,” two very different things that aren’t as closely related as their names might suggest.

Untangling the many varieties of fraud can get complicated, especially when merchants are trying to make sense of their chargeback data for analytical purposes. It can be helpful to know how fraud claims are handled on the bank’s end, what sort of timeline to expect, and what actions they are likely to take.

A dispute is when a cardholder asks their bank for a chargeback on a transaction, claiming that they either didn't authorize the transaction or didn’t get what they paid for. True fraud is the most common reason behind legitimate disputes.

If the customer didn’t get what they paid for, they’re required to contact the merchant before disputing the charge, which will usually result in the merchant providing a refund or some other remedy. When a merchant refuses to provide a refund in accordance with their sales agreement, or violates card network rules when processing a transaction, the customer has a valid claim tofile a dispute.

In cases of true fraud, both a cardholder and the merchant can be considered victims. The cardholder was the one whose information was stolen and used illegally, while the merchant will be the one bearing the cost. In cases of friendly fraud, however, the customer is actually defrauding the merchant.

True fraud can result from simple transactions involving the use of stolen card information, or may involve account takeover attacks that utilize stored payment credentials in the customer’s own account. For now, however, let’s focus on the big picture.

For cardholders who have been victimized by fraudsters, this can feel like a big ask. Oftentimes when a cardholder first notices fraud on their account, they discover that it’s been going on for quite some time.

Small, easily overlooked card testing purchases often accumulate before the fraudster goes for a big payout.These are low dollar amount transactions that let the fraudster know that the card hasn’t been reported stolen yet.

Researching and documenting all of these transactions to satisfy the bank can be a lot of work, but it’s worth the effort—the Fair Credit Billing Act caps cardholder liability for credit card fraud at $50. As long as the fraud claim can be substantiated, the cardholder won’t be held responsible for more than that amount. Many banks even have policies dictating that the customer won't be held liable for any amount at all when fraud occurs.

Debit card fraud is governed by the Electronic Fund Transfer Act, which requires cardholders to notify banks about fraudulent charges within 60 days of the transaction—any later and the bank is not obligated to respond. In addition, cardholder liability for fraud is only limited to $50 if the bank is notified within two days of the transaction. However, most banks give their customers 120 days to dispute a fraudulent charge and have more generous liability policies than the law requires.

Once notified, the bank has 10 business days to investigate the claim and reach a decision. If they find that fraud did indeed occur, they are obligated to refund the cardholder.

If the bank needs more time to investigate, they can take up to 45 days, but they must at least temporarily return the funds to the cardholder’s account by the 10-day deadline. Many banks streamline this process by granting a provisional credit as soon as a dispute is filed.

Ideally, bank investigators should uncover intentional (and unintentional) friendly fraud when it occurs, since they're trained to identify common scenarios such as:

• The customer let a free trial run into the paid billing period
• An in-app purchase was made by an unsupervised child
• The customer forgot about a recurring subscription charge
• Buyer’s remorse

But as every merchant knows, this doesn’t always happen. Friendly fraud chargebacks are a huge problem for merchants, who have to take it upon themselves to provide evidence that refutes these claims.

If they’re confident that fraud has occurred and feel the case is substantial enough to warrant it, the bank may notify law enforcement agencies such as the FBI. Of course, the decision on whether or not to open an investigation is up to the law enforcement agency involved.

When a merchant is hit with a friendly fraud chargeback, things are a little more complicated. This type of fraud is harder to prove, and banks tend to side with the customer when in doubt. Even in the best-case scenario, recovering funds lost to friendly fraud will take some time.

If the merchant can prove to the issuing bank that the transaction is legitimate and the cardholder’s claims are false, they can get their money back. However, this process will generally take at least 30 days, and often longer.

The process for fighting friendly fraud is called chargeback representment. The merchant has to present the transaction to the issuer a second time, along with evidence that refutes the cardholder’s claims.

The evidentiary criteria for each chargeback reason code is determined by the card network, but the issuer is responsible for reviewing it and making a decision. In order to win the dispute, the merchant must provide evidence that the bank finds sufficiently convincing.

While the bank’s decision can be appealed through arbitration, the loser has to pay hundreds of dollars in additional fees. Unless you’re dealing with a high-value transaction and are certain the card network will side with you, it rarely makes sense to carry a dispute that far.

With merchants carrying the ultimate liability for the cost of chargebacks, banks aren’t really incentivized to investigate fraud in great depth or push back too hard against their customers’ claims. This might not be fair, but it highlights how important it is for merchants to take charge of their own defense when it comes to fraud and chargebacks.

Fighting chargebacks is a battle on two fronts. Not only do merchants have to preemptively defend themselves and their customers against true fraud, but they must also fight friendly fraud chargebacks after they’ve been filed by engaging in the representment process and supplying the banks with compelling evidence that proves they were wrong to take their customer’s claims at face value.

FAQ

Thanks for following theChargeback Gurusblog. Feel free to submit topic suggestions, questions or requests for advice to:win@chargebackgurus.com