Skip to main content

​
Purpose

This module focuses on how refunds, reversals, and chargebacks are exploited in virtual card systems. We will detail how these flows work, how fraud occurs within them, and what preventative or investigatory controls your teams should implement. This is essential training for:
  • Treasury and float management teams
  • Fraud and compliance analysts
  • Support teams handling transaction inquiries
  • Engineers implementing refund/reversal/chargeback logic
  • Legal or audit stakeholders investigating loss events

​
Definitions

​
How each works internally

​
Refund flow

  1. User spends $200 at a merchant.
  2. Merchant initiates a refund (days later).
  3. Processor pushes funds back to Bitnob.
  4. Bitnob credits:
  • Card (if active or frozen), or
  • Master account (if card is terminated)

​
Reversal flow

  1. User makes a purchase.
  2. Authorization is placed, but no settlement.
  3. Merchant cancels or fails to complete the order.
  4. Bitnob receives a reversal webhook.
  5. Authorization hold is lifted; funds are restored.

​
Chargeback flow

  1. User disputes a charge (e.g. fraud or failed service).
  2. Bitnob notifies the processor and requests reversal.
  3. If valid, processor debits the merchant and credits Bitnob.
  4. Cardholder receives funds (or master wallet is credited).
  5. Processor charges a penalty fee for the dispute.

​
Common abuse patterns

​
1. Refund abuse

Fraudsters create multiple cards, spend and terminate them, and receive refunds that flow back to their wallets. Example:
  • Create card, top up $100
  • Spend $90
  • Terminate card
  • Merchant refunds $90
  • Refund lands in float; fraudster demands payout

​
2. Reversal exploits

  • Use cards to “test” platforms that issue reversals instead of declines
  • Appear inactive (no real spend) but cycle balances rapidly
Pattern: Rapid top-up → spend → reversal → repeat. Can indicate laundering or collusion with merchants.

​
3. Chargeback fraud

User makes a legitimate purchase, then disputes the charge weeks later claiming fraud. High-risk signals:
  • Frequent disputes from same user across multiple cards
  • Chargebacks against high-risk MCCs (ads, gaming, etc.)
  • No prior complaint through support before dispute

​
Controls & detection strategies

​
Refund & chargeback SLA guidelines

​
Logging & audit best practices

  • Log original spend reference and webhook reference in all refund records
  • Maintain ledger integrity across top-up → spend → refund path
  • Store MCC, merchant, BIN, IP, and device for each reversal or chargeback
  • Flag multiple refunds to same card in short succession
  • Track “refund value ” by user weekly

​
Support team checklist

​
Module 5 knowledge check

​
1. Which of the following is true about reversals?

A. They occur after settlement B. They involve merchant disputes C. They occur before settlement and release the hold D. They trigger chargeback fees Correct answer: C

​
2. What should happen when a refund is issued to a terminated card?

A. It’s automatically lost B. It must be credited to user wallet C. It should be rejected D. It must be credited to float and logged Correct answer: D

​
3. A user has 3 chargebacks in one week across 3 cards. What should happen?

A. Lock account, investigate B. Issue new cards C. Accept the chargebacks without action D. Credit user with float balance Correct answer: A