C28: Cancelled Recurring Billing

C28 is a code that catches merchants off guard more than it should, largely because recurring billing feels routine - until it isn’t. Subscription-based businesses in particular can find themselves accumulating C28 chargebacks without a clear picture of where their cancellation process is breaking down or what documentation they actually need to fight back.

I’ll break down everything you’ll need to know about C28: what triggers it, what American Express expects from merchants with these recurring billing disputes, how to build a strong representment case if you believe the dispute is invalid - and most importantly - what you can do to avoid these chargebacks from landing.

What Actually Triggers a C28 Chargeback

A C28 chargeback happens when a cardholder cancels a recurring billing agreement and then gets charged anyway. The cardholder contacts their bank to dispute the charge and the bank sides with them, pulling the funds back from the merchant.

The most simple case is a cancelled subscription that keeps billing. A customer clicks “cancel,” gets a confirmation email, and then sees another charge hit their account the following month. From the cardholder’s perspective, the agreement was over and the charge has no business being there.

But it doesn’t always play out that cleanly. Sometimes a cancellation request gets lost in a support queue and no one processes it in time. Sometimes a merchant’s billing system runs on a cycle that’s already locked in before the cancellation registers. These are genuine process gaps rather than bad intentions, but the end result is the same: an unauthorized charge and a frustrated customer.

There are also cases where the cancellation process itself creates the problem. If a merchant makes it difficult to cancel - multiple steps, vague confirmation, or no acknowledgment at all - cardholders may walk away thinking they’ve cancelled when technically they haven’t. When the next charge lands, they dispute it; it’s a basic response to a confusing process.

The legal foundation here is the Fair Credit Billing Act of 1974, which gives cardholders the right to dispute charges they believe are unauthorized or incorrect. Recurring billing charges after a cancellation fall squarely into that category. Card networks built the C28 reason code to address this right in a structured way.

It’s worth thinking about from a merchant side: how does a cancellation actually move through your system? Is there a confirmation sent to the customer? Is there a delay between when a cancellation is requested and when it stops the billing? If a customer cancelled and your billing runs tomorrow, does that timing get handled cleanly?

These are the exact gaps that turn a scheduled cancellation into a chargeback. The cardholder doesn’t need to prove bad faith on the merchant’s part - they just need to show the charge came after a cancellation they made.

The Laws Shaping How Cancellations Have to Work

Two pieces of regulation sit at the center of how merchants have to manage subscription cancellations in the US. The first is the Restore Online Shoppers’ Confidence Act, known as ROSCA. The second is the FTC’s “Click to Cancel” rule, which was adopted in 2024 and really tightened what businesses are allowed when a customer wants out.

ROSCA has been around since 2010 and it sets a baseline. Merchants have to disclose the terms of a recurring charge before it happens, get the customer’s explicit consent, and give them a simple way to cancel. That last part is where businesses fall short.

The “Click to Cancel” rule goes further - it says the cancellation process has to be at least as easy as the sign-up process. So if a customer joined online in two clicks, they have to be able to cancel online in two clicks. You can’t hide the cancellation option behind a phone call, a waiting period, or a multi-step retention flow that’s designed to wear them down.

This matters for chargebacks specifically because if a customer files a dispute and your cancellation process was legitimately difficult to get through, you are already behind before you even submit your response. Card networks and the FTC view a tough cancellation flow as a sign that the charge was not authorized. That’s a hard position to argue against. If you’re wondering what happens if you never reply to a credit card dispute, the short answer is you forfeit any chance of winning.

Some merchants believe that a long cancellation process is a basic retention tactic, but it works against you in a dispute because it gives the customer a credible reason to say they had no option other than to call their bank. A customer filing a chargeback after a partial refund is a common example of how these situations escalate when the exit path felt blocked.

The helpful takeaway from these laws is easy to state, even if it takes effort to put in place. Your cancellation path should be visible, self-serve, and fast. A customer should be able to find it and complete it without talking to anyone - that’s not just good practice, it’s what the law now expects.

