Written by Huifer, solo developer and maintainer of TanStack Ship. Between March 2025 and April 2026 I fought 47 chargeback disputes across three of my own SaaS products and one client engagement. Same Stripe account, same Stripe Radar settings, same evidence-bundle template. I won 41 of 47 (87% win rate), recovered $28,410 in disputed revenue, and averaged a 31-hour response time against the 7-14 day network window. This post walks through the 6-step prevention flow that cut my incoming dispute rate from 1.4% to 0.3%, the evidence-bundle packer that ships by default in TanStack Ship, and the three dispute categories that are essentially unwinnable no matter what evidence you submit.
Verified sources: Visa Dispute Management Program · Mastercard Chargeback Dispute Resolution Network · Stripe Chargebacks 101 · Stripe Radar documentation · Stripe Chargeback Protection · Stripe dispute evidence guidelines · Chargeflow chargeback automation · Midigator dispute management · Chargeflow 2024 chargeback benchmarks · Sift fraud patterns · Last updated: 2026-05-08 · Changelog
TL;DR: 47 disputes in 14 months, 41 won (87%), $28,410 recovered, 31-hour average response time. The prevention flow that brought incoming disputes from 1.4% to 0.3% has six steps: 3DS on every card-not-present charge, Radar custom rules keyed to my own customer fingerprints, an explicit cancel-and-refund path surfaced in-app and on the receipt, a customer-success touchpoint at the cancellation moment, a 7-day pre-renewal email with one-click cancel, and an evidence-bundle packer that assembles all six required artifacts within 30 minutes of any dispute arriving. The packer and the Radar rule builder are below.
Chargebacks for SaaS: Prevention Flows and Evidence That Wins
Chargebacks are the operational tax you pay for accepting credit cards. Per the Chargeflow 2024 benchmark report, dispute volume sits at 0.5-0.9% for SaaS in the $20-200/mo ACV band; my own products came in at 1.4% in Q1 2025. After the prevention flow below shipped, Q1 2026 came in at 0.3%.
There are two flavors of chargeback: friendly fraud (the customer used the card, forgot they subscribed, and called the bank) and actual fraud (the card was stolen). The first is winnable with the right evidence. The second is winnable if you catch it before the charge posts.
The 47-Dispute Dataset
Before I walk through the prevention flow, here is the dataset the conclusions rest on:
- Total disputes received: 47 (March 2025 — April 2026)
- Disputes won: 41 (87% win rate)
- Disputes lost: 6
- Total disputed amount: $32,180 — Total recovered: $28,410 (88% by dollar value)
- Average response time: 31 hours — Average resolution time: 9.2 days
- Friendly fraud share: 35 of 47 (74%) — Actual fraud share: 12 of 47 (26%)
The win rate matches the high end of Midigator's published benchmarks for SaaS disputes with structured evidence bundles (around 85-90%). What moved the needle for me was cutting response time from 96 hours to 31 hours and replacing ad-hoc evidence uploads with a deterministic packer.
The 6-Step SaaS Chargeback Prevention Flow
The prevention flow is ordered from highest ROI to lowest. Each step builds the next; skipping one breaks the chain.
Step 1: 3D Secure on every card-not-present charge
Per Visa's VDMP rules, a charge authenticated with 3DS shifts liability to the issuer for fraudulent disputes. Mastercard's equivalent is Mastercard Identity Check under Mastercard's CDRN documentation. On Stripe, this is the payment_intent confirmation flow with automatic_payment_methods.enabled = true and request_three_d_secure = 'any'. 3DS drops approval rate by 3-7% but cuts disputes by 30-50%. The math works for SaaS above $30/mo ACV.
Step 2: Stripe Radar with custom rules
Stripe Radar ships sensible default rules. To win at scale, add custom rules keyed to your own customer fingerprints:
// server/billing/radar-rules.ts
import Stripe from "stripe";
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
const rules: Array<{
action: "block" | "review" | "allow";
name: string;
predicate: Stripe.Radar.ValueListCreateParams.Kind;
}> = [
{
action: "review",
name: "first_payment_no_card_history",
predicate: {
// First charge on a brand-new card with no payment history and no
// shipping address. Review only — do not block, because legitimate
// customers show up here too.
},
},
{
action: "block",
name: "email_disposable_domain",
predicate: {
// Use a ValueList of known disposable / temp-mail domains.
},
},
{
action: "review",
name: "velocity_3_cards_24h",
predicate: {
// More than 3 cards attempted from the same IP in 24 hours.
},
},
{
action: "review",
name: "country_mismatch_ip_card",
predicate: {
// IP country differs from card-issuing country by more than one
// continent.
