Skip to main content

Amex F29 - Card Not Present Fraud

Last updated . Copy page as text

This is the Amex code for a customer denying an online or phone order: F29. Looking for Visa 10.4, Mastercard 4837 or Discover UA02?

Read the code off your notice: a dot means Visa, four digits and no dot is Mastercard, two letters at the front is Discover. Get that right first, because Amex gives you 20 days to respond and Visa gives 30 days (see your notice) and Mastercard 45. Get Discover's deadline from your acquirer in writing.

TL;DR
  • F29 is Amex's main fraud code for e-commerce and card-not-present orders. The cardholder says they didn't authorize the charge.
  • SafeKey (Amex's 3D Secure) is the defense that actually works. Full authentication shifts liability to the issuer. The dispute stops being yours.
  • Without SafeKey you're arguing with AVS/CVV results, delivery proof, and device logs. That wins sometimes, not most of the time.
  • You get 20 calendar days to respond. Visa gives 30 days (see your notice) and Mastercard gives 45.
  • Amex may send an inquiry first. Answer it well and the chargeback doesn't get filed at all.

Got this code?​

Your deadline: Amex gives you 20 calendar days, and the date on your notice wins.

The claim: A cardholder told Amex they didn't place an order you shipped. Online, phone, or mail. That's F29. On Amex it's the code e-commerce merchants see most.

Records that answer it:

  1. SafeKey records: ECI 05 puts you in good shape
  2. AVS and CVV results, with the match status
  3. Delivery proof: tracking, signature, address match
  4. Earlier undisputed orders with the same device, email or IP

Next: Decide whether it's worth fighting, then fill in the response outline for this claim and follow the Representment Workflow.

Records by what you sell​

The same claim needs different records depending on what you sold. Find your column.

What you sellShipped goodsDigital or onlineIn person or a service
Records that answer it
  • The 3D Secure result, if it ran
  • The shipping address matching an AVS-verified billing address
  • Earlier undisputed orders on the same card, and delivery records
  • The customer's IP address, device and email at purchase
  • Login or access logs after the payment
  • Earlier undisputed payments on the same card
  • The receipt and the card entry method: read from the chip, or typed in
  • Chip and PIN results, and the authorization response
  • For a collected order or service: the signature and ID details the cardholder gave
Where to find them
  • Shopify: the order's Order risk section shows AVS and CVV indicators and the IP address when available. Submit through Add evidence
  • Stripe: Counter dispute on the dispute details page. Stripe fills in the 3D Secure ECI for a liability-shift case. For an eligible Visa 10.4, leave pre-filled CE 3.0 fields unchanged and complete any empty required fields. Shipping goes in shipping_address and shipping_tracking_number
  • Square: Orders & payments > Disputes, in the dispute's information request form
  • Stripe: Counter dispute on the dispute details page: customer_purchase_ip, customer_email_address, access_activity_log. For an eligible Visa 10.4, leave pre-filled CE 3.0 fields unchanged and complete any empty required fields
  • Shopify: the IP address in the order's Order risk section, when available
  • Your own server or app logs for device and access records
  • Square: the payment in Orders & payments > Transactions. Square says a fraud claim on a chip card that was swiped generally goes the customer's way
  • Stripe: Counter dispute on the dispute details page: customer_signature, service_documentation
  • Your processor, for the entry mode and chip results it holds

Sources: Stripe's evidence by product type VENDOR; Stripe's dispute response form VENDOR; Shopify's evidence by reason VENDOR; Shopify's order risk analysis VENDOR; Square's dispute walkthrough VENDOR; Square's transaction search VENDOR. Checked 24 October 2026. Menus move, so follow what your own dashboard shows.

Overview​

A cardholder says the charge wasn't theirs, and no card was present. Amex files F29. That's online checkout, phone orders, mail orders, and anything else where the card never physically showed up. There's no chip read to fall back on. Everything you'll argue with is data you captured at checkout.

When This Code Applies​

  • Cardholder denies making an online purchase
  • Stolen card credentials used for a CNP transaction
  • Account takeover resulting in unauthorized orders
  • Family member or household user makes purchase without authorization
  • Friendly fraud (cardholder made the purchase but claims otherwise)

Conditions for Valid Dispute​

Amex Must Verify​

  1. Cardholder didn't authorize the transaction
  2. Transaction happened in a card-not-present environment
  3. Dispute filed within the allowable time frame
  4. Cardholder didn't benefit from the transaction

Transaction Must Be​

  • E-commerce (online checkout)
  • Mail order or telephone order (MOTO)
  • Recurring billing without proper SafeKey authentication
  • Any other environment where the card never physically appears

Time Frames​

Shorter Than Visa/Mastercard

Amex gives you 20 calendar days to respond. Visa allows 30 days (see your notice), Mastercard allows 45. That's a third less than Visa and under half of Mastercard. Miss it and you lose automatically. Doesn't matter how good the evidence was.

