%201.svg)
BFCM Payments, Fraud and Disputes Readiness Checklist
Chargebacks?
No longer your problem.
Recover 4x more chargebacks and prevent up to 90% of incoming ones, powered by AI and a global network of 20,000 merchants.
600+ reviews
TL;DR:
- What it is: a countdown that gives every payments, fraud and dispute task an owner and a due date, starting this week.
- Key dates: Black Friday is November 27, 2026 and Cyber Monday is November 30, and disputes on those orders can arrive until about March 27 and March 30, 2027.
- Start before Thanksgiving: Stripe's 2025 data showed fraud trending up from November 8 and volume rising sharply from about November 17.
- Before the peak: baseline your ratios, start alert enrollment, test checkout and 3D Secure, write a refund authority rule and freeze rules on November 20.
- After the peak: refund first on alerts, check your Visa VAMP ratio weekly in January and close out evidence files in late March.
A BFCM payments, fraud and disputes checklist is a dated, owner-by-owner list of the checkout, fraud-screening, refund and evidence tasks a merchant finishes before, during and after Black Friday and Cyber Monday, so holiday orders do not turn into chargebacks between December and March. Most BFCM plans cover ads, inventory and shipping and give payments a line item at best.
The volume explains why it needs its own plan. In 2026, Black Friday is November 27 and Cyber Monday is November 30. Adobe Analytics measured this US online spend for the same days in 2025:
Historical benchmark · US online retail
Cyber Week spending in 2025
Black Friday
$11.8BOnline spending on Black Friday 2025.
Cyber Monday
$14.25BOnline spending on Cyber Monday 2025.
Five-day Cyber Week total
$44.2BThanksgiving through Cyber Monday 2025, including both days above.
Source: Adobe Analytics, Cyber Monday 2025 release. Historical results, not a forecast for your store or the 2026 season.
This checklist counts back from Thanksgiving (November 26) and gives each task an owner and a date. For the strategy behind it, read our guide to Black Friday and Cyber Monday chargeback prevention. For marketing and fulfillment prep, see our BFCM readiness guide. Year-round controls sit in our ecommerce fraud prevention guide, and Black Friday fraud covers the attack patterns to expect.
What a BFCM payments, fraud and disputes checklist should cover
Six things: a baseline of your current dispute and fraud ratios, enrollment in pre-dispute alerts, checkout and 3D Secure rules tested before traffic arrives, a written refund authority rule, evidence captured at order and delivery time, and a monitoring plan that runs through January. The table below puts a date and an owner on each.
The countdown: who does what, and by when
| When | Owner | Task | Done when |
|---|---|---|---|
| Now to Oct 25 | Finance | Pull last season's dispute rate by order month and your current monthly fraud-plus-dispute ratio, using Visa's VAMP formula (fraud reports plus disputes, divided by settled transactions). | One baseline sheet exists |
| Now to Oct 25 | Payments | Confirm dispute portal access, who receives dispute emails and your processor's response deadlines. Start enrollment in pre-dispute alerts for each card network you accept, such as Ethoca and CDRN alerts. Lead times vary by provider, so start now. Tell your processor in writing what order volume and average order value to expect. | Alert coverage listed per network |
| Oct 26 to Nov 6 | Engineering | Test checkout end to end on mobile and desktop, including 3D Secure step-up and declined-card paths. Add CAPTCHA and rate limits on payment and save-card endpoints (see card testing fraud). | Test log signed off |
| Nov 2 to 13 | Fraud or risk | Backtest your fraud detection rules against last November's orders. Decide which signals flag an order for review and which block it, and size the review queue to expected volume. | Flag and block rules written down |
| Nov 2 to 13 | Support lead | Write a refund authority rule: who can refund without approval, up to what amount, and how fast an alert must be answered. | Rule shared with every agent |
| From Nov 8 | Fraud or risk | Start daily checks of decline rate, review queue and approval rate. Stripe's 2025 retail data showed fraud trending up from November 8 and volume rising sharply from about November 17, more than a week before Black Friday (Stripe). | First daily log entry |
| Nov 9 to 20 | Fulfillment and CX | Check that confirmations, tracking emails and your billing descriptor are clear. Set a signature or photo-proof rule for high-value gift orders. | Sample order reviewed end to end |
| Nov 9 to 20 | Ecommerce lead | Publish a dated holiday return policy on product pages, at checkout and in the confirmation email. | Terms live in all three places |
| Nov 20 | Fraud or risk | Freeze rules and thresholds. After this date, changes need a named approver. Name an on-call reviewer for each peak window. | Rota published |
| Nov 26 to Dec 1 | Fraud and support | Check the monitoring triggers below every hour. Keep a reviewer on shift into Cyber Monday evening: Adobe measured $16 million a minute in online spend between 8 pm and 10 pm that night in 2025 (Adobe). | Hourly log kept |
| December | Payments and support | For an eligible pre-dispute alert, check earlier and pending refunds, follow the provider’s resolution instructions and confirm the outcome. Respond to formal dispute notices with relevant evidence. Watch for late carrier scans that turn into item-not-received claims. | No alert past your response rule |
| January | Finance | Check your VAMP ratio weekly. Disputes from November orders land in a month with fewer settled transactions. | Weekly ratio recorded |
| Mar 27 and 30, 2027 | Risk and finance | These dates are 120 days after Black Friday and Cyber Monday purchases, an initial cohort-review checkpoint. Compare November-cohort dispute rates with last year. Keep evidence for open cases and longer applicable filing windows; delayed-delivery cases can extend beyond this checkpoint. | Results review held |
Peak-weekend monitoring triggers
Stripe's 2025 retail peak data shows how far above normal the weekend runs:
Stripe’s 2025 retail cohort
Fraud risk builds before the peak
Fraud activity starts rising
Nov 8Fraud began trending upward on November 8, 2025, with further spikes through December.
