Mastercard's primary CNP fraud code, decided on device, address, and delivery evidence tying the legitimate cardholder to the purchase.
Mastercard 4837 is the closest Mastercard analogue to Visa 10.4 (card-absent fraud), and the evidence package looks similar: AVS, CVC2, 3DS, device fingerprint, IP, prior history, delivery. The differences are procedural. The Mastercard response window is 45 days, longer than Visa's 30, and Mastercard's compelling-evidence provisions read differently from Visa's, which matters when the merchant is arguing under a specific framework rather than on the general facts.
How the dispute actually arrives
The cardholder has up to 120 days from the transaction date to file a 4837. Most file within 30 to 60 days, when the statement arrives. The merchant gets the notification through their processor, with the cardholder's claim summarized in a sentence. The 45-day response window starts on the day of the notification, not the day the cardholder filed.
A 4837 against a digital-goods seller often arrives months after the buyer used the product. A 4837 against a physical-goods seller often arrives after the package was delivered to the cardholder's billing address. Both patterns are common, and both can win at representment with the right evidence.
What the issuer is looking for
Issuers reviewing a 4837 ask one question: was the legitimate cardholder responsible for the transaction. The answer is built from several pieces, and no single piece is decisive on its own.
AVS and CVC2 matches at the time of the transaction show the buyer had the billing address and the printed security code. Those are necessary but no longer sufficient on their own in 2026. 3D Secure authentication, where the issuer's own systems verified the cardholder at checkout, shifts liability away from the merchant entirely for that transaction. Where 3DS was used and passed, the merchant should cite it explicitly and the dispute should not have been filed against the merchant in the first place.
Device fingerprint, IP geolocation, and session history matter most when the cardholder claims they were not at their computer. Prior order history from the same card, to the same shipping address, especially with positive feedback or no prior disputes, builds the same picture. Delivery confirmation to the cardholder's verified billing address is the closing piece for physical goods.
Mastercard's compelling-evidence provisions, where they apply, are the framework the rebuttal letter cites. They are not identical to Visa's, and a merchant arguing the wrong framework loses on a procedural point.
Common scenarios merchants see
A cardholder spots a charge they do not recognize on a months-old statement and files a 4837 without first contacting the merchant. The full session history, including the email confirmation the buyer received and the delivery to their billing address, often resolves the case.
A buyer used the card, received the goods, and is now claiming the transaction was unauthorized. This is the textbook friendly fraud case. Login records to the buyer's account, the IP address matching prior legitimate sessions, and any post-delivery communication from the buyer carry the case.
A family member or partner placed the order. Under Mastercard rules, the cardholder is generally responsible for transactions made by household members with access to the card. The defense is evidence the order shipped to the cardholder's address and was retained.
A true account takeover. These cases are usually unwinnable, and fighting genuine fraud at representment damages the merchant's dispute ratio without recovering revenue.
What this code is not
Reason code 4837 is not a dispute about whether the merchandise arrived or matched the description. If the buyer says they got it but it was not what they ordered, the dispute belongs under Mastercard 4853 (cardholder dispute). Merchants who confuse the two and submit non-receipt evidence on a 4837 are arguing a different case from the one the issuer is reviewing.
Where this fits in our service
Mastercard reason code 4837 is the highest-volume fraud code we draft rebuttal letters against on the Mastercard side. The letter is built from the AVS and CVC2 state at the transaction, the 3DS posture, the session evidence available, the buyer's relationship with the merchant before the dispute, and the relevant Mastercard rule citation. If you are reading this because you just received one, you can start with a free first letter.
Official source: Mastercard rules. Last reviewed 2026-05-11.