What is a safe chargeback rate for a subscription business?

Structurally you want to operate below 0.5 percent, well under the levels where Visa's VAMP program and Mastercard's monitoring programs engage, because acquirers act before the brands do. Subscription merchants drift upward without touching anything as rebill cohorts age, so the ratio needs active management through alerts, pre-billing notices, and easy cancellation rather than periodic attention when a warning letter arrives.

Do I legally have to offer one-click cancellation?

The FTC's federal click-to-cancel rule was vacated by an appeals court in 2025 before taking full effect, but that changed less than the headlines suggested. ROSCA still requires simple cancellation mechanisms for online negative-option billing, state auto-renewal laws such as California's impose their own requirements, and Visa's rules require an easy online cancellation path for trial and subscription merchants regardless of what regulators do. Build one-click cancellation anyway; it is both a compliance floor and your cheapest chargeback reduction.

How do I keep rebills working when customers' cards expire?

Use the card networks' account updater services, which refresh expired and reissued card numbers automatically, and adopt network tokens where your processor supports them, since tokens update behind the scenes without touching the PAN. Layer decline-code-aware retry logic on top, spacing retries and abandoning hard declines instead of retrying blindly. Together these typically recover a large share of involuntary churn while keeping you clear of excessive-retry fees.

High-risk vertical

Subscription & Continuity Billing: payment processing without the fragility

Recurring billing is a risk model of its own, independent of what you sell: every rebill is a card-not-present charge the customer did not actively initiate that day. Card brands wrote dedicated rulebooks for negative-option and trial merchants, regulators keep tightening cancellation requirements, and the gap between a healthy subscription business and a chargeback-monitoring case is mostly infrastructure.

Why processors flag this vertical

Negative-option billing, where silence becomes consent to charge, is the single most litigated billing model in ecommerce, covered federally by ROSCA and targeted repeatedly by FTC rulemaking and enforcement.
Visa maintains specific rules for trial and subscription merchants requiring express consent at enrollment, reminder notification before a trial converts, and a straightforward online cancellation method, and violations are chargeback-eligible.
Mastercard's subscription and negative-option rules similarly require transaction receipts with cancellation instructions and confirmation at enrollment, giving issuers rule-backed grounds to grant disputes.
Forgotten rebills structurally inflate dispute ratios, because even satisfied customers charge back transactions they do not remember authorizing.
State auto-renewal laws, led by California's, impose their own disclosure and cancellation requirements with private enforcement, adding legal exposure on top of card-brand rules.
Continuity merchants are frequently coded under MCC 5968, a designated direct-marketing code that acquirers monitor with tighter tolerances and price accordingly.

What drives chargebacks here

The forgotten rebill is the core driver: a charge posts months after signup, the customer does not recognize it, and the issuer files it as unrecognized or unauthorized.
Trial-to-paid conversions generate disputes when the reminder before conversion is missing or buried, which is exactly why Visa mandates it.
Cancellation friction converts refunds into chargebacks, since a customer who cannot find the cancel button calls their bank instead.
Descriptor mismatch between the checkout brand and the statement entity turns routine rebills into unrecognized-charge disputes.
Failed cancellations that rebill anyway, usually a CRM or webhook bug, produce the angriest disputes and the complaint-board posts that follow underwriters around.

Processing challenges to expect

Aggregators tolerate subscription billing generically but terminate fast when ratios climb, and continuity merchants climb faster than one-time sellers by the nature of the model.
High-risk underwriters price continuity offers with reserves and volume caps, and they read your enrollment flow, terms placement, and cancellation path as part of underwriting.
Visa's VAMP program consolidated fraud and dispute monitoring in 2025, and subscription merchants sit closer to its thresholds than their one-time-sale peers at the same quality level.
Involuntary churn from expired and reissued cards forces reliance on account-updater services and smart retries, and acquirers watch excessive-retry patterns, which carry their own card-brand fees.
Regulatory motion is constant, with the FTC's click-to-cancel rule vacated by a federal appeals court in 2025 while state auto-renewal laws keep expanding, so compliance targets shift under your feet.

The infrastructure playbook

Own your card file in a processor-agnostic token vault with network tokens where available, because in a subscription business the vault is the business, and gateway-locked tokens convert any PSP dispute into an existential event.
Run multiple MIDs under your legitimate entity with your acquirer's knowledge to isolate offer types and keep any single MID's ratio manageable, and never confuse that with laundering volume across unrelated shells, which is a MATCH-list offense.
Wire Ethoca Alerts and Verifi RDR into automated refund logic so first-party disputes are intercepted before they post, which is the single highest-leverage tool for staying under VAMP thresholds.
Use account updater services and disciplined retry logic to fight involuntary churn without tripping excessive-reauthorization penalties, and segment retries by decline code rather than hammering every failure.
Send pre-rebill notification emails and make cancellation genuinely one-click, both because card-brand rules increasingly require it and because easy cancellation demonstrably converts chargebacks into recoverable churn.
Keep descriptors matched to the consumer-facing brand with a phone number, and test them quarterly on real statements, since descriptor drift after processor migrations is a common silent cause of dispute spikes.

Frequently asked questions

What is a safe chargeback rate for a subscription business?: Structurally you want to operate below 0.5 percent, well under the levels where Visa's VAMP program and Mastercard's monitoring programs engage, because acquirers act before the brands do. Subscription merchants drift upward without touching anything as rebill cohorts age, so the ratio needs active management through alerts, pre-billing notices, and easy cancellation rather than periodic attention when a warning letter arrives.
Do I legally have to offer one-click cancellation?: The FTC's federal click-to-cancel rule was vacated by an appeals court in 2025 before taking full effect, but that changed less than the headlines suggested. ROSCA still requires simple cancellation mechanisms for online negative-option billing, state auto-renewal laws such as California's impose their own requirements, and Visa's rules require an easy online cancellation path for trial and subscription merchants regardless of what regulators do. Build one-click cancellation anyway; it is both a compliance floor and your cheapest chargeback reduction.
How do I keep rebills working when customers' cards expire?: Use the card networks' account updater services, which refresh expired and reissued card numbers automatically, and adopt network tokens where your processor supports them, since tokens update behind the scenes without touching the PAN. Layer decline-code-aware retry logic on top, spacing retries and abandoning hard declines instead of retrying blindly. Together these typically recover a large share of involuntary churn while keeping you clear of excessive-retry fees.

Related verticals