Amex's primary CNP fraud code, decided on whether the merchant can tie the order to the cardmember's device, address, or account.
F24 is Amex's primary fraud code in card-not-present e-commerce, parallel to Visa 10.4 and Mastercard 4837, and it covers both genuine unauthorized use and friendly fraud where the buyer ordered, received, and then denied the charge. The procedural quirk that catches first-time merchants is the response window: 20 days, against Visa's 30 and Mastercard's 45. A merchant who handles a Visa or Mastercard fraud chargeback over a leisurely month will miss the Amex deadline on the same case.
How the dispute actually arrives
A merchant receives an F24 through Amex's dispute system, either directly via Amex's merchant portal or through a processor that aggregates Amex disputes. The notification cites the disputed transaction and the cardmember's claim. The 20-day clock starts on the day of the notification.
Amex disputes are operationally different from Visa and Mastercard in that Amex is both the issuer and the network. There is no separate issuing bank reviewing the rebuttal. Amex's own dispute team reads the response. That changes the rhetoric of the letter slightly: the merchant is arguing to Amex itself, not to a third-party issuer applying network rules.
What the issuer is looking for
Amex reviewing an F24 asks one question: was the legitimate cardmember responsible for the transaction. The answer is built from several pieces, and no single piece is decisive on its own.
AAV and CID matches at the time of the transaction show the buyer had the billing address and the printed card identification number. SafeKey authentication, Amex's equivalent of 3D Secure, shifts liability away from the merchant entirely for transactions where SafeKey was used and the cardmember was authenticated. Where SafeKey was used and passed, the merchant should cite it explicitly.
Device fingerprint, IP geolocation, and session history matter where the cardmember claims they were not at their computer. Prior order history from the same cardmember, to the same shipping address, especially with positive feedback or no prior disputes, builds the same picture. Delivery confirmation to the cardmember's verified billing address is the closing piece for physical goods.
Common scenarios merchants see
A cardmember spots a charge they do not recognize on a months-old statement and files an F24 without first contacting the merchant. The full session history, including the email confirmation the buyer received and the delivery to their billing address, often resolves the case.
A buyer used the card, received the goods, and is now claiming the transaction was unauthorized. The textbook friendly fraud case. Login records to the buyer's account and any post-delivery communication carry the case.
A family member placed the order. Under Amex rules, the cardmember is generally responsible for transactions made by household members with access to the card. The defense is evidence the order shipped to the cardmember's address and was retained.
A true account takeover. These cases are usually unwinnable, and the right move is to issue the refund rather than fight at representment.
What this code is not
Reason code F24 is not a dispute about whether the merchandise arrived or matched the description. Amex uses separate codes (the C-series) for cardmember disputes about goods and services. Submitting non-receipt evidence on an F24 misses the question Amex is asking.
Where this fits in our service
Amex reason code F24 is the most common fraud code we draft rebuttal letters against on the Amex side. The letter is built from the AAV and CID state at the transaction, the SafeKey posture, the session evidence available, the buyer's relationship with the merchant before the dispute, and the relevant Amex rule citation. The shorter response window means we prioritize F24 cases when they arrive. If you are reading this because you just received one, you can start with a free first letter.
Official source: Amex rules. Last reviewed 2026-05-11.