Chargebacks for a White-Label VPN Brand

A refund is you (or Apple, or Google) sending the money back through the original rail. A chargeback is the issuer pulling the money through the network, usually with a fee, because the cardholder filed a dispute. The verbs feel similar in a chat window. They are not similar in the processor dashboard.

If a dispute is open, the case owns the money. A goodwill credit on the same invoice is a second reversal. You eat the amount twice plus the fee. The refund-ops article is the fork in the inbox: ask early whether they already called the bank. People lie. The dashboard does not. If the dispute exists, the macro is we see a case, we will respond, access is paused. It is not we will refund in 24 hours.

Klox consumer copy points unhappy buyers at support and /refund first. Copy the idea if you copy the window. Do not tell a partner site that our seven days is their policy. Do not tell an agent that a chargeback is 'just a refund with extra steps.' Extra steps include representment, a deadline, and a risk score.

Issuers pick a code. You do not get to pick a more convenient one. Fraud is 'not me.' Cancelled recurring is 'I ended this and you billed anyway.' Not as described is 'the product was a lie.' Credit not processed is 'you owed me a refund.' Duplicate is two captures. If you upload a reconnect ticket into a fraud case, you wasted the page limit on a story the issuer did not ask.

Visa groups consumer disputes in the 13.x range and fraud in 10.x. Mastercard uses four-digit codes; 4837 is the fraud analogue people quote, 4853 is a wide consumer-dispute bucket. Amex and Discover have their own. Your processor UI may show a friendly English phrase instead of the number. Save the number. Macros should branch on the number.

I will not pretend every 2026 portal still prints the same digits. Confirm on the case. The family is stable even when the sticker changes.

Visa merchant response is commonly about 30 days from the chargeback. Mastercard is commonly about 45. Amex is often shorter. Those are network-shaped numbers. Your processor will give you a shorter upload deadline because they need time to format and forward. Stripe-class dashboards often want evidence in a handful of days. The portal date is the date that can fire. Put it on the agent card in red.

Start the pack the hour you are notified, not the afternoon before the clock. Compiling descriptor screenshots, the terms tick, and mail logs is boring and slow if you never saved them. If you have to grep production because you have no billing export, you already lost the easy cases.

I will not invent an SLA for how fast Klox partners must click. I will say this: a yearly from $2.83 a month still becomes a painful reversal when you miss the window and the acquirer keeps the fee.

This is the VPN-specific trap. Marketing said no-logs. A well-meaning analyst wants to attach 'they streamed for 40 hours' or a list of hostnames. If you do not keep destinations, you cannot produce destinations. If you produce them anyway, you lit the policy on fire for one case. Journalists read representment PDFs when they leak. Banks are not your only audience.

What is fair if you actually store it as account or billing data: email, account id, checkout timestamp, statement descriptor, last login or last-authenticated-at, checkout IP or login IP, device-slot count (five is the Klox consumer cap; your brand may differ), whether WireGuard or OpenVPN was configured as a slot, terms accepted, receipts, dunning or renewal mail, cancel timestamp or its absence, refund rows.

What is a traffic log: DNS queries, destination IPs, SNI, URLs, payload sizes per site. Last handshake to your node is closer to entitlement health than to browsing history. Still: if the public policy says you do not keep connection timestamps, do not magically keep them for Visa. The policy-mistakes essay is the HTML. Here the rule is simpler. The pack may only contain rows the policy admits exist.

Unrecognized charges are the category tax. Privacy merchants look like spam on a statement if the descriptor is LLC-random. The billing article is how you pick a descriptor. This article is how you prove it. Screenshot the live descriptor. Put the same string in the receipt and the first email. If the card says KLOX*BRAND and the email says a different DBA, you handed the issuer a gift.

Terms: a tick at checkout, a timestamp, a URL and version. 'See our website' is not a tick. If you changed the window after they bought, attach the version that was live that day. Refund ops already told you to date the policy. Disputes are why.

Receipts: amount, currency, date, last4 if you have it, plan name, that it is recurring. Yearly from $2.83 a month is a consumer SKU on our site. Your brand's receipt should show your price, not ours, unless you are us.