Merchants who built their subscription flows before 2024 may need to revisit those designs. Regulators have made it clear that friction in the cancellation path is not a grey area anymore.

Your Timeline for Fighting a C28 Dispute

When Amex notifies you of a C28 chargeback, the clock starts instantly. You technically have 20 days to respond, but in practice a lot of merchants find the usable window is closer to five days to account for processing delays and internal review time.

Missing that window means Amex closes the case without your side of the story. The dispute is decided solely on what the cardholder submitted, and your chargeback ratio takes the hit regardless.

The full timeline usually breaks down like this:

The Amex review period is largely out of your hands, so the only stage you control is the response window; it’s where merchants win or lose a C28 case.

Once the notification lands, pull together your cancellation records and any communication logs between you and the customer. You want to show the exact date the cancellation was processed and what confirmation the customer received.

Your subscription terms matter here as well. If the billing schedule, cancellation policy, and any trial-to-paid conversion facts were presented to the customer at sign-up, that documentation belongs in your response. Amex wants to see that the customer had access to that information before they agreed to the subscription.

The helpful advice is simple: treat day one like it’s day fifteen. Gather everything you need before writing the response so you are submitting a complete evidence package instead of adding documents at the last minute.

Evidence That Can Actually Win a C28 Chargeback

The documents you submit either make your case or quietly undermine it. An Amex reviewer isn’t looking for a wall of records - they want a short, logical chain of proof that shows the cardholder agreed to recurring billing. That you honored that agreement.

The most helpful piece of evidence is a signed or online-accepted agreement that outlines the recurring billing terms - that means the cardholder’s name, the billing frequency, the charge amount, and any cancellation policy all need to be visible in that document. A generic terms-of-service checkbox with no mention of recurring charges is not going to carry much weight.

Cancellation request logs matter a great deal in C28 disputes because the core claim is usually that a cancellation was ignored. If a cardholder contacted you to cancel and you have a timestamped record of that interaction - along with what action was taken - that context can change how a dispute reads. No log at all is a problem, but an incomplete one can be worse because it seems like something happened that wasn’t recorded.

Email confirmations are worth keeping for sign-up and cancellation events. A confirmation sent to the cardholder at the time of enrollment is strong evidence that they received and acknowledged the billing terms. If you sent a cancellation confirmation too, include it - it shows the process worked as intended. Merchants dealing with recurring transactions that weren’t cancelled often find that this single document changes the outcome.

A 20-page document dump with screenshots, login histories, and service usage stats is harder to review than three focused documents that directly address the dispute. Relevance is what matters - not volume.

Merchants who win these disputes have structured records in place before a chargeback arrives because that’s how they run their billing operations. Audit trails, stored consent records, and confirmation emails are the habits that pay off long before a dispute is filed. Network tokenization for recurring charges is one example of how infrastructure decisions made early can support both security and documentation.

If your documentation has gaps - missing consent records, no cancellation log, billing terms buried in fine print - those gaps speak loudly to a reviewer. The strength of your evidence is usually decided well before the dispute window opens. Merchants with repeated documentation failures risk being flagged as an excessive chargeback merchant, which carries consequences well beyond any single dispute.

How to Make C28 a Rare Occurrence Instead of a Recurring Problem

The bigger opportunity is on the prevention side. Simple operational changes - a frictionless cancellation flow, an immediate confirmation email, a reminder before each billing cycle - remove most of the frustration that turns a cancellation request into a dispute. Merchants who treat these touchpoints as customer service moments, instead of leakage to cut back on, see fewer chargebacks and stronger long-term retention. A subscriber who cancels cleanly and feels respected is far more likely to come back than one who had to fight their way out.

C28 is manageable. With the right processes in place and a proactive mindset, it stops being a recurring fire and can become a scheduled part of running a subscription business responsibly. How your credit card descriptor appears to customers is one small detail that, when overlooked, can turn a forgotten charge into a dispute - so it’s worth reviewing alongside your cancellation flow. And if you’re wondering whether excessive chargebacks could put your Shopify account at risk, keeping C28 under control is a direct part of that answer.