New dispute notification
Amount: £3,800.00
Reason: Services not as described
Response deadline: 20 days
Chargeback defence for citizenship firms
What happens when a client calls their bank.
You collected a flat fee for a citizenship case. The documents are with the comune. The process takes months. The client gets impatient, or their spouse says “that’s too much, call the bank.” They call. The bank opens a dispute. You get the notification above.
What happens next depends entirely on what you recorded at the point of sale. Not what you did. Not how hard you worked. What you can prove.
The process
What the adjudicator sees
The person deciding your dispute doesn’t know what Italian citizenship is. They don’t know what a comune is. They see three things: a payment, a reason code, and whatever evidence you submit.
If you submit “I performed the service” without documentation, you lose. The process is designed to protect consumers. Without evidence, the consumer’s word is the only word.
18%
net recovery rate across all chargebacks
Source: Chargebacks911 Field Report, 2024
That’s across all merchants, all industries. Merchants who formally submit evidence win around 45% of the disputes they contest — but most chargebacks are never contested at all.
Evidence
What wins. What doesn’t.
01
Signed engagement letter
A document the client signed specifying: what service was purchased, the refund policy, the expected timeline, and what constitutes delivery. This is the single most important piece of evidence for professional service disputes.
Required for service disputes
02
Timestamped consent recording
A record that the client agreed to specific terms at the exact moment of payment — with integrity verification so neither side can claim the terms were different. IP address, device fingerprint, the exact text they agreed to, all bound together.
Strongest evidence of informed consent
03
3D Secure authentication
Shifts liability to the card issuer for fraud disputes — where someone denies authorising the payment. Does not cover “services not received” or “not as described.” Valuable, but not a complete defence. See the section below.
Fraud disputes only
04
Portal activity trail
Login records, document uploads, status views, message history — all timestamped. Proves the client actively engaged with the service after payment.
Supporting evidence
05
Service delivery proof
The filed application, the comune acknowledgment, the translated documents. Tangible output that shows work was performed.
Supporting evidence
What doesn't work
“I did the work.” “They agreed verbally.” “It’s in my email somewhere.” “The engagement letter was attached to the invoice but they didn’t sign it.” None of this meets the evidence threshold.
Correction
The 3DS misconception most firms don’t know about.
3D Secure is widely recommended as chargeback protection. It is — but only for a specific type of dispute. When someone steals a card and uses it to pay you (true fraud), 3DS shifts liability to the card issuer. You’re not debited.
But
3DS does not cover “services not received,” “services not as described,” “cancelled service,” or “credit not processed.” These are the dispute types that actually threaten citizenship firms.
For Italian citizenship firms, where the most common dispute reasons are timeline frustration and buyer’s remorse — not stolen cards — 3DS alone is insufficient. The engagement letter, consent recording, and portal activity trail are what win these disputes.
3DS liability shift rules: Visa Core Rules; Adyen documentation; GPayments implementation guide. Applies to fraud reason codes only.
The cost
Anatomy of a £3,800 chargeback.
The refund is only the beginning.
Refund to client
Processing fees on original transaction (not returned)
Stripe dispute fee (non-refundable)
Stripe counter fee (if you fight and lose, since June 2025)
Staff time — 3-4 hours compiling evidence
Total impact
£4,090–4,340
Every $1 lost to fraud costs $3.00\u2013$4.60 in total. LexisNexis True Cost of Fraud Study, 2024.
Thresholds
The cliff edges.
0.75%
Stripe flags your dispute rate as excessive
Source: docs.stripe.com/disputes/measuring
1.5%
Visa and Mastercard monitoring programs trigger
Source: Visa VAMP (from April 2026); Mastercard ECP
5 years
on the MATCH list if your processing is terminated
Source: Mastercard MATCH; docs.stripe.com/disputes/match
What MATCH means
No mainstream processor will accept you for five years. Your options become high-risk processors at 4–8% per transaction with rolling reserves, or bank transfer only.
For a small firm doing 50 transactions a month, three disputes in a bad month is a 6% ratio. Stripe is sending you a warning before you even realise you have a pattern.
Comparison
Your current setup vs a defensible system.
| Most firms | On the platform | |
|---|---|---|
| Engagement letter | Emailed as attachment. Often unsigned. | Signed checkbox before checkout completes. |
| Consent recording | None. No timestamp, no proof. | HMAC-sealed, timestamped, anti-replay nonce. |
| 3D Secure | Not enabled, or PayPal default. | Enforced. Covers fraud liability shift. |
| Delivery proof | Scattered across email threads. | Portal activity log with timestamped logins. |
| Dispute response | Manual. 3-4 hours compiling. | Auto-compiled. Submitted same day. |
| Policy versioning | Terms page changed since client paid. | SHA-256 hash archived at consent time. |
The exposure
Why Italian citizenship firms are structurally exposed.
Flat fees of £3,000–8,000 collected before most visible work happens. The client pays, then waits.
Delivery timelines of months to years. A client who paid in January and hasn’t seen a result by December doesn’t understand that the comune takes eight months.
Outcomes depend on Italian bureaucracy, not the firm’s effort. The consulate rejects a document. The comune doesn’t respond. None of this is the firm’s fault.
60–80% of chargebacks industry-wide are estimated to be friendly fraud — clients who received the service but dispute anyway (Merchant Risk Council; Chargebacks911 Field Report, 2024).
What we did about it
We built this because we lost one.
We run a citizenship practice. We collected a flat fee. A client disputed. We had an engagement letter but no signed consent recording. We lost the dispute and the arbitration appeal.
So we built the system that would have won it. Consent text generated server-side. HMAC-SHA256 binding every field into a single integrity hash. Anti-replay protection. 3D Secure on every transaction. Engagement letter accepted before checkout completes.
Since deploying
Zero chargebacks lost. Not because we stopped getting disputes. Because the evidence is there before the dispute arrives.
Now the same system runs for other citizenship firms. Same infrastructure, their brand. Managed, updated, maintained by us.
If you’ve lost a chargeback — or you know you would if one came — email us.
Tell us what happened, or what you’re worried about. We’ll reply with what the defence would look like on the platform.
info@corviado.com