Skip to main content

Amex F29 - Card Not Present Fraud

On this page
TL;DR

F29 is Amex's primary fraud code for e-commerce and card-not-present transactions. The cardholder claims they did not authorize the charge. Your best defense is SafeKey (3D Secure) authentication: with it, liability shifts to the issuer. Without it, you need AVS/CVV matches, delivery proof, and device-level evidence. Response window is 20 calendar days, shorter than Visa or Mastercard.

Overview​

Amex files F29 when a cardholder reports that a card-not-present transaction was not authorized. This covers online purchases, phone orders, mail orders, and any transaction where the physical card was not presented. It is the single most common Amex chargeback code for e-commerce merchants.

When This Code Applies​

  • Cardholder denies making an online purchase
  • Stolen card credentials used for a CNP transaction
  • Account takeover resulting in unauthorized orders
  • Family member or household user makes purchase without authorization
  • Friendly fraud (cardholder made the purchase but claims otherwise)

Conditions for Valid Dispute​

Amex Must Verify​

  1. Cardholder did not authorize the transaction
  2. Transaction occurred in a card-not-present environment
  3. Dispute filed within the allowable time frame
  4. Cardholder did not benefit from the transaction

Transaction Must Be​

  • E-commerce (online checkout)
  • Mail order or telephone order (MOTO)
  • Recurring billing without proper SafeKey authentication
  • Any environment where the physical card was not presented

Time Frames​

Shorter Than Visa/Mastercard

Amex gives merchants 20 calendar days to respond to chargebacks, roughly half of Visa's 30-day window. Missing this deadline means an automatic loss.

StageWindow
Inquiry response20 calendar days
Chargeback response20 calendar days
Documentation request10 calendar days

Amex Inquiry Process​

Amex frequently sends an inquiry before escalating to a full chargeback. Treat inquiries as urgent. Ignoring them guarantees a chargeback.

SafeKey (3D Secure) Liability Shift​

Full Liability Shift (Issuer Liable)​

When the transaction is fully authenticated through SafeKey:

  • SafeKey challenge completed by cardholder
  • ECI 05 = fully authenticated
  • Valid cryptogram/AEVV present

No Liability Shift (Merchant Liable)​

ScenarioECIMerchant Liability
Authentication attempted, issuer unavailable06Reduced
Authentication failed or not attempted07Full
SafeKey not implementedN/AFull
Certain excluded MCC categoriesAnyFull
SafeKey Is Your Best Defense

Merchants with SafeKey authentication see F29 chargeback rates drop by 60-80%. If you process any volume on Amex, implementing SafeKey should be a top priority.

Representment Options​

1. SafeKey Authentication​

When to use: Transaction was authenticated via SafeKey (3DS).

Evidence required:

  • ECI value showing full authentication (05)
  • AEVV/cryptogram
  • Authentication timestamp
  • SafeKey transaction ID

2. AVS and CVV Match​

When to use: Address and security code verified successfully.

Evidence required:

  • AVS response showing match (full or partial)
  • CVV/CID match confirmation
  • Delivery confirmation to the AVS-verified address

3. Delivery Confirmation​

When to use: Physical goods were delivered to the cardholder.

Evidence required:

  • Carrier tracking showing delivered status
  • Signature confirmation (strongly recommended)
  • Delivery address matching billing or AVS-verified address
  • Photo proof of delivery (if available)

4. Digital Goods Access​

When to use: Digital products or services were accessed by the cardholder.

Evidence required:

  • IP address at time of download or access
  • Access/usage logs showing activity after purchase
  • Account login history
  • Download confirmation records

5. Prior Transaction History​

When to use: The cardholder has a history of undisputed purchases.

Evidence required:

  • Previous undisputed transactions from the same account
  • Matching email, device, or IP across transactions
  • Established customer relationship documentation

6. Cardholder Communication​

When to use: You have direct communication with the cardholder acknowledging the purchase.

Evidence required:

  • Order confirmation sent to cardholder email
  • Customer service correspondence about the order
  • Chat transcripts or call recordings

Required Documentation​

Evidence TypeStrength
SafeKey authenticated (ECI 05)Very Strong
AVS match + CVV match + signed deliveryStrong
Tracking delivered + AVS matchMedium-Strong
Prior undisputed transactions + device matchMedium
No authentication or delivery proofVery Weak

Win Rate Expectations​

Defense TypeExpected Win Rate
SafeKey authenticated (ECI 05)70-85%
AVS + CVV + delivery proof45-60%
Prior transaction history + device match35-50%
Standard evidence only25-40%
No evidenceUnder 15%

Prevention Strategies​

Authentication​

  1. Implement SafeKey (3D Secure 2.0) - Primary liability shift protection for Amex
  2. Use frictionless flow where possible - Maintains conversion while adding protection
  3. Challenge high-risk transactions - Step up authentication when fraud signals are present

Verification​

  1. Require CVV/CID on every transaction - Amex 4-digit CID on card front
  2. Check AVS on every order - Decline or review mismatches
  3. Verify email addresses - Send order confirmations
  4. Phone verification for high-risk orders - Callback confirmation

Evidence Collection​

  1. Log everything - IP addresses, device fingerprints, timestamps, session data
  2. Retain all communications - Emails, chat logs, call recordings
  3. Require delivery confirmation - Tracking plus signature for high-value orders
  4. Document account history - Build customer profile over time

Fraud Screening​

  1. Real-time fraud scoring - ML-based detection at checkout
  2. Velocity checks - Flag unusual ordering patterns
  3. Device fingerprinting - Track and match devices across sessions
  4. Address validation - Cross-reference shipping and billing

Common Mistakes​

  1. Not implementing SafeKey - Missing the most effective liability protection
  2. No delivery confirmation - Unable to prove receipt of goods
  3. Ignoring Amex inquiries - Letting them auto-escalate to chargebacks
  4. Missing the 20-day window - Shorter than Visa/MC, easy to miss
  5. Weak evidence packaging - Submitting incomplete documentation
  • F10 - Missing Imprint
  • F24 - No Cardholder Authorization
  • F30 - EMV Counterfeit
  • F31 - EMV Lost/Stolen/NRI

Next Steps​

Got this chargeback?

  1. Check if SafeKey was used --> If ECI 05, you have a strong defense
  2. Pull AVS/CVV results --> Document match status
  3. Gather delivery proof --> Tracking, signature, address match
  4. Check for prior undisputed transactions --> Same device/email/IP?
  5. Respond within 20 days --> Representment Workflow

Prevent future F29 chargebacks:

  1. Implement 3D Secure / SafeKey for liability shift
  2. Set up dispute alerts to refund before chargeback
  3. Configure fraud detection to catch unauthorized use early

See Also​

Last updated on