Mastercard First-Party Trust: What Reason Code 5002 Actually Changes
Shawn Kelley · Last updated August 2026
When a customer disputes a charge claiming they didn't authorize it, merchants usually fight back with evidence: address verification, delivery records, login history. That works under normal rules.
But when Mastercard itself already looked at the transaction and decided it was probably legitimate, the rules change completely. That decision is called a First-Party Trust reject, reason code 5002.
What is a First-Party Trust reject?
Mastercard runs its own fraud-detection systems: Identity Check Insights and Ethoca Customer Clarity.1 When those systems look at a disputed transaction and conclude the cardholder probably did authorize it, the merchant's bank can reject the dispute using that Mastercard data instead of evidence the merchant collected.2 How the acquirer actually reaches for reason code 5002 isn't something the rulebook spells out.3
Normally the merchant has to prove the customer made the purchase. With First-Party Trust, Mastercard has already made that call before the merchant gets involved.
What happens if the customer's bank still wants to push the dispute through?
They can try, but they face much tighter requirements than a normal dispute.2
Geography. Both the card and the merchant have to be in an eligible region. As of April 2026 that covers the US, Canada, Latin America/Caribbean, and most of Asia Pacific, but not Mainland China domestic transactions, India, or Nepal.
The Mastercard account is closed. Not suspended pending review. Closed.
The account is blocked on the issuer's own host system.
The account is flagged on Mastercard's watchlist for 180 days, or until the card expires.
Paperwork. If the card was issued on a US BIN, the cardholder has to sign a notarized statement (Form 0830, the First-Party Trust Cardholder Exception Affidavit) swearing the transaction wasn't theirs. Outside the US, the issuer submits a signed attestation from its Chargeback or Chargeback Compliance contact explaining why the cardholder still disagrees with Mastercard's data.4
The issuer can't just say the customer is still upset. It has to show it treated the account as compromised, and shut things down accordingly.
The geography rule has been widened twice. Earlier, narrower versions applied from 27 October 2024 (US only) and 21 January 2026 (US, Canada, Latin America/Caribbean); the current version took effect 19 April 2026.2
Why can't the merchant use their usual evidence anymore?
Because the restricted set of options for fighting a re-filed dispute after a First-Party Trust reject doesn't include it.4
Under normal rules there are fourteen ways to fight back, including matching the customer's address, showing the transaction was authenticated, or presenting direct evidence the customer was involved.5 After a First-Party Trust reject, that list shrinks to two.
| Second-presentment ground | Standard 4837 | After 5002 |
|---|---|---|
| Compelling evidence (airline, recurring, e-commerce, MOTO) | Yes | No |
| AVS match | Yes | No |
| Authenticated transaction | Yes | No |
| Addendum charge | Yes | No |
| Refund previously issued | Yes | Yes |
| The chargeback was invalid (ten procedural grounds) | Yes | Yes |
The whole category of "here's proof the customer actually did this" is gone. Mastercard already used that kind of evidence when it made the First-Party Trust determination. It doesn't come back as an option.
How long does the customer's bank have to re-file?
120 days from the original transaction date, the same deadline as any normal unauthorized-transaction dispute.2 The clock doesn't restart when the reject happens. So if the original purchase was already three months old when Mastercard rejected the dispute, the bank only has about a month left to pull together the notarized affidavit (or signed attestation) and re-file.6
These rules sit in Chapter 2 of the Chargeback Guide, which governs chargebacks processed on or before 20 April 2028. Chapter 4 carries a functionally identical replacement text that takes effect 21 April 2028.
Related
- Chargeback Response Deadlines by Network and Reason Code
- What Counts as Compelling Evidence for a Visa Dispute?