BFCM fraud volume
1.7×Fraud volume in the four-day BFCM period versus a typical four-day period.
Payment volume before Black Friday
2.4×Daily payment volume in the preceding week versus the annual daily average.
Source: Stripe, Preparing for peak shopping season 2026, based on Stripe's 2025 holiday transaction data. Cohort benchmarks inform preparation; set operating triggers from your own payment and fraud logs.
Set triggers before Thanksgiving. The examples below are starting points. Replace them with figures from your own logs from last November.
| Signal | Example trigger | First action |
|---|---|---|
| Decline rate | More than double the same hour last year, or the trailing four-week rate | Check for card testing and tighten rate limits |
| Approval rate | Drops against the same hour last year | Check processor status, the 3D Secure flow and false declines |
| Held-for-review share | Queue older than your response target | Add a reviewer. Do not loosen rules without sign-off |
| New accounts per IP | Above your 95th percentile for a peak day | Turn on CAPTCHA or require login before payment |
| Gift orders to new addresses | Share rises sharply day over day | Add confirmations and tracking emails, verify the largest orders and check for shipping address fraud |
Evidence to capture before the dispute exists
A dispute response is only as good as what you stored at order and delivery time. Match what you keep to the claim you expect:
Capture at purchase and fulfillment
Match the record to the disputed claim
Unrecognized charge
Order confirmation, customer account history, IP and device data, and a screenshot of how your billing descriptor appears.
Item not received
Tracking with carrier scans, delivery confirmation, delivery address match and, for high-value orders, a signature or delivery photo.
Not as described or return dispute
The return policy version shown at checkout, return authorization records and inspection notes.
Refund dispute
Refund transaction ID, date and amount tied to the original order.
Keep records linked to the original payment and order. IP, device and delivery records supply context; they do not independently prove cardholder authorization.
The claim-to-evidence matrix in our friendly fraud guide maps each claim to the documents to submit, our evidence source map shows where each document lives in your payments stack, and Compelling Evidence 3.0 explains the data that helps on Visa fraud disputes.
After the peak: December to March
Disputes from BFCM orders arrive on a lag, so the ratio that matters most is the one you check in January. Visa's VAMP fact sheet defines it and sets the limits:
| VAMP item | Current rule |
|---|---|
| Ratio formula | TC40 fraud reports plus TC15 disputes, divided by settled transactions (TC05) |
| Merchant Excessive threshold | 1.5% (150 bps) from April 1, 2026 in the US, Canada, EU, Asia Pacific and Latin America and the Caribbean. CEMEA stays at 2.2% |
| Minimum volume | At least 1,500 combined fraud reports and disputes in the month (CEMEA: 150 and USD 75,000) |
| Excluded from the ratio | Disputes resolved through pre-dispute solutions and TC40 fraud that qualifies for Compelling Evidence 3.0, depending on the timing of Visa's data extract |
Source: Visa VAMP fact sheet.
The exclusions are why alert enrollment and evidence capture belong in a BFCM plan: disputes that never reach the ratio cannot push you toward a threshold. January also settles fewer transactions than November, so the same dispute count produces a higher ratio. Our guide to chargeback thresholds compares Visa and Mastercard programs, and the plan for post-holiday chargebacks covers staffing the weeks after the peak.
Response deadlines come from your processor. Adyen's documentation, for example, lists 9 days for Visa disputes on US and Canadian local payments opened since July 21, 2025 and 40 days for Mastercard. Confirm the figures for your own processor, and read why Q1 is the real chargeback season for how the lag affects staffing.
FAQ: BFCM payments, fraud and disputes readiness
How early should I start BFCM payments and fraud prep?
Start BFCM payments and fraud prep in October. Alert enrollment goes through your processor or provider, so lead times vary, and fraud rules need backtesting before they are frozen on November 20. Stripe's 2025 data showed fraud trending up from November 8, so monitoring should be live by then.
Who should own refund decisions during peak?
One named person should own BFCM refund decisions, backed by a written refund authority rule: who can refund without approval, up to what amount, and how quickly an alert must be answered. Without a rule, refunds wait in a queue while the dispute window closes.
How long after Black Friday can disputes arrive?
Visa and Mastercard commonly allow cardholders up to 120 calendar days from the transaction date to dispute a charge, which is about March 27, 2027 for Black Friday 2026 orders and March 30, 2027 for Cyber Monday. See chargeback time limits for each network's filing and response windows.
What is the 540-day rule for chargebacks?
In some delayed-delivery cases, such as pre-orders, Visa and Mastercard allow a filing window of up to 540 calendar days from the transaction date, per Adyen's dispute timeframes. A pre-order sold on Black Friday 2026 can still be disputed in 2028.
Should I freeze fraud rules during BFCM?
Freeze routine fraud rule changes from November 20 and allow emergency changes only with a named approver and a written reason. Constant tuning during peak makes it hard to tell which change moved your approval rate.
Which thresholds matter after BFCM?
Visa's merchant Excessive threshold under VAMP is 1.5% in most regions from April 2026, and January is the month most likely to push a healthy merchant toward it because fewer transactions settle than in November.
Chargeflow Alerts and Automation cover the refund-first and evidence steps in this checklist.
Chargebacks?
No longer your problem.
Recover 4x more chargebacks and prevent up to 90% of incoming ones, powered by AI and a global network of 20,000 merchants.
.png)