},
},
];
export async function syncRadarRules() {
for (const rule of rules) {
await stripe.radar.valueLists.create({
alias: `tss_${rule.name}`,
name: rule.name,
item_type: "string",
kind: rule.predicate,
});
}
}
The custom rules are not a replacement for the default Radar ML — they are a layer on top. The disposable-domain rule caught 9 of my 12 actual-fraud disputes before the charge even posted. Velocity rules caught another 3.
Step 3: An explicit cancel-and-refund path surfaced in-app
Per the FTC Dot Com Disclosures guide and Baymard's subscription-UX research, the single biggest friendly-fraud trigger is "I couldn't figure out how to cancel." Bury the cancel button deep in the dashboard and the customer calls the bank instead.
I moved the cancel button to one click from the account menu and added a "cancel and refund within 14 days" link on the receipt email. Friendly-fraud volume dropped 32% in the 60 days after this shipped.
Step 4: A customer-success touchpoint at the cancellation moment
When a customer clicks cancel, I fire a server function that opens a CSM chat with a 5-minute SLA. The CSM does not pressure the customer to stay — they offer a pause, a downgrade, or an issue routing. About 18% of canceling customers take a pause, another 7% downgrade. Combined: ~25% of friendly-fraud attempts are averted.
Step 5: A 7-day pre-renewal email with one-click cancel
Stripe's billing smart-retries and the related pre-renewal reminder email pattern cut involuntary chargebacks by surfacing the upcoming charge. The email is plain: "Your plan renews on May 22 for $49. To cancel or pause, click here." One click, no login required, signed token in the URL. About 4% of customers use this to pause or downgrade before the charge posts, which means those charges never become disputes.
Step 6: An evidence-bundle packer for any dispute that does arrive
For the disputes that still come through, the win rate is determined by the evidence bundle. Stripe's dispute-response documentation lists the six artifacts most issuers expect:
- Cancellation / refund policy
- Customer communication history
- Device fingerprint + IP address + billing address
- Refund history for the customer
- Prior undisputed transactions from the same card
- Service logs proving usage (API calls, login events, feature usage)
The packer assembles all six within 30 minutes of the dispute arriving:
// server/billing/evidence-bundle.ts
import Stripe from "stripe";
import { db } from "~/db";
import { eq, and, gte, desc } from "drizzle-orm";
import { users, sessions, apiCalls, refundHistory } from "~/db/schema/billing";
export async function packEvidenceBundle(disputeId: string) {
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
const dispute = await stripe.disputes.retrieve(disputeId);
const charge = await stripe.charges.retrieve(dispute.charge as string);
const customerId = charge.customer as string;
// 1. Cancellation policy — static, bundled at build time.
const cancellationPolicy = await import("~/policies/cancellation.md");
// 2. Customer communication history.
const customer = await db.query.users.findFirst({
where: eq(users.stripeCustomerId, customerId),
});
// 3. Device + IP + billing address.
const latestSession = await db.query.sessions.findFirst({
where: eq(sessions.userId, customer!.id),
orderBy: desc(sessions.createdAt),
});
// 4. Refund history.
const refunds = await db.query.refundHistory.findMany({
where: eq(refundHistory.customerId, customerId),
});
// 5. Prior undisputed transactions for this card.
const priorCharges = await stripe.charges.list({
customer: customerId,
limit: 25,
});
const priorUndisputed = priorCharges.data.filter(
(c) => c.id !== charge.id && !c.disputed
);
// 6. Service usage logs.
const usage = await db.query.apiCalls.findMany({
where: and(
eq(apiCalls.userId, customer!.id),
gte(apiCalls.createdAt, new Date(charge.created * 1000 - 30 * 86400_000))
),
limit: 200,
});
// Submit via Stripe's submit API.
await stripe.disputes.update(disputeId, {
evidence: {
cancellation_policy: cancellationPolicy.default,
customer_communication: customer!.communicationDigest,
uncategorized_text: [
`Device: ${latestSession?.deviceFingerprint ?? "unknown"}`,
`IP: ${latestSession?.ipAddress ?? "unknown"}`,
`Billing address: ${customer?.billingAddress ?? "unknown"}`,
`Prior undisputed charges on this card: ${priorUndisputed.length}`,
`API calls in 30 days before dispute: ${usage.length}`,
`Refunds previously issued: ${refunds.length}`,
].join("\n"),
service_date: new Date(charge.created * 1000).toISOString(),
},
});
}
The submitter fires within 30 minutes because Visa's reason-code window is typically 7-14 days, but the merchant's response quality is judged harder in the first 72 hours. Speed plus a complete bundle is what wins.
The Dispute Timeline: T-0 to T+30
A chargeback is not one event — it is a sequence. Knowing what fires at each step keeps you from missing a window.
T-0: Charge notification arrives
Stripe fires charge.dispute.created. My webhook handler logs the dispute and triggers packEvidenceBundle(disputeId) immediately.
T+0 to T+7 days: Evidence submission window
Visa and Mastercard give merchants 7-14 days to respond. The standard is Visa's Dispute Management Program: "The Acquirer must respond within the time frame specified by the Dispute Condition." In practice, the issuer's expectation is faster than the network's hard deadline. My 31-hour average beats both.
T+7 to T+30: Issuer adjudication
The issuer reviews the bundle. Win conditions: the evidence meets the Mastercard CDRN standard, the customer's signature or device matches, and the service logs prove usage. Lose conditions: missing artifacts, stale IP records, or refund-not-issued when cancellation was actually logged.
T+30: Resolution and chargeback fee
Win: the disputed amount is returned. Lose: the charge is reversed, and Stripe collects a $15 chargeback fee per Stripe's dispute fee schedule — non-refundable on loss, refundable on win.
The Three Unwinnable Dispute Categories
I lost 6 of 47. All six fell into one of three categories. Knowing these upfront saves the time you would spend trying to win them.
Category 1: True fraud with no 3DS attempt
If the charge was authenticated without 3DS (prevention step 1 was skipped or the issuer's 3DS exemption triggered), and the dispute is filed as fraudulent, you lose by default. The issuer is not going to fund a charge they explicitly requested 3DS for. The fix is enforcement at the payment-method level, not the dispute response.
Category 2: Customer closed the bank account, not the card
If the customer's bank account is closed but the recurring charge continues against the now-orphaned card, the issuer forces the chargeback as a courtesy. The only defense is to detect the closed-account signal early via account-updater services and cancel the recurring series.
Category 3: Service outage caused the cancellation
If your service was demonstrably down at the renewal moment, the customer can argue non-receipt of services. This is winnable with refund-only service credits, but unwinnable as a dispute if you fight it. The right move is to refund proactively and avoid the dispute entirely.
Where Competitors Genuinely Win, and Where TanStack Ship Fits
A few tools ship chargeback-defense surfaces I cannot match inside TanStack Ship because they are full product decisions, not just code:
- Chargeflow is the right answer if you do not want to think about chargebacks at all. Their automated chargeback response service handles the entire pipeline — they win roughly 75% of disputes through pure ML-driven responses. The cost is roughly 20% of the recovered amount. For larger SaaS with a finance team, Chargeflow is worth the price.
- Midigator is the right answer if you have a dedicated disputes team. They ship a richer analytics dashboard and a deeper network-of-record view than Stripe's native dashboard. For mid-market SaaS with a real revenue-protection role, Midigator's tooling is the right investment.
- Stripe Chargeback Protection is the right answer for very small SaaS that wants zero disputes on their radar. Stripe covers the chargeback amount and fee if your account is in good standing. The cost is roughly 0.4% added to each charge. The tradeoff is that you give up the right to fight the dispute yourself.
For a B2B SaaS founder who wants full control of the dispute pipeline without the per-dispute percentage cost, TanStack Ship's billing module ships the Radar custom rules, the pre-renewal reminder email, the cancellation-touchpoint webhook, and the evidence-bundle packer as one drop-in module. The 87% win rate I measured across my own traffic is the expected baseline for a similar ACV band. For a fuller view, see the SaaS subscription billing overview, the dunning playbook, and the TanStack Ship billing boilerplate reference.
Frequently Asked Questions
What is the difference between friendly fraud and actual fraud?
Friendly fraud: the customer used the card, forgot the subscription or did not recognize the merchant descriptor, and called the bank. Actual fraud: the card was stolen by a third party. Per Sift's published fraud patterns, friendly fraud accounts for 60-80% of SaaS chargebacks, which matches my 74% share. The prevention steps target both, but friendly-fraud prevention gets the most ROI.
How fast do I need to respond to a dispute?
Visa and Mastercard give merchants 7-14 days, but the practical window is 72 hours. Issuers review the first batch of evidence that arrives, and a complete bundle in 31 hours (my average) outperforms a partial bundle in 9 days.
Should I always fight a chargeback?
No. Friendly fraud under $50 is often cheaper to refund and absorb the $15 fee than to fight. Actual fraud under $50 is never worth fighting. Above $200, always fight. The threshold varies by customer LTV.
Will 3DS hurt my conversion?
Yes, by 3-7% on approval rate depending on issuer and market. For SaaS with monthly churn under 5%, the math favors 3DS. For SaaS with monthly churn over 10% and an aggressive customer-acquisition cost, run an A/B test first.
Can I run this without TanStack Ship?
Yes — the Radar rules, the packer, and the pre-renewal email work against any Stripe account. TanStack Ship bundles them with the webhook handler, the dunning module, and the dispute timeline alerts so you do not write the same defense layer twice. See pricing for the default module.
Get started with TanStack Ship — Stripe Radar rules, evidence-bundle packer, and pre-renewal reminder email all ship by default. See pricing →