Chargebacks for travel agencies: preventing card fraud and disputes
In short
A chargeback is the reversal of a card payment, decided by the cardholder's bank after they dispute it. Travel agencies are exposed because the trip takes place long after the payment. With Visa, the deadline runs up to 120 days after the last expected service date, capped at 540 days. 3D Secure generally protects against fraud, not against commercial disputes. For those, the best defence is cancellation terms accepted before payment.
A traveller pays €6,000 by card on 15 January for a stay from 10 to 20 August. The trip goes ahead. At the end of November, they dispute the payment with their bank: in their view, the hotel did not match what was promised. The agency learns about the dispute once the amount has already been taken back.
Ten months after the payment, this is still possible. Card network rules count the deadline from the date of the service, not only from the date of payment. For an agency that collects months before departure, the dispute window is therefore long.
This guide explains how a chargeback works, what 3D Secure really covers, and what an agency can prepare before a dispute arrives.
What is a chargeback?
The traveller does not ask the agency for a refund. They dispute the payment with their own bank, which takes the funds back and opens a procedure.
Chargeback
The reversal of a card payment decided by the cardholder's bank, following a dispute. The merchant can respond with evidence; the cardholder's bank makes the final decision.
The process always follows the same steps.
- The traveller disputesWith their bank
They give a reason: unauthorised payment, service not received, trip cancelled, service not as described.
- The amount is taken backAs soon as it opens
The cardholder's bank has already credited its customer. The amount is withdrawn on the merchant's side before any decision.
- The agency respondsA few days
At Stripe, the response deadline is generally 7 to 21 days depending on the network. Evidence is sent in one go.
- The bank decidesUp to 3 months
Dispute won: the funds come back. Dispute lost: the refund becomes final.
These deadlines and submission rules are described in Stripe's documentation on responding to disputes. Not responding in time means losing the dispute.
There is also a lighter step: the inquiry. The cardholder's bank asks the merchant for information, often because its customer does not recognise a transaction on their statement. Answering quickly often stops it from becoming a real dispute.
Why are travel agencies more exposed?
Because a trip combines several risk factors on a single payment.
The gap between payment and service. A deposit can be paid eight months before departure. Throughout that time, and after the return, the payment remains disputable.
The amounts. A booking worth several thousand euros is a dispute the traveller has every reason to open, and one the agency cannot afford to lose.
Cancellations and changes. A trip often changes after payment: dates, options, travellers. Every change not confirmed in writing is a source of disagreement over what was owed.
Third-party suppliers. A cancelled flight or a disappointing hotel comes back to whoever collected the money. For the traveller, that is the agency.
The payer is not always the traveller. A parent, a company or a group member pays for the booking. If they do not recognise the descriptor on their statement, they may dispute without even telling the traveller.
The networks take this into account. Visa's rules include provisions specific to merchant category code 4722, the one for travel agencies and tour operators, which we cover below.
How long does a traveller have to dispute a payment?
For a service not received, the Visa rules (18 April 2026 edition, condition 13.1) set the deadline at 120 days from:
- the transaction processing date;
- or the last date the cardholder was due to receive the service, without exceeding 540 days after the payment.
For a trip, the second date is almost always the later one. Back to the opening example.
| Step | Date |
|---|---|
| Card payment | 15 January |
| Departure | 10 August |
| Last scheduled day of service | 20 August |
| End of the dispute window (120 days) | 18 December |
The payment stays disputable for almost eleven months. If the last day of the trip falls more than 420 days after the payment, the 540-day cap applies.
For Europe, the same rule adds two deadlines specific to the sector. For code 4722, the cardholder's bank must wait 30 days after the merchant cancelled the service before opening the dispute. And when the traveller must first claim a refund from a bonding or insurance scheme, it must wait 60 days after that claim.
Fraud or commercial dispute: what is the difference?
This is the most useful distinction for an agency, because the two are not prevented the same way.
Fraud is a payment the cardholder did not make: a stolen card, a number used by someone else. A commercial dispute is a payment the cardholder did make, but whose counterpart they contest.
| Reason | What the traveller says | Travel example |
|---|---|---|
| Fraud | "I didn't make this payment." | A stolen card is used to book a holiday |
| Service not received | "I didn't get what I paid for." | A transfer or a hotel night did not happen |
| Service cancelled | "I cancelled and wasn't refunded." | The traveller cancels and disputes the fees retained |
| Not as described | "It wasn't what was planned." | The accommodation does not match the description |
| Credit not processed | "I was promised a credit or a refund." | A goodwill gesture was announced but never paid |
These categories correspond to conditions 10.4, 13.1, 13.7, 13.3 and 13.6 of the Visa dispute management guidelines for merchants.
In travel, most of the risk sits in the last four rows. They are decided by documents and exchanges, not by payment technology.
Does 3D Secure protect against chargebacks?
Against fraud, largely. Against the rest, no.
3D Secure is the step where the cardholder confirms the payment with their bank, for example in their banking app. In the European Economic Area, the PSD2 directive requires this strong authentication on most online payments.
On an authenticated payment, if the cardholder disputes for fraud, liability generally shifts to their bank. Stripe states that this shift is not guaranteed: it depends on the network rules and on each dispute. For any other reason, the standard process applies. Both points appear in its documentation on 3D Secure authentication.
