Blocking Repeat Chargeback Customers

A single chargeback is a cost of doing business. A repeat chargeback from the same person is a leak you can close. The problem is that anyone who has learned to dispute a charge and keep the goods rarely stops at one, and they know better than to reuse the exact same details. Blocking one email address does almost nothing when the next order arrives under a fresh Gmail account.

The fix is to build a blocklist that matches people, not just strings. That means keying on several identifiers at once and being deliberate about avoiding false blocks, because blocking a genuine repeat customer is far more expensive than absorbing an occasional chargeback.

Why single-field blocking fails

If your blocklist only holds email addresses, you are one signup away from being beaten every time. A determined abuser rotates the things that are cheap to change and keeps the things that are inconvenient to change.

• Email is free to rotate. A new address takes thirty seconds. Email-only blocking stops only the laziest repeat offenders.
• Names are trivially altered. Slight spelling changes, middle initials, or a partner's name defeat name matching instantly.
• Cards get replaced. A fraudster with several stolen cards simply uses the next one.

What stays relatively constant is harder to fake: the shipping address where they actually want the goods delivered, the phone number they use to receive delivery notifications, and above all the device they order from.

The four identifiers worth keying on

A durable chargeback blocklist matches on several fields and treats a hit on the stickier ones as stronger evidence.

• Email. Weak on its own, but useful for exact repeats and for spotting patterns like the same base name with plus-addressing or shuffled dots.
• Phone number. Stickier than email because the abuser usually needs a working number for delivery SMS. Normalize formatting before matching so that +1 (555) 010-1234 and 5550101234 collide.
• Shipping address. Very sticky. The goods have to physically arrive somewhere the abuser controls. Normalize and fuzzy-match so minor edits, the exact address-manipulation trick fraudsters use, still hit.
• Device fingerprint. The stickiest of all. Browser, OS, screen, fonts, and other attributes combine into an identifier that survives new emails, new names, and new cards. When the same fingerprint that produced a chargeback returns, that is your strongest single signal.

Best control. Score a returning order by how many identifiers match and how sticky each one is. A device-fingerprint match alone should carry more weight than three rotated emails, and a match across device plus address should be close to conclusive.

Building the blocklist workflow

The list is only as good as what feeds it and how carefully it is applied.

1. Capture every chargeback's full identity set. When a dispute lands, record the email, normalized phone, normalized shipping address, and device fingerprint together as one linked record, not four separate entries.
2. Match new orders against the set at checkout. Before an order is created, compare its identifiers to the blocklist and compute a match score across all four fields.
3. Act by confidence tier. A high-confidence multi-field match blocks outright. A single sticky-field match, such as device only, holds for review. A single weak-field match, such as email only, raises the score but does not block by itself.
4. Expire and review entries. Addresses and phone numbers get reassigned over time. Age out old entries and periodically review the list so it does not accumulate stale false positives.

Doing this by hand across four normalized fields is not realistic past a trickle of orders. Shieldy Fraud Filter lets you block by email, phone, address, and device fingerprint at the checkout level, and layers AI fraud scoring on top so that a returning abuser who rotated their obvious details is still caught by the identifiers they could not easily change.

Avoiding false blocks

This is the part that separates a useful blocklist from a revenue leak in the other direction. Aggressive matching creates collateral damage, and some of it is invisible until a good customer emails you angry.

• Shared devices and networks. Family members, roommates, office computers, and public Wi-Fi mean two unrelated people can share an IP or even a device. Never block on shared-network signals alone.
• Reassigned identifiers. Phone numbers and addresses get new owners. An address that saw a chargeback two years ago may house an entirely different, honest resident today. Expiration windows matter.
• Legitimate disputes. Not every chargeback is fraud. A customer who charged back once because a package genuinely never arrived is not a repeat abuser. Distinguish "friendly fraud" and true abuse from honest service failures before adding someone to a hard-block list.
• Plus-addressing and normalization errors. Overly loose email matching can collapse distinct customers into one. Test your normalization rules against real data.

The safeguard is the same as everywhere else in fraud prevention: weight multiple signals, and reserve hard blocks for high-confidence matches. Send the ambiguous middle to review. A held order that a human clears in ten seconds costs you almost nothing; a wrongly blocked loyal customer costs you their lifetime value and a bad review.

Measuring whether it works

Track two numbers against each other so you can tune the balance:

• Repeat-chargeback rate. The share of chargebacks coming from identifiers already on your list. If this stays high, your matching is too loose or your capture is incomplete.
• False-block complaints. Customers reporting that they were wrongly declined. If this rises, your matching is too aggressive or your entries are stale.

Healthy tuning drives the first number down while keeping the second near zero. If both move the wrong way, revisit your confidence tiers rather than the list itself.

The takeaway

Blocking one email stops nobody. Repeat chargeback abusers rotate the cheap identifiers and keep the sticky ones, so your blocklist has to key on email, phone, address, and device fingerprint together, weighting the stickier fields more heavily. Capture the full identity set on every dispute, match new orders at checkout, and act in confidence tiers so hard blocks stay reserved for near-certain matches.

Do that, and returning abusers hit a wall while your honest repeat buyers never notice a thing. Explore the plan options to see which blocklist and scoring layers fit your store.