- Chargeback Glossary
Sources
-
Mastercard Chargeback Guide, Merchant Edition, 19 May 2026 edition, Chapter 2, "First-Party Trust," Supporting documents, p.564: "An issuer statement that the compelling evidence provided in the Identity Check Insights (data-only) message category and Ethoca Customer Clarity details were provided to the cardholder." ↩
-
Mastercard Chargeback Guide, Merchant Edition, 19 May 2026 edition, Chapter 2, "First-Party Trust," Issuer Chargeback, p.564. Post-2028 mirror at Chapter 4, "Dispute Processing," p.1228 — text is functionally identical; Chapter 4 doesn't apply to chargebacks processed before 21 April 2028. ↩ ↩2 ↩3 ↩4
-
Not documented in the rulebook. The Chargeback Guide doesn't state whether reason code 5002 is a manually selected acquirer second-presentment reason or an automated outcome of Mastercard's signal-exchange systems. It's absent from the enumerated second-presentment ground list for a standard 4837 (p.499), which suggests it runs outside that normal menu, but that is an inference from absence rather than a stated mechanism. ↩
-
Mastercard Chargeback Guide, Merchant Edition, 19 May 2026 edition, Chapter 2 — Dual Message System Chargebacks, "First-Party Trust," Acquirer Second Presentment, p.565. The restricted second-presentment list for a re-filed First-Party Trust chargeback reads: "The acquirer may second present when one of the following occurred: A refund was previously issued. [or] The chargeback was invalid," followed by ten procedural grounds (fraud-chargeback-counter threshold, two or more prior fraud-related chargebacks, not reported to the Fraud and Loss Database, requirements not met, past time frame, duplicate processing, and documentation defects). Compare to the standard 4837 second-presentment list at p.499. ↩
-
Mastercard Chargeback Guide, Merchant Edition, 19 May 2026 edition, Chapter 2, "No Cardholder Authorization," Acquirer Second Presentment, pp.498–499. Standard grounds include addendum charges, AVS match, authenticated transaction, compelling evidence for airline/recurring/e-commerce/MOTO transactions, gaming payment transactions, refund previously issued, "No Show" hotel transactions, and specific Maestro MOTO cases, plus fourteen invalidity grounds. ↩
-
Mastercard Chargeback Guide, Merchant Edition, 19 May 2026 edition, Chapter 2, "First-Party Trust," Supporting documents, p.564. Form 0830 required "when the card was issued under a BIN or BIN Range assigned to the United States region"; an issuer attestation applies for all other eligible regions. ↩
05Frequently asked questions
What triggers a First-Party Trust reject on a Mastercard chargeback?
A First-Party Trust reject, reason code 5002, happens when Mastercard's own fraud-signal data, delivered through Identity Check Insights and Ethoca Customer Clarity, indicates a disputed transaction was likely authorized by the cardholder, and the acquirer uses that data to reject a No Cardholder Authorization (4837) chargeback.
Can a merchant still use compelling evidence after a First-Party Trust reject?
No. The second-presentment grounds available for a chargeback re-filed under the First-Party Trust exception are limited to a previously issued refund or one of ten procedural invalidity grounds. Compelling evidence, an AVS match, an authenticated transaction, and an addendum charge are all absent from that restricted list, though all four are available on a standard No Cardholder Authorization second presentment.
What is Form 0830?
Form 0830 is the First-Party Trust Cardholder Exception Affidavit, a notarized statement, signed by the cardholder, required when an issuer re-files a No Cardholder Authorization chargeback after a First-Party Trust reject and the card was issued on a US BIN. Issuers outside the US instead submit a signed attestation from their Chargeback or Chargeback Compliance contact.
Which regions does the First-Party Trust exception currently cover?
As of 19 April 2026, an issuer can only use the First-Party Trust exception when both the card's issuing BIN and the merchant's terminal are located in the United States, Canada, Latin America/Caribbean, or Asia Pacific (excluding Mainland China domestic transactions, India, and Nepal). Earlier, narrower versions applied from 27 October 2024 (US only) and 21 January 2026 (US, Canada, Latin America/Caribbean).
How long does an issuer have to re-file after a First-Party Trust reject?
120 calendar days from the original transaction's Central Site Business Date, the same window as a standard No Cardholder Authorization chargeback, counted from the transaction date, not from the date of the reject.
Shawn Kelley is the co-founder of Disputed. He ran dispute operations at SeatGeek before starting the company.