A chargeback record holds the dispute data a merchant keeps when a payment is reversed. First-party or friendly fraud is tested against Fraud Act 2006 s.2, a false representation. PCI DSS v4.0 limits how much of a card number may be shown. anonym.plus masks the card, removes the cardholder, and keeps the trend visible on your device.
When this applies
The Payment Services Regulations 2017 decide when a provider must refund an unauthorised transaction. Strong customer authentication has applied to UK e-commerce card payments since 14 March 2022, which changes who carries the loss. An analytics team studying repeat disputes needs the pattern, not the buyer.
How anonym.plus handles it
- Open the dispute in anonym.plus on your device.
- The tool flags cardholder names and card numbers.
- Local OCR reads a scanned dispute letter.
- Turn the name map OFF for true anonymity.
- Replace each identifier with a label.
- Save the clean record locally.
What you need to provide
- The dispute record (PDF, DOCX, or scan).
- An operator (Replace, with the name map off).
- Optional batch for many disputes at once.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | Tom Glaze → [CARDHOLDER] |
| Financial | CREDIT_CARD | 4111 1111 ... → ****1111 |
| Money | MONEY | £240 reversed → [AMOUNT] |
| Contact | EMAIL_ADDRESS | tom@example.co.uk → [EMAIL] |
| Contact | PHONE_NUMBER | +44 131 555 2210 → [PHONE] |
| Dates | DATE_TIME | dispute 05/2026 → [DATE] |
Compliance achieved
- Card numbers are masked to the last four digits, in line with PCI DSS v4.0.
- A first-party dispute is tested against Fraud Act 2006 s.2, false representation.
- Refund duties for an unauthorised transaction sit in the Payment Services Regulations 2017.
- True anonymity for analytics is the UK GDPR Recital 26 bar, so keep the map off.
- Offline work keeps cardholder data off any server.
Anonymise chargeback fraud records offline — see plans & start free →
Limitations & cautions
Recital 26 says the data is personal while anyone can re-identify it. Keep the name map off for analytics. A small merchant plus an exact amount and date can still narrow to one buyer, so review the residual fields.
Frequently asked questions
How much of a card number stays after the pass?
Only the last four digits. PCI DSS v4.0 limits what may be shown, and the Mask operator keeps the trend data usable.
Is the analytics set truly anonymous?
Only with the name map off and free-text clues checked. Recital 26 sets that bar, and the tool helps you meet it.
Who pays for an unauthorised card payment?
The Payment Services Regulations 2017 set the refund duty, and strong customer authentication has applied to UK e-commerce card payments since 14 March 2022. Your evidence copy for that decision stays whole.