The effect on fraud, on the other hand, is measurable.
€53
of fraud per €100,000 of card payments in France in 2024
French Observatory for the Security of Payment Means, 2024 report
× 3
Online payments without 3D Secure or strong authentication are three times more defrauded than other channels
French Observatory for the Security of Payment Means, 2024 report
540 days
Maximum Visa dispute window for a service not received
Visa Core Rules, April 2026
The first two figures come from the 2024 report of the Observatory for the Security of Payment Means, published by the Banque de France in September 2025.
In short, 3D Secure is essential, but it only settles the first row of the previous table. For the others, the booking file has to be prepared.
How do you reduce the risk before payment?
A commercial dispute is mostly won before it exists. A traveller rarely disputes what they clearly accepted.
Before sending a payment request
- Have the terms of sale and cancellation accepted before payment, with a checkbox or a signature.
- Keep the dated version of those terms, as the traveller accepted it.
- Confirm every change to the booking in writing: dates, options, travellers, price.
- Tell the payer which descriptor will appear on their bank statement.
- Send the request to the actual payer, with the booking reference, when it is not the traveller.
- Send a confirmation after each payment: amount, purpose, balance remaining.
On the first point, Visa is precise. For an online payment, the cancellation policy must be shown before final checkout, with an "I accept" checkbox or next to the payment button. A policy published elsewhere on the website, without acceptance at the time of payment, does not meet this requirement.
After the payment, the rule is simple: respond quickly to a complaint. A partial refund agreed with the traveller often costs less than a lost dispute, which can take back the full amount.
What evidence should you keep to respond to a dispute?
The evidence that shows what the traveller accepted and what they received. It is hard to gather in a hurry: it is better to file it as the booking progresses.
The documents of a defensible booking
- The accepted quote or contract, with the details of the services.
- The terms of sale and cancellation, in the version accepted, and proof of that acceptance.
- Written exchanges with the traveller, especially about changes.
- Proof of service: tickets issued, hotel confirmations, vouchers, itinerary sent.
- For a cancellation, the date of the request, the fees applied and the refund made.
- The payment history of the booking: amounts, dates, methods used.
Form matters as much as substance. At Stripe, the response can only be sent once and cannot be edited afterwards. Banks open neither links nor audio or video files. A clear document of a few pages that answers the stated reason is worth more than a pile of attachments.
Can a SEPA payment be disputed?
Yes, but the rule depends on the type of SEPA payment. A credit transfer and a direct debit share the SEPA name but are not disputed the same way.
A SEPA credit transfer is sent by the traveller from their bank. There is no procedure comparable to a card chargeback. According to the Banque de France FAQ on SEPA transfers, a transfer order can no longer be cancelled once the bank has received it, and the funds can only be returned with the beneficiary's agreement.
A SEPA direct debit is initiated by the merchant, based on a mandate signed by the payer. According to the Banque de France, the payer can request a refund with no reason given for eight weeks after the debit. Without a valid mandate, the debit is considered unauthorised and can be disputed for thirteen months.
| Card | SEPA direct debit | SEPA credit transfer | |
|---|---|---|---|
| Who initiates the payment | The merchant, with the holder's card | The merchant, under a mandate | The payer |
| Dispute possible | Yes, with a reason | Yes, with no reason for 8 weeks | No equivalent procedure |
| Deadline | Up to 120 days after the service (Visa) | 8 weeks, or 13 months without a mandate | Not applicable |
A direct debit therefore moves the risk more than it removes it: the window is short and fixed, but no reason is required. Choosing between card and SEPA according to the amount is covered in our comparison Card vs SEPA for travel payments.
How does Ezus Pay secure payments?
Ezus Pay runs on Stripe's PCI-DSS compliant infrastructure. No card data passes through or is stored at Ezus Pay or at the agency.
3D Secure on every card payment. Ezus Pay requests authentication on all card payments, not only when the bank requires it. An authenticated payment can therefore benefit from the liability shift in case of fraud, although that shift is not guaranteed.
A recognisable descriptor. The traveller's statement shows "EZUS*" followed by the agency's name, or by the descriptor chosen in the settings. Telling the payer about it avoids some inquiries.
Terms of sale on the payment page. When the agency uploads its terms and conditions as a PDF in its settings, the payment page shows an "I have read and accept the Terms and Conditions and the privacy policy" checkbox, with a link to the document. Ticking it is required to pay. A pre-payment message can also remind the traveller of the cancellation terms. Keep the accepted contract or quote on your side: it is the main document in a dispute file.
SEPA payment by direct debit. The SEPA payment in Ezus Pay is a direct debit: the traveller authorises the debit from their account on the payment page. It therefore carries the eight-week refund right described above.
Dispute handling. Disputes on Ezus Pay payments are received and handled by the Ezus Pay team, which manages the relationship with Stripe. The team notifies the agency, asks for the booking documents, then submits them to Stripe. Evidence cannot yet be submitted from the dashboard.
How the payment link attaches each payment to the right booking is covered in a dedicated article. To compare with a Stripe account opened directly, see our comparison between Ezus Pay and Stripe. The full overview is in our guide to online payments for travel agencies.
Ezus Pay is the payment solution built for travel agencies, DMCs and tour operators. It lets you collect by card or SEPA and track every payment on the right booking, with or without Ezus.