TC40

The name comes from transaction code 40 in Visa's systems. When a cardholder reports a purchase as fraudulent, the issuer logs it as a TC40, usually the same day the card is blocked. Mastercard's equivalent was long called SAFE (System to Avoid Fraud Effectively) and now goes by Fraud and Loss Database. The reports flow to the network and on to the acquirer. The merchant only sees them if the acquirer chooses to pass them along.

The catch is that a report and a dispute are separate things. An issuer can report the fraud and simply refund the cardholder itself, so the merchant never gets a chargeback and assumes everything is fine. The reports still feed Visa's monitoring programme, where a high fraud ratio means fines and, at worst, losing the right to accept cards. For a merchant hit by card testing, the TC40 feed may be the first warning.