Fraud pack: they were the cardholder or the cardholder authorized it. Compelling Evidence-style programs on Visa (prior undisputed transactions, matching device or IP) exist for some 10.4 cases. Use them if you qualify. Do not recite a product name as if it were a win. If you have two older good charges on the same PAN, export them. If you do not, do not fake them.

Cancelled recurring: the renewal was allowed because they had not cancelled, or they cancelled after the bill, or the portal shows no cancel. Attach the cancel UX screenshot from the date of purchase if you have it. If cancel was hidden, you will lose and you should fix the portal before the next case. Friendly fraud often arrives as this code because calling the bank is easier than finding Cancel.

Not as described: you sold WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, a tunnel. You did not sell a city count or a speed percentage. Attach the listing. Attach the ticket where they refused OpenVPN TCP on a hotel AP if that is true. Do not attach a fake uptime badge. Do not attach an audit you do not have.

Repeat it until agents can say it in their sleep. Open dispute: no goodwill refund on that charge. Already refunded, then dispute: notify the processor immediately with the refund id. Dual movement is the amateur hour the refund-ops piece warned about. This desk owns the second half: represent or accept, never stack.

Accepting is allowed. If the pack is empty, if the amount is a monthly you would have refunded anyway, if the user is inside a window you staff, accepting can be cheaper than a sloppy fight. Accepting is not a refund button in chat. It is the dispute action. The money is already in motion.

Partial refunds on a disputed yearly are how you confuse the issuer. If you must split, do it through the processor's dispute tools, not a random credit memo.

Pause the entitlement when you are notified. Leaving five devices up while you fight 'I never bought this' is how you lose. You delivered the service after they said it was not theirs. WireGuard does not care about your moral intent. OpenVPN will happily keep a peer until you drop it.

Tell them access is paused because of a billing dispute, not because you are punishing a review. Give a path: if they withdraw the dispute and still want the app, here is how. Do not require them to withdraw as a condition of a refund you already should have issued inside the window. That is hostage-taking and it reads badly in a later pack.

If they paid on the App Store, you may learn about a store refund late. Kill slots when you learn. Store money is not your Visa case, but leftover tunnels are still your network.

Won: the amount stays. Confirm entitlement policy. If you paused, decide whether to restore. If they still want out, cancel going forward without a second cash movement. Lost: the amount is gone. Keep access off. Do not quietly restore the tunnel as a courtesy. You already lost the money.

Finance needs a row: case id, reason code, amount, currency, invoice id, represent or accept, outcome, fee, agent, timestamps, entitlement paused at. If that row lives only in Slack, you will never see a descriptor problem or an affiliate spike.

I will not print a target win rate. Acquirers watch ratios. Treat a climbing dispute rate as an emergency the same way the billing essay said. Fix cancel UX, descriptor, and traffic quality. Do not fix it by attaching destinations you swore you do not have.

If they paid Apple, Apple owns the money. If they paid Google, Google owns it. You do not upload a Visa pack for an IAP you never processed. You still revoke access when you learn the store refunded or reversed. You can help them find reportaproblem.apple.com or Play's refund flow. You cannot honestly tell the issuer you will represent a charge that never hit your merchant account.

Two catalogs means two dispute desks. The in-app subscribe button should have said which. White-label brands that hide web billing inside an iOS app without reading store rules get a worse day than a chargeback day.

Do not double-move. A user who bought on Apple and also emails you for a web refund is trying it on. Check the channel before you click. Refund ops covered the double-refund. Here: there is no representment you can file on a store rail.

The cheapest chargeback is the one that never files. Put cancel where a tired person can find it. Put refund eligibility next to it if you offer a window. Klox consumer is seven days, first purchase only. Fast in-window refunds prevent a lot of 13.x mail. Slow-playing a yearly to 'save cash' buys you a fee and a ratio problem.

Descriptor you can search. Receipt that matches. Renewal mail that names the brand and the amount. Dunning that does not say cancelled while the tunnel is up. Those are other articles. This desk still has to exist because some people will call the bank on purpose.

I will not write a public essay that teaches you how to detect every professional disputers' pattern in code. I will say: decline stacked goodwill, require the original email, watch PAN cycling, and keep the AUP kill separate from the dispute pack. Then go run the inbox.