What Mastercard 4837 means
The cardholder (or a corporate card's company) told the issuer they did not authorize the transaction. The issuer must report it to Mastercard's Fraud and Loss Database before charging back. Fully authenticated Identity Check transactions are generally protected.
Common causes
- Stolen card details used at checkout
- Account takeover of a customer's store account
- Family members using a saved card
- Friendly fraud and unrecognized descriptors
Evidence that answers it
- Mastercard Identity Check (3-D Secure) authentication for the transaction
- For registered customers: other undisputed purchases, a registered device and IP address, signed proof of delivery, or registration or use of the goods
- Correspondence with the cardholder showing they took part in the transaction
- AVS results where the AVS second presentment applies
- Proof the chargeback is invalid: more than 35 fraud chargebacks on the account, or approval after two earlier fraud chargebacks
How to prevent it
- Use 3-D Secure on risky orders
- Screen orders and hold mismatched billing, shipping, IP and device signals
- Encourage account creation and record device and IP at checkout
- Use a recognizable billing descriptor
Time limits and caveats
Issuer time frame: within 120 days of the Central Site Business Date. Second presentment within 45 days. Mastercard's registered-customer compelling evidence does not apply to guest checkouts. In the U.S., Mastercard's First-Party Trust program can reject a 4837 when Consumer Clarity data validates the cardholder; the issuer can then re-file only with a cardholder affidavit or attestation and a closed account.
How Verdikx helps with 4837
Verdikx's fraud playbook for 4837 asks for proof the cardholder participated: checkout IP and device, AVS and CVC results, prior undisputed orders on the same account and customer messages from connected helpdesks (beta). Order screening on new Shopify orders and Stripe early fraud warnings (Growth and Pro) reduce exposure. Ethoca alerts are coming soon.
Frequently asked questions
What does Mastercard reason code 4837 mean?
Mastercard 4837 means the cardholder says they did not authorize the transaction. It is the main fraud code for online sales, and acquirers map legacy 4840 and 4863 to it. It is sometimes winnable with compelling evidence of participation, such as authentication, account history with undisputed purchases, a registered device and IP, or correspondence.
Is Mastercard 4837 worth fighting?
Our reference rates 4837 (No Cardholder Authorization) sometimes winnable, depending on the evidence you have. The evidence that answers it starts with mastercard Identity Check (3-D Secure) authentication for the transaction. The cardholder's bank decides the outcome.
How long does a cardholder have to file a Mastercard 4837 chargeback?
Usually 120 days from the transaction date, under the network's issuer time limits. Your processor gives you far less time to respond, so work from the due date on the case.
Answer your next 4837 with the right evidence.
Install on Shopify, or create a workspace for WooCommerce, another platform or your processors, and get your first verdicts in minutes. 7-day free trial, no percentage of what you win.
Sources
- Mastercard Chargeback Guide, Merchant Edition (13 May 2025) (checked October 5, 2026)
- Stripe Docs: Dispute reason codes (checked October 5, 2026)
Last reviewed by Verdikx Research.