4837: No Cardholder Authorization

What makes 4837 especially frustrating is that it doesn’t always mean fraud actually occurred. Sometimes these disputes are filed in error. Sometimes there’s a miscommunication between a cardholder and their bank. And sometimes, yes, the transaction was legitimately unauthorized. Knowing which situation you’re in - and how to respond - makes the difference between absorbing the loss and successfully fighting the chargeback.

I’ll break down what triggers a 4837 dispute, what Mastercard’s rules say about merchant liability, and what steps you can take to respond with the strongest possible case. Whether you’re trying to understand a chargeback you just received or building better processes to avoid the next one, you’ll find helpful information ahead.

What Triggers a 4837 Chargeback in the First Place

A 4837 chargeback gets filed when a cardholder says they never authorized a transaction on their account. That sounds simple, but the situations behind that claim can vary quite a bit.

The most common trigger is stolen card data. Someone gets hold of a cardholder’s account details and uses them to make purchases, and the actual cardholder disputes every charge they didn’t make. Account takeovers follow a similar path - a fraudster gains access to an online account and starts spending before the cardholder even notices anything is wrong.

Then there’s friendly fraud, which is a very different animal. The cardholder made the purchase but later claims they didn’t - maybe a forgotten subscription, a family member who used the card without asking, or a deliberate attempt to get money back while they keep the goods. Mastercard doesn’t draw that line for you - it treats the dispute the same way regardless of the actual reason behind it.

One thing worth learning about is that 4837 applies to card-present and card-not-present transactions. A contactless tap at a retail counter and a checkout on a website are both within scope. There’s no transaction type that puts a merchant automatically outside of this danger.

What Mastercard looks for when a claim comes in is evidence that the cardholder or an authorized person approved the transaction. If you don’t have that, the dispute tends to move in the cardholder’s favor. The bank issuing the card is responsible for validating the claim before filing, but that review isn’t always exhaustive.

The actual problem is volume. One disputed transaction is manageable, but unaddressed disputes accumulate in a merchant’s chargeback ratio. Once that ratio crosses Mastercard’s threshold, the consequences go beyond individual chargebacks themselves - and a merchant risks being flagged as an excessive chargeback merchant.

The Timeline Rules Merchants Often Miss

Once a 4837 chargeback lands, the clock is already well into its run. Cardholders have as many as 120 calendar days from the transaction date to file a dispute, which means a chargeback can arrive weeks or months after a sale you’ve long since forgotten about.

On your end, the window is much tighter. You get 45 days to respond once the chargeback hits your account; it’s not 45 business days - it’s 45 calendar days, including weekends and holidays.

Missing that response window closes your case entirely, and the funds go to the cardholder by default regardless of what actually happened during the transaction.

The difference between these two deadlines is worth mentioning. A cardholder has over four months to act, and you have a fraction of that time to build and submit a full response.

This is where merchants lose disputes they’d have won - not because their evidence was weak, but because internal delays, missed notifications, or slow communication with their payment processor ate up the available time.

It’s helpful to set up alerts so chargeback notifications reach the right person instantly instead of sitting in a queue. Your processor’s dashboard should be something you check on a set schedule instead of reactively.

The 45-day window shrinks quickly once you factor in how long it takes to pull transaction records, contact staff, and put together a coherent response. The only way to give yourself actual room to work is to start that process on day one.

What Counts as Valid Evidence When You Fight Back

The evidence you submit needs to line up with the type of transaction being disputed. A card-present sale and a card-not-present sale are judged by different standards, so the same document won’t carry the same weight in both situations.

For in-store transactions, a signed receipt is your strongest asset - it directly links the cardholder to the purchase and gives the reviewer something concrete to point to. AVS matches and CVV confirmations add support, but they don’t replace a signature on their own.

Card-not-present transactions need a very different strategy. Here you want to build a picture of the customer instead of using a single document. Device fingerprinting data, IP address logs, and account login history all help show that the actual cardholder was the one who placed the order.

Delivery confirmation is another piece that reviewers take seriously for online orders. A carrier scan showing the package reached the billing address goes a long way toward countering a “no authorization” claim. If the customer signed for the delivery, that’s even better.

