Generative AI Fraud and Chargebacks: What Merchants Can Do

What has changed

Fraud against online stores is not new. What generative AI changes is the cost of making things look real. A fake ID, a convincing complaint email, a photo of a cracked product: each used to take some effort or skill. Now each takes a prompt.

US authorities have said so directly. In December 2024, the FBI warned that criminals use generative AI to commit fraud on a larger scale, and that AI-generated content can be hard to identify. Its warning covers believable text, realistic images, fake identification documents, cloned voices and video. A month earlier, FinCEN, the US Treasury's financial crimes unit, issued an alert on deepfake media. It reported an increase since 2023 in suspicious activity reports describing suspected deepfakes, especially fraudulent identity documents used to get past identity checks.

For a merchant, this shows up in four places: who is buying, what they claim went wrong, how the dispute is written, and what "proof" is attached. This article walks through each, then covers the evidence that still holds up.

Synthetic identities

The Federal Reserve describes synthetic identity fraud as combining real and fake personal information to form a new identity. It calls this kind of fraud difficult to detect and often unreported, because there is frequently no real person checking statements and noticing strange charges. The classic pattern: the fraudster uses the identity until the gain is large enough, then "busts out" and stops paying.

Generative AI makes the fictitious parts easier to produce at scale: profile photos, ID images, a plausible email history, a website for a fake business. The FBI's warning lists realistic profile photos for fake accounts and fraudulent identification documents among the uses it has seen.

What this means for your disputes:

• A synthetic buyer may never dispute anything. The loss falls on the card issuer that extended the credit.
• But when cards or accounts tied to synthetic identities are used in your store, fraud chargebacks can follow, and the "customer" will not answer an email.
• Name and address checks alone are weaker than they were. A synthetic identity can have a consistent name and a working address.

AI-edited "damaged item" photos and refund fraud

This is the most visible change for stores that sell physical goods. A customer receives an item in good condition, edits a photo to show a crack, stain, tear or mold, and asks for a refund without returning anything.

The pattern has been reported in public. In late 2025, sellers on Chinese e-commerce platforms reported a wave of refund claims backed by AI-altered images, such as mold on fruit or holes in clothing, mostly on low-value items. The OECD's AI incident monitor logged the case, citing broad Chinese media coverage, including a police case involving a fabricated video of dead crabs. Similar reports have come from sellers on European resale platforms and eBay, though those reports are thinner.

How this reaches your chargeback record: if you refuse the refund, the customer can go to their bank and file a "not as described" or "damaged" dispute. The edited photo goes along with it. Banks are not forensic labs.

What helps:

• Ask for more than one photo, including the shipping label, the packaging, and the item with something that shows the date.
• For higher-value items, require the item back before refunding, or ask for a short video.
• Keep your own photos of what shipped. Pack-out photos taken at fulfillment are hard to argue with.
• Look at the account, not just the claim: refund history, number of damage claims, and whether the same pattern shows up across orders.

AI-written dispute narratives and deepfaked documents

Two smaller shifts are worth knowing about.

Dispute narratives. Anyone can now ask a chatbot to write a firm, well-structured complaint that uses the right terms: "item not as described", "merchant refused to refund", "unauthorized transaction". We are not aware of published data that measures this in chargebacks, so treat it as a likely pattern rather than a proven trend. The effect is that a well-written dispute tells you nothing about whether it is true. Judge the claim against your records, not its tone.

Documents. The FBI and FinCEN both describe fake identification documents produced with AI. The same tools can produce a receipt, a screenshot of a chat, a carrier notice or a bank letter. If a customer sends a document that conflicts with your own data, your data should win. Check a carrier claim against the carrier's own tracking page, not a screenshot.

First-party misuse

Much of what gets called AI fraud is still first-party misuse, sometimes called friendly fraud: a real customer, with their own card, who received the order and disputes it anyway. Sometimes they forgot the purchase, or did not recognize the descriptor. Sometimes a family member ordered. Sometimes it is deliberate.

AI does not create this behavior. It lowers the effort. Editing a photo or drafting a convincing letter takes less effort than it did, so a customer who might once have let a small complaint go can now back it with "evidence" in a few minutes.

Two things follow. First, prevention still matters most: a clear billing descriptor, tracking sent by default, and fast support remove the easy reasons to dispute. Second, when a first-party dispute does arrive as "fraud", the strongest response is proof that this cardholder has bought from you before without complaint. Visa has a specific rule for that.

What evidence still holds up

Generated content is easy to fake. Records created by third parties at the time of the transaction are not. That is the dividing line.

Evidence	Who creates it	Easy to fake with AI?
Carrier delivery scans and tracking history	The carrier	No, if you pull it from the carrier
AVS and CVV results	The card network and issuer at authorization	No
IP address and device data at checkout	Your checkout and risk tools	No, though it can be masked
Prior undisputed orders on the same card	Your order history	No
Customer emails and chat logs	Your support system	No, if exported from your system
Customer-supplied photos and documents	The customer	Yes

Visa Compelling Evidence 3.0. For one specific dispute type, Visa lets merchants use transaction history to shift liability back to the issuer. Per Verifi, Visa's company, the rule works like this:

• It applies only to disputes under Visa reason code 10.4, "Other Fraud: Card Absent Environment".
• You need at least two prior transactions on the same payment credential, dated 120 to 365 days before the dispute.
• Those prior transactions must not have been disputed as fraud.
• At least two core data elements must match between the prior transactions and the disputed one, from: User ID, IP address, shipping address and device ID. One of the two must be the IP address or the device ID.

So a matching shipping address and account login is not enough on its own. You need IP or device data stored for both the old orders and the new one. Visa also runs this check before a dispute is filed, through Verifi's Order Insight: Visa pre-selects two to five eligible prior transactions, the merchant returns the data, and if the criteria are met the pre-dispute is blocked. After a dispute, the merchant's acquirer can submit the same type of package.

The lesson for the AI era: you cannot produce this evidence after the fact. It has to be captured at checkout, every time, and kept for at least a year.

Practical steps

1. Store checkout signals on every order. IP address, device identifier where your stack provides one, AVS and CVV results, and the customer account ID. Keep them for at least 13 months so you can meet the 365-day CE 3.0 window.
2. Pull delivery proof from the carrier. Save the carrier's tracking history and delivery scan when the order is delivered, not when a dispute arrives.
3. Photograph what ships. For items that draw damage claims, take pack-out photos at fulfillment.
4. Tighten damage claim intake. Ask for several photos, including label and packaging. Require returns above a value you choose.
5. Watch accounts, not single claims. Flag repeat damage claims, repeat "not received" claims, and new accounts with high-value first orders.
6. Do not trust customer documents over your own records. Verify carrier, bank and receipt claims against the source.
7. Keep the support thread. Export conversations with the order. A customer who confirmed receipt in chat cannot easily claim non-delivery to their bank.
8. Use alerts for the cases you would lose. Refund before a dispute is filed when the evidence is weak, so you save your effort for the cases you can win.

Where Recoup fits

Recoup refunds matched Ethoca, RDR and CDRN alerts inside the window, and fights the remaining disputes with evidence pulled from the store, carrier tracking, risk signals and customer conversations. Responses are filed automatically or after your approval.