StageWindow
Inquiry response20 calendar days
Chargeback response20 calendar days
Documentation requestUse the reply-by date; get it from your acquirer in writing if unclear

Amex Inquiry Process​

Amex may send an inquiry before the chargeback. Treat the inquiry as your real deadline. Ignore it and the chargeback files itself. Then you're fighting, not answering.

SafeKey (3D Secure) Liability Shift​

Full Liability Shift (Issuer Liable)​

The issuer eats the loss when all three of these are true:

  • SafeKey challenge completed by cardholder
  • ECI 05 = fully authenticated
  • Valid cryptogram/AEVV present

No Liability Shift (Merchant Liable)​

ScenarioECIMerchant Liability
Authentication attempted, issuer unavailable06Reduced
Authentication failed or not attempted07Full
SafeKey not implementedN/AFull
Certain excluded MCC categoriesAnyFull
SafeKey Is Your Best Defense

Nobody publishes a clean figure for SafeKey's effect on F29 volume. Anyone quoting you one is guessing. The mechanism is what matters. A fully authenticated transaction (ECI 05) moves fraud liability to the issuer. Those disputes never reach you. Take real Amex volume and it's the highest-value item on this page.

Representment Options​

1. SafeKey Authentication​

When to use: SafeKey ran and it passed.

Evidence required:

  • ECI value showing full authentication (05)
  • AEVV/cryptogram
  • Authentication timestamp
  • SafeKey transaction ID

2. AVS and CVV Match​

When to use: AVS and CVV both matched.

Evidence required:

  • AVS response showing match (full or partial)
  • CVV/CID match confirmation
  • Delivery confirmation to the AVS-verified address

3. Delivery Confirmation​

When to use: Physical goods reached the cardholder. You've got tracking.

Evidence required:

  • Carrier tracking showing delivered status
  • Signature confirmation (strongly recommended)
  • Delivery address matching billing or AVS-verified address
  • Photo proof of delivery (if available)

4. Digital Goods Access​

When to use: They used it. You've got logs.

Evidence required:

  • IP address at time of download or access
  • Access/usage logs showing activity after purchase
  • Account login history
  • Download confirmation records

5. Prior Transaction History​

When to use: They've bought before and never disputed.

Evidence required:

  • Previous undisputed transactions from the same account
  • Matching email, device, or IP across transactions
  • Established customer relationship documentation

6. Cardholder Communication​

When to use: You've got the cardholder on record about the order.

Evidence required:

  • Order confirmation sent to cardholder email
  • Customer service correspondence about the order
  • Chat transcripts or call recordings

Required Documentation​

Evidence TypeStrength
SafeKey authenticated (ECI 05)Very Strong
AVS match + CVV match + signed deliveryStrong
Tracking delivered + AVS matchMedium-Strong
Prior undisputed transactions + device matchMedium
No authentication or delivery proofVery Weak

Which defenses hold up​

Defense TypeHow it tends to go
SafeKey authenticated (ECI 05)Strongest
AVS + CVV + delivery proofStrong
Prior transaction history + device matchWeaker
Standard evidence onlyWeaker still
No evidenceRarely wins

Track your own win rate by reason code.

That table is a decision, not trivia. Without SafeKey your case is weaker.

Common Mistakes​

  1. Skipping SafeKey - You're eating avoidable fraud
  2. No delivery confirmation - You can't prove they got it
  3. Ignoring Amex inquiries - They don't go away, they escalate
  4. Missing the 20-day window - Shorter than Visa/MC, easy to blow
  5. Dumping files on Amex - A messy packet reads weak
  • F10 - Missing Imprint
  • F24 - No Cardholder Authorization
  • F30 - EMV Counterfeit
  • F31 - EMV Lost/Stolen/NRI

Prevention Strategies​

Authentication​

  1. Turn on SafeKey (3D Secure 2.0) - Moves the loss to the issuer
  2. Run the frictionless flow - Most customers never see it
  3. Challenge the risky ones - Step up when a signal fires

Verification​

  1. Require CVV/CID every time - Amex puts 4 digits on the front
  2. Check AVS on every order - Decline or review mismatches
  3. Verify email addresses - A bounced confirmation is a signal
  4. Call for the big ones - High-value or high-risk orders

Evidence Collection​

  1. Log everything - IP, device fingerprint, timestamps, session data
  2. Keep the conversation - Emails, chat logs, call recordings
  3. Require delivery confirmation - Tracking, plus signature on big orders
  4. Track account history - Today's boring order is tomorrow's evidence

Fraud Screening​

  1. Real-time scoring - Catch it at checkout, not later
  2. Velocity checks - Flag ordering patterns that aren't normal
  3. Device fingerprinting - Match devices across sessions
  4. Address validation - Cross-check shipping against billing

Next Steps​

Prevent future F29 chargebacks:

  1. Implement 3D Secure / SafeKey for liability shift
  2. Set up dispute alerts to refund before chargeback
  3. Configure fraud detection to catch unauthorized use early

See Also​

Something wrong on this page? Email matt at paymentsandrisk.com and say what needs fixing.