Communication logs can be fairly persuasive. Emails, chat transcripts, or text messages where the customer references the order, asks about shipping, or follows up after purchase show engagement that a fraudster wouldn’t have - that’s the thing that turns a thin rebuttal into a credible one. If the dispute escalates further, understanding what pre-arbitration means will help you know what comes next.

A common mistake is submitting a large stack of loosely related documents without explaining what each one proves. A skeptical reviewer won’t connect the dots for you, so label your evidence and state plainly what it shows. For disputes involving recurring billing charges, make sure you include cancellation policy acknowledgment alongside your other documentation.

When 4837 Chargebacks Stack Up and Mastercard Steps In

Individual chargebacks are manageable, but Mastercard watches the bigger picture too. Once a merchant hits 100 chargebacks in a single month and a chargeback-to-transaction ratio of 1.5% or more, Mastercard places them into its Excessive Chargeback Program (ECP); it’s when the consequences get worse than just lost revenue on individual disputes.

The ECP has two levels, and the higher you go, the worse the penalties get. Fines start to apply, and if the numbers don’t improve, Mastercard can ultimately pull a merchant’s ability to accept its cards; it’s not a theoretical outcome - it’s the designed end point of the program for merchants who don’t bring their numbers down.

There’s also a separate threshold worth learning about at the account level. If a single cardholder account generates 15 or more chargebacks, Mastercard can restrict or block further disputes from that account against the same merchant - this doesn’t mean you’re off the hook for those transactions, but it does limit how much damage one account can do going forward.

The ECP is worth taking seriously because it doesn’t reset quickly. Merchants who enter the program have to show steady improvement over multiple months before Mastercard removes them. During that time, fines accumulate and extra scrutiny applies to every chargeback filed against them - like 4837 disputes.

Keeping your monthly chargeback count well below that 100-dispute line is the sensible goal here. One category of disputes, like 4837, can contribute more than merchants expect to the ratio.

Steps to Cut Down on 4837 Disputes Going Forward

The best place to start is with authentication. 3D Secure 2 (3DS2) is one of the most helpful tools available for card-not-present transactions because it gives you a verifiable record that the cardholder participated in the purchase. That record makes it much harder for a dispute to stick under the 4837 reason code.

Billing descriptors are a small fix that makes a real difference. When a cardholder sees a vague or unfamiliar name on their statement, disputing the charge is usually the path of least resistance for them. Make your descriptor match your brand name as closely as possible and include a customer service phone number if you can.

Fraud screening tools are worth the investment too. Velocity checks, device fingerprinting, and address verification all help catch suspicious orders before they get processed. No tool catches everything, but layering a few of these together cuts back on the number of unauthorized transactions that slip through.

For card-present environments, staff training matters more than merchants expect. Employees need to know how to manage declined cards, flag unusual behavior, and verify ID when a transaction looks off. A transaction that was processed incorrectly in-store is hard to defend later.

It is also worth thinking about this in terms of the program thresholds from the previous section. Staying below Mastercard’s dispute and fraud rate limits can depend on keeping the volume of 4837 chargebacks low over time. Small process improvements add up, and they are far less disruptive than the oversight programs that kick in when thresholds are crossed.

Some of these changes take time, but others - like updating your billing descriptor or tightening your fraud filters - can be done faster. Start with what is easiest to change and work from there. You want to make unauthorized transaction claims less likely and harder to win when they do happen.

Don’t Let One Chargeback Code Cost You More Than It Should

More than that, a spike in 4837 disputes is worth taking seriously as a signal - it might point to gaps in your authentication setup, inconsistencies in how your billing descriptor appears on statements, or patterns in how products or channels attract fraud. Chargebacks are feedback - not just friction - and that change in perspective is how merchants turn a reactive problem into a proactive strategy.

Start with the basics: know your response window, keep your transaction records organized, and make sure your team understands what Mastercard is actually looking for in a strong rebuttal - each dispute you work through builds your instincts and your process. 4837 is manageable - and with the right strategy, it stays that way.