Chargebacks are no longer a cost of doing business you simply absorb. Mastercard and Datos Insights project 286 million chargebacks worldwide in 2026, costing merchants $36.9 billion — rising to $46.1 billion by 2029. In the US alone, every $1 lost to fraud costs merchants $4.61 once fees, lost goods, and staff time are counted, and each dispute burns roughly $128 in operating cost ($82 internal, $46 third-party) before you lose the sale itself.
But averages hide the real story. Your chargeback risk depends heavily on what you sell. This post breaks down the numbers sector by sector, explains why e-commerce is structurally exposed, and shows how to fight back — including a practical walkthrough of writing your own fraud policies in Ambriel's scoring engine, in plain language with no code.
Chargeback rates by sector: the 2026 picture
Industry benchmarks (Swipesum's rate table, via Chargeback.io and ClearlyPayments; blended average per Sift, Q3 2025) show a spread of almost 10x between the safest and riskiest sectors:
| Sector | Avg. chargeback rate | Typical dispute driver |
|---|---|---|
| Education & training | 1.02% | Course quality disputes, intangible delivery |
| Travel & hospitality | 0.89% | Cancellations, services not rendered |
| Health & wellness | 0.83% | Trial-to-paid confusion, results disputes |
| Gaming | 0.74% | Unauthorized use, buyer's remorse |
| Software & SaaS | 0.66% | Forgotten renewals, hard cancellation |
| Media & entertainment | 0.58% | Unauthorized purchases |
| Retail / e-commerce | 0.28–0.52% | Non-delivery, friendly fraud |
| Restaurants | 0.12% | In-person fulfillment, small tickets |
The blended all-industry average sits at 0.26% (Sift, Q3 2025), up from 0.21% a year earlier. Three traits push a sector above the line: recurring billing the customer forgets about, large average tickets worth disputing, and intangible delivery the customer can claim never happened.
Ticket size matters too. Mastercard's 2025 research puts the average chargeback value at $120 in travel, $99 in high-risk categories (gaming, gambling, crypto), $84 in e-commerce retail, $77 in digital goods, and **$69 in subscriptions.
Know your thresholds
Networks don't grade on a curve — the same limits apply whether you sell coffee or courses:
- Good: under 0.4% dispute rate (Stripe's early-stage benchmark).
- Watch out: above 0.75% is the industry's excessive mark.
- Visa VAMP (since April 2026): 1.5% ratio and 1,500 monthly fraud-plus-dispute counts puts you in the program.
- Mastercard ECM: 100–299 monthly chargebacks or 1.5–2.99%; HECM at 300+ or 3% and above.
A merchant sitting at 1.2% can drift into a monitoring program without changing a thing as volumes grow. The single most important planning detail: disputes you deflect with pre-dispute alerts never enter the VAMP numerator. Prevention literally doesn't count against you.
Why e-commerce is structurally exposed
Card-not-present selling stacks every risk factor at once:
- No physical handoff. Nothing proves the customer received the goods the way a restaurant meal does — "item not received" is always one click away.
- First-party misuse dominates. So-called friendly fraud — legitimate cardholders disputing legitimate purchases — now accounts for the majority of disputes. Buyer's remorse, forgotten subscriptions, and family members ordering on shared cards all end up as your chargeback.
- Resale-friendly goods. Electronics, sneakers, and luxury items are instant cash on secondary markets, making them magnets for stolen-card testing.
- Frictionless checkout cuts both ways. Guest checkout and one-click pay convert better — and let fraudsters scale faster.
The result: general retail e-commerce chargeback rates more than tripled from 0.15% in early 2023 to 0.47% in early 2024, and digital goods/subscriptions rose 59% to 0.54% in the same window.
How to actually reduce fraud and chargebacks
There is no single fix, but merchants that get below 0.4% tend to do the same five things:
- Score every order before authorization. A real-time risk score at checkout lets you approve, step up (3-D Secure), hold for review, or block — instead of discovering fraud in next month's chargeback report.
- Deflect disputes before they count. Enroll in pre-dispute alert networks (Ethoca, Verifi RDR / CDRN) and auto-refund low-value alerts. A refunded alert is cheap; a counted dispute pushes you toward VAMP.
- Make yourself recognizable. Match the statement descriptor to the brand the customer bought from, add a support phone number, and send delivery/renewal notifications. Confusion is a top dispute driver.
- Make refunds easier than chargebacks. A visible, one-click refund policy converts would-be disputes into returns. Generous on paper, cheaper in practice.
- Fight the winnable ones with evidence. Merchants that represent with complete evidence (AVS/CVV match, device data, delivery confirmation, login history) win roughly half of represented cases. Log everything at order time — you can't reconstruct it later.
Track your ratio monthly, not just your count. A growing store can cross the 1,500-count VAMP floor on volume alone — set an internal alert at 1.0% so you act months before the network does.
Putting policies to work: Ambriel's scoring engine
Step 1 above — scoring before authorization — is where Ambriel fits. The scoring engine checks every checkout against policies you define in plain language in the Ambriel dashboard. Each policy draws on a built-in signal library: order details, email reputation, device and session fingerprints, IP reputation, phone signals, customer history, card BIN data, and merchant context.
There is no code to write. The visual Rule Builder turns your risk appetite into policies. A policy from the Rule Builder looks like this:
Disposable email domain
AND hidden connection (VPN or proxy)
AND first order over €500
→ Hold for manual review
Other policies your store might run:
- Anonymous network — the session comes through a VPN, proxy, or Tor exit node → add risk.
- Country mismatch — the IP country doesn't match the billing country → add risk.
- Breached email — the address has appeared in multiple known data breaches → add risk. These are often credential-stuffing victims, not the real cardholder.
- Machine-made address — readability analysis flags addresses no human would type (
xqtt7391@...) → add risk. - Bot or private browsing — automated session or private-browsing mode at checkout → add risk.
- First order, high basket — a brand-new customer placing an unusually large first order → add significant risk.
From signals to decisions
In practice, a sector-tuned policy set layers these checks and assigns score weights:
| Policy | What it checks | Effect |
|---|---|---|
| Disposable or fresh-domain email | One-time email address or newly registered domain | +15 score |
| VPN / proxy / Tor session | Hidden or rerouted connection | +20 score |
| IP country ≠ billing country | Order placed from an unexpected country | +20 score |
| Email seen in data breaches | Address exposed in known breaches | +15 score |
| Bot or private-browsing session | Automated or untraceable checkout | +25 score |
| First order, high basket | New customer, unusually large order | +30 score |
Score bands then drive the checkout outcome automatically: approve below your threshold, step up with 3-D Secure in the grey zone, hold for manual review when several signals stack, and block when the combination is unambiguous. Policies are versioned, so you can tune weights and thresholds per sector (fashion vs. electronics behave very differently), test changes safely, and see exactly which policy fired on every decision.
Start with the built-in signal library, run in review-only mode for two weeks to calibrate thresholds against your own traffic, then switch the highest-precision policies to auto-block. Most stores see chargeback movement within the first 90 days.
Helpful Questions & Answers
Under 0.4% of transactions. Above 0.75% is considered excessive by card industry standards, and Visa's VAMP program starts at a 1.5% ratio with 1,500 monthly counts. Benchmark yourself against your own sector — 0.5% is normal-ish in travel but alarming in retail.
Travel (0.89%), health and wellness (0.83%), gaming (0.74%), and SaaS/subscriptions (0.54–0.66%) sit well above the 0.26% all-industry average, driven by intangible delivery, recurring billing, and large tickets. Online education is the outlier at around 1–4.8% depending on the dataset.
Visa counts fraud reports plus disputes in the VAMP numerator — but disputes resolved through pre-dispute tools like Verifi RDR or Ethoca alerts never enter it. Auto-refunding low-value alerts keeps your ratio down while costing less than a fought dispute.
You write policies in plain language in the Ambriel dashboard — for example, "disposable email plus hidden connection means hold for review." Every order is checked against your policies in real time at checkout, and the resulting score decides automatically whether to approve, ask for extra verification, hold for review, or block. No code, no integration changes.
Yes. Every policy is versioned, so you can tune weights and thresholds per sector, product line, or season — fashion's return-abuse patterns need different policies than electronics' stolen-card testing — and see which policy fired on every decision.
Conclusion
Chargebacks will keep rising — 286 million disputes this year says the trend is structural, not cyclical. But the merchants staying under 0.4% share a playbook: score before authorization, deflect what you can with alerts, make descriptors and refunds dispute-proof, and fight the rest with evidence.
If checkout scoring is the missing layer in your stack, try it where the risk concentrates first: your highest-ticket, highest-return sector. Request a demo to trial Ambriel's scoring engine on your own traffic, or read how real-time risk scoring combines these signals into a single decision.