This piece is split into seven parts. Part I covers what the dispute mechanism is and who pays whom. Part II is the difference between credit cards and debit cards - same Visa/Mastercard logo, but different legal rights, a fact rarely stated plainly in Vietnam. Part III lists the cases eligible for dispute under network rules. Part IV compares the legal frameworks across three countries - the US, Singapore, Vietnam - same payment network, different outcomes. Parts V and VI cover the reality on the ground in SG and VN, checking the license against actual life. Part VII is a six-step playbook for anyone who has just spotted a strange transaction.

I. The Dispute Mechanism - Four Parties, One Money Loop, Three Layers Of Rules

Every card transaction has four parties in the payment chain (the four-party model): the cardholder, the issuing bank (issuer), the card network (Visa/Mastercard), the bank that settles with the merchant (acquirer), and the merchant. Money flows one way - from the cardholder through the issuer, through the scheme, through the acquirer, to the merchant. When a dispute arises, the money flow reverses along that exact same path. That is a chargeback.

The card network's role here is not "final arbiter" - the network sets the rules (Visa Dispute Management Guidelines 2024; Mastercard Chargeback Guide May 2025) and settles disputes between two banks. The cardholder never speaks directly with Visa or Mastercard. Everything goes through your issuer. This is the first point where the mechanism becomes asymmetric: the bargaining power sits with the issuing bank, not the cardholder.

1.1 - Visa Claims Resolution (VCR): four reason-code groups

Since April 2018, Visa has standardized all reason codes into four categories numbered 10/11/12/13:

• 10 · Fraud - a fraudulent transaction not carried out by the cardholder. Examples: a skimmed card, card-not-present (CNP) fraud, a counterfeit card. Runs through the Allocation workflow: Visa automatically assigns liability to whichever party is at fault (usually the acquirer/merchant if there's no 3DS/EMV).
• 11 · Authorization - a transaction that wasn't validly authorized (e.g., an expired card, a blocked card, or a limit exceeded but processed anyway).
• 12 · Processing Errors - technical errors. Includes duplicates (the same transaction recorded twice), wrong amount, wrong currency, an unprocessed refund.
• 13 · Consumer Disputes - civil disputes. Goods not delivered, goods differing from description, damaged goods, service not rendered, a subscription cancellation that didn't take effect. Runs through the Collaboration workflow: Visa does not auto-assign liability - both sides get a chance to respond before it's formalized.

Visa's standard time limit: the cardholder has 120 days from the transaction date (or the expected delivery date) to file a chargeback. The merchant has 30 days for representment (submitting counter-evidence) after being notified (ChargePay 2024).

1.2 - Mastercard MasterCom: four categories with longer time limits

Mastercard splits similarly into four groups: Authorization, Cardholder Disputes, Fraud, Point-of-Interaction Errors (Visa calls this differently: "Processing Errors"). The main difference: the window is usually 90–120 days, with some reason codes running as long as 540 days (long-running transactions such as subscriptions and installment plans). Merchants get 45 days for representment (Chargebacks911 Mastercard 2026).

1.3 - Pre-arbitration and Arbitration: the final round

If the two sides still disagree after representment, the dispute moves to pre-arbitration - the issuer can refile with additional evidence. The final step is formal arbitration at Visa/Mastercard, costing $500–900 and potentially adding another 10–45 days (Chargebacks911). The arbitration decision is final and binds the two banks - it is not a court ruling, and the consumer is never a party to arbitration. The issuing bank decides whether to escalate to arbitration on the customer's behalf. If they don't, the customer has nowhere left to go within the scheme system.

II. Credit Card vs Debit Card - Same Visa Logo, Different Protections

Most Vietnamese cardholders carrying a Visa/Mastercard don't know a structural fact: a credit card and a debit card - even under the same Visa logo, issued by the same bank - do not carry the same dispute rights. This gap isn't because Vietnamese banks apply the rules poorly; it originates in the US's own legal design, spreads through scheme rules, and gets printed into the T&Cs of every bank in the world. Three core differences:

2.1 - Why the US splits credit and debit into two different laws

The US is the only country that draws this sharp a line, via two separate statutes. Consumer Compliance Outlook (Federal Reserve, 2016) explains: "Consumer protections for credit and debit cards derive from different federal laws - the Truth in Lending Act (TILA) for credit cards and the Electronic Fund Transfer Act (EFTA) for debit cards."

• TILA 1968 → Regulation Z → Fair Credit Billing Act 1974 - applies to credit cards. It sets (a) a hard $50 liability cap, no tiers; (b) a legal right to dispute goods/services with the merchant via a "billing error" (12 CFR §1026.13); (c) a holder-in-due-course defense - if the merchant breaches the contract, the cardholder can refuse to pay the bank, for amounts ≥$50 within the same state or within 100 miles.
• EFTA 1978 → Regulation E - applies to debit cards. It sets a liability tier of $50 (reported within 2 business days) / $500 (reported 2–60 days from the statement) / unlimited (after 60 days). Important: Reg E does not define a merchant dispute as an "error" - only a pure EFT (a wrong amount transferred, a wrong account, or goods charged but never received are not Reg E errors).

This asymmetry isn't a legislative oversight - it's deliberate. The logic: a credit card is a temporary loan from the bank (the bank bears the money risk); a debit card is a direct withdrawal (the customer bears the money risk). When credit fraud happens, it's the bank's loss - they have an incentive to investigate thoroughly and recover. When debit fraud happens, the money has already left the customer's account - the bank only investigates when forced to, and Reg E's tiered liability is designed to pressure users into checking their statements regularly.

2.2 - Visa Zero Liability - an extra layer, but with gaps

On top of the legal framework sits the voluntary Visa Zero Liability Policy - applying to both credit and debit, pushing most unauthorized cases down to $0. Mastercard has an equivalent policy. Regardless of national law, these two schemes create a shared layer of protection. But there are three points users easily get wrong:

• Applies only to unauthorized transactions - not to merchant disputes. Goods not delivered, damaged goods, an uncancelled subscription - none of this falls under Zero Liability. It has to go through the chargeback process, whose scope is voluntary, not a hard legal right.
• Doesn't apply to commercial cards or anonymous prepaid cards. Business cards and internal prepaid cards typically sit outside Zero Liability.
• Can be revoked if "negligence" is inferred. The bank can declare the customer "negligent" - especially when an OTP was entered - and withdraw Zero Liability protection. This is the biggest gray zone in SG and VN.

2.3 - Singapore and Vietnam: the law doesn't draw a clear line, but daily life does

Neither Singapore nor Vietnam splits its legal framework by card type the way the US does. Singapore: the ABS guideline uses a single "card transaction disputes" category - no credit/debit split. Vietnam: Circular 18/2024, Article 19, applies uniformly to "bank cards" - covering debit, credit, and prepaid cards alike. On paper, both card types get the same right to file, the same 60-day deadline, the same 30-business-day processing window.

But the economic reality differs. SingSaver puts it bluntly: "transaction disputes might be easier to manage in credit cards as compared to