Fraud Alerts and Chargeback Notifications

Overview

When card networks or processors detect fraudulent activity on a transaction, they issue a fraud alert before a formal chargeback is filed. Coinflow receives these alerts automatically, acts on them immediately, and notifies you — giving you a window to act before the dispute becomes a chargeback.

Understanding this two-stage process helps you respond faster, reduce losses, and maintain a healthy chargeback rate.

Stage 1 — Fraud Alert Received

Fraud alerts are pre-chargeback signals sent by card networks and processors indicating that a cardholder has reported a transaction as unauthorized. Coinflow receives these from multiple sources:

Source	Alert type
Shift4	TC40 (Visa fraud report) and SAFE (Mastercard fraud report) via automated file transfer
Worldpay	Direct fraud report feed
NatWest	Direct fraud report feed
Nuvei	Dispute alert feed

Fraud alerts and chargebacks are separate events. An alert means a cardholder flagged the transaction — a chargeback is the formal bank dispute that follows, sometimes days or weeks later. Not every fraud alert results in a chargeback, but all should be treated as high-risk.

When an alert arrives, Coinflow does the following in sequence:

Store the fraud report

The alert payload (fraud type, ARN, amount, processor code) is attached to the original payment record. This creates an audit trail and prevents duplicate processing if the same alert is received more than once.

Block the customer

The customer’s account is immediately set to Blocked status. Blocked customers cannot initiate new transactions on your platform until the block is cleared by Coinflow.

The block reason is recorded as:

Fraud reported on payment ({paymentId})

Report to fraud protection providers

The customer is added to two lists in Coinflow’s fraud intelligence network:

fraud_reported — flags the account as a confirmed fraud case
pre_chargeback_alert — signals an incoming chargeback is likely

This informs future risk decisions for this customer across the platform.

Notify you

Coinflow sends the CardPaymentSuspectedFraud webhook to your configured endpoint. The payload includes the payment ID, customer wallet, and alert details.

Set up this webhook to trigger your own internal review process — for example, halting pending fulfillment or flagging the order in your system.

Stage 2 — Chargeback Raised

If the cardholder escalates their dispute with their bank, the bank formally issues a chargeback. This happens independently of the fraud alert — typically days to weeks after the original transaction.

When Coinflow receives a chargeback from the processor:

Payment status updated

The payment moves to CHARGEBACK status. If the customer wasn’t already blocked from the fraud alert stage, they are blocked now.

Chargeback protection evaluated

Coinflow checks whether the transaction was covered by your chargeback protection configuration:

Approved — the protection provider accepted liability. Coinflow covers the financial loss. Contact Coinflow to confirm handling.
Rejected / NotEnabled — you are liable. A response is required before respondByDate.

If protection is enabled, Coinflow also attempts to debit the disputed amount from the merchant settlement wallet.

You are notified

Coinflow sends the CardPaymentChargebackOpened webhook with the dispute details, reason code, and respondByDate deadline.

Full Lifecycle

Cardholder reports fraud to bank/network
        ↓
Fraud alert received by Coinflow (TC40 / SAFE / processor feed)
        ↓
Customer blocked — CardPaymentSuspectedFraud webhook sent to merchant
        ↓
        ├── Cardholder drops dispute → no chargeback filed
        │
        └── Cardholder escalates → bank issues formal chargeback
                    ↓
            Coinflow receives chargeback from processor
                    ↓
            Payment → CHARGEBACK status
                    ↓
            CardPaymentChargebackOpened webhook sent to merchant
                    ↓
            Merchant responds before respondByDate
                    ↓
            Network decides → CHARGEBACK_WON or CHARGEBACK_LOST

What This Means for You

On CardPaymentSuspectedFraud: Review the flagged order immediately. If goods or digital access haven’t been delivered yet, halt fulfillment. The customer is already blocked from new transactions.
On CardPaymentChargebackOpened: You have until respondByDate to submit a response. See Responding to Disputes for the full response process.
Blocked customers: Blocks are set and cleared by Coinflow. Contact the Coinflow team if you believe a block was applied in error.