A woman emails you at 2 a.m. Her subject line is all capitals. Someone got into her account, she writes, and bought a year of your product. She feels violated. She has already told her bank, and she means every word.

Here is the uncomfortable part. She may be completely right. She may also be completely wrong and completely sincere, because a person who forgot she signed up on a Tuesday night feels the same alarm as a person who was robbed. Your job is to find out which one she is. Your evidence has to do that sorting for you.

Why this dispute is different

Most chargebacks come down to a dispute over what happened. An account takeover claim is about who was there. The customer isn't saying the product was bad or the package was late. She is saying the person who paid wasn't her.

That usually lands as a fraud-type dispute, such as "unauthorized" or "fraudulent." The reviewer's question changes with it. They are no longer asking whether you delivered. They are asking whether the cardholder, or someone she authorized, made this purchase.

There is a hard fact underneath this. Credential stuffing is real. Attackers take email and password pairs leaked from one breach and try them on other sites, betting that people reuse passwords. Some of your disputing customers are victims of exactly this. Treating all of them as liars is both wrong and bad strategy.

Two stories the evidence can tell

Think of every takeover claim as a fork. Down one path, a stranger really did enter the account. Down the other, the owner did it and the story has drifted: a spouse, a teammate, a half-remembered signup, a charge she did not recognize on her statement.

The records you already keep can tell these paths apart, because a stranger leaves a different trail than an owner does.

A real takeover tends to look like a rupture. A login from a new country and a new device appears. The password or the email address changes shortly after. Then the purchase happens, often something quick to cash in on, with no sign of actual use.

An owner's purchase tends to look like continuity. The same device and the same rough location show up as in months of earlier sessions. Nothing about the account's habits changes. The customer logs in, uses the product, and only later disputes.

Your first job is to figure out which pattern you are looking at, before you write a word of rebuttal.

The records that actually discriminate

Not every data point carries the same weight. Here is what is worth pulling, and what each one can and can't prove.

Login history around the purchase. Look at the sessions before, during and after the charge. Were they from the same IP range and device type as the account's long history? A single new IP proves little, since people travel and phones switch networks. A sudden change in everything at once says more.

Account-change events. Did the email, password or payment method change right before the charge? A password reset followed by a purchase is the classic takeover signature. The absence of any change is quietly strong evidence for you.

Two-factor events. If the account has two-factor authentication and the purchase session passed it, that is meaningful. It doesn't prove the owner did it, because phones get stolen and SIM swaps happen. But it raises the bar for the "stranger" story.

Use after the purchase. If the product was used in ways only an owner would know how to use, such as imported data, saved settings or a long workflow, that supports the owner story. If the account sat untouched, that supports the stranger story, and you should weigh it honestly.

Delivery to the cardholder's own email. If the receipt and confirmation went to the address on file, and that address has been the same for a long time, say so. A new address added just before the purchase points the other way.

Note what this list doesn't include: the customer's tone, or your gut feeling that she seems honest. Reviewers cannot weigh either.

Prior undisputed history is your strongest card

Card networks have recognized for years that a returning customer is a different case from a first-time stranger. Visa's Compelling Evidence 3.0 program is built on this idea. For certain fraud disputes, an issuer can be shown earlier, undisputed transactions that share identifying data with the disputed one, such as the same device or IP, and that can shift the outcome. The exact rules and eligibility are set by the network and by Stripe, so read the current requirements for your dispute's reason code before relying on them.

The principle holds beyond that program. If this account has paid you on schedule from the same device for a long stretch without complaint, a single disputed charge sits inside a long, ordinary pattern. Show that pattern. Don't just assert it.

When the honest answer is to let it go

This is the part most chargeback advice skips. Sometimes your own logs say the customer is telling the truth.

If the evidence shows a foreign login, a password change and a purchase within minutes, fighting is the wrong move. Submitting a rebuttal that argues the cardholder made the purchase, against your own data, is a bad bet and a worse habit. You will probably lose. You will also have spent your single chance to respond on a claim you don't believe.

A better response is to accept the dispute, then do the things that matter. Secure the account. Force a password reset. Tell the customer, kindly, what you found and what to change. A victim who is treated well often tells other people, and a victim who is treated as a suspect tells even more.

Fight when the evidence says continuity. Concede when it says rupture. The skill is in reading which one you have, quickly, while the clock runs.

Write the response around one question

When you do fight, build the submission around the reviewer's single question: was this the cardholder?

Lead with the continuity case in two or three sentences. Then give a short, dated sequence: account created, earlier sessions from the same device, the purchase session, usage afterward. Attach only the exhibits that support it, such as a login log excerpt and a screenshot of the account-change history showing no recent changes. Keep it readable on a phone screen, because the reviewer may not give it more than a minute.

Don't call the customer a fraudster. Say what the records show and let them carry the argument.

Your next moves

  • Export the account's full login history today for the disputed account. Save sessions from at least the few months before the charge, with IP, device and timestamp, as one readable page.
  • Check for account-change events in the days before the purchase: email, password, payment method, two-factor settings. Write down "none found" if that is the case, because that is evidence too.
  • Find earlier undisputed payments from the same customer and note which identifying details match the disputed one. Check the current Stripe and network requirements for those fields before you cite them.
  • Decide fight or concede before you draft. If your logs show a sudden new country, device and password change, accept the dispute and secure the account instead.
  • Add a lightweight alert on your side for password resets followed by a purchase within the same hour, so the next takeover gets caught before it becomes a dispute.

Where Argeback fits

The hardest part of these cases is not the writing. It is gathering the right records fast enough, then making an honest call about which story they tell, all inside a deadline that Stripe measures in days. Argeback pulls your dispute in, assembles the evidence it can find into a draft response, and lets you review and file from your phone before the 7-day window closes, so you spend your attention on the judgment call and not on the paperwork. If you'd like to see how that works, you can look at Argeback whenever the next 2 a.m. email arrives.