A chargeback is a buyer asking their bank to reverse a card payment. For a digital product it hurts twice: the money goes back, and the key or file you delivered stays with the buyer. Chargebacks come in two kinds that need different fixes. Fraud chargebacks come from stolen cards: the real cardholder spots a charge they never made. Buyer disputes, often called friendly fraud, come from real customers who don’t recognize the charge, say the product never arrived or didn’t work, or went to their bank instead of to you. This guide covers both.
Why digital goods fraud is so common
Digital goods are exactly what someone with a stolen card wants to buy. They arrive in seconds, they can be resold quickly, and there’s no parcel and no delivery address to trace. Keys, gift cards and game items are the classic targets. And because a key or file can’t be taken back once it’s delivered, the defense has to happen before delivery. After that, all you have left is evidence.
Prevent chargebacks on digital goods before delivery
Fraud Shield checks every checkout on every path (the storefront, buy buttons, embeds, Discord and Telegram purchases) twice: before payment, and again after the provider confirms it, once card details such as the BIN and the 3-D Secure result are known. Each check runs in order: your allowlist, your blocklist (emails, domains, IPs, countries, devices, cards and more), your own rules, then a risk score built from network signals (VPN, proxy, Tor, hosting), the email, velocity, where the buyer seems to be, their history at your store and the size of the cart.
Orders flagged at payment are held: paid, but nothing is delivered. In the review queue you approve them, or cancel or refund them and add the buyer’s email, IP and device to your blocklist in the same step. Why held? on any order shows exactly which rule or signal caught it.
Rules worth starting with in a digital store:
- Send orders far above your usual cart to review.
- Challenge checkouts where the billing, IP and card countries disagree.
- Ask buyers with a disposable email address for a 6-digit email code.
Run a new rule in shadow mode first to see what it would have done, and try made-up checkouts in the Simulator (Fraud Shield).
When to ask for 3-D Secure
3-D Secure asks the cardholder to confirm the payment with their bank, usually in the banking app or with a code. A thief holding only the card details usually can’t pass it. In many regions, a payment authenticated with 3-D Secure also moves the liability for fraud chargebacks from you to the card issuer; check your processor’s rules for where you and your buyers are. It does nothing for disputes that say the product didn’t arrive or didn’t work.
The cost is friction: every extra step loses some honest buyers. So ask where the risk is. A Fraud Shield rule can require 3-D Secure, or an email code, for risky checkouts only, such as a first order, a VPN connection or a large cart.
Limit card orders where the risk is highest
Order limits set the smallest and largest order each way to pay can take: cards up to an amount, a lower limit on a buyer’s first card order, crypto from an amount. Above the limit, buyers see your other ways to pay (order limits). The chargeback shield goes further and steers risky checkouts to crypto or store credit, and you can price crypto lower so buyers take the switch.
Not every way to pay can be reversed the same way:
| Way to pay | Can it be reversed after delivery? |
|---|---|
| Cards, Apple Pay, Google Pay | Yes, through a chargeback |
| PayPal checkout | Yes, through a PayPal dispute or a chargeback |
| Cash App Pay, direct debits | Yes, so they count as cards for order limits |
| Crypto to your own wallet | No: refunds are yours to send |
| Gift cards | You redeem the code before anything is delivered |
| Skins through Skinloop | A trade reverted after delivery counts as a lost chargeback |
Details per method are in payment methods for digital products and accepting crypto payments.
Give buyers a faster way out than their bank
Many buyer disputes start because the bank looked like the easiest way to get help. Take that reason away:
- Report a problem. Every order page lets the buyer open a claim with you (not received, not working, not as described, wrong item), with a reply-by date three days out. You resolve it as refunded, replaced or rejected.
- Key replacements. Key not working? gives a buyer a fresh key from the same pool, within your replacement policy, without a ticket (selling license keys).
- Product status. A Down badge, a short note and a status page tell buyers you know about a problem before they decide they were scammed (product status).
- A name they recognize. Checkout shows “Sold by” with your legal name and address when you set them. Make the name on the buyer’s card statement match your store too; that’s set in your payment provider.
- A clear policy. Say when you refund, replace or don’t, and refund quickly when the fault is yours (writing a refund policy).
Chargeback evidence for digital products
ShopFast imports chargebacks from Stripe and PayPal into Disputes & Claims with their evidence deadline. Answer each reason with the evidence that fits it:
| Dispute reason | Evidence that answers it |
|---|---|
| Fraudulent or unauthorized | The buyer’s IP and country against the billing and card country, the 3-D Secure result, the risk check, the buyer’s earlier orders |
| Product not received | Delivery records: the order page and receipt that carried the key or file, the keys sent, the downloads |
| Not as described or not working | Your product page, the key sent, any replacement given, your replies in the claim |
| Refund not given | Your refund policy, the claim thread and, for EU, EEA and UK buyers, the stored “Deliver my order right away” agreement |
Lead with the evidence that matches the reason, keep it short and factual, and send it before the deadline (buyer protection). Delivery that’s logged automatically, as in automatic delivery for digital products, is what makes this evidence exist at all.
After a chargeback
- On your own gateway the dispute follows your processor’s rules. ShopFast took no fee on the order, and nothing moves on ShopFast’s side. With ShopFast Pay, available by application, ShopFast deals with the processor instead.
- Time-based access ends. Telegram access is removed on a chargeback, and given back if you win it.
- History counts. A buyer’s chargebacks at your store feed Fraud Shield’s risk score, so the same buyer scores higher next time. Add them to your blocklist when it’s clearly fraud.
Questions sellers ask
Can you win a chargeback on a digital product?
Yes, when your evidence answers the reason the buyer gave: delivery records for 'not received', the IP, country and 3-D Secure result for 'unauthorized'. Send it before the evidence deadline.
Does 3-D Secure stop chargebacks?
It stops many fraud chargebacks, because a thief usually can't pass the bank's check, and in many regions it moves fraud liability to the card issuer. It doesn't help with disputes that say the product didn't arrive or didn't work.
What is friendly fraud?
A dispute from the real cardholder rather than a thief: they don't recognize the charge, forgot the purchase, or went to their bank instead of asking you. Recognizable store names, fast support and delivery records reduce it.
Are crypto payments safe from chargebacks?
There is no bank to reverse a crypto payment, so there is no chargeback. You can still refund a buyer from your own wallet when you choose to.
Should I refuse all refunds to avoid losses?
No. A buyer with no other way to get help goes to their bank, and a lost chargeback costs more than a refund. Refund or replace when the problem is yours, and say when you won't in your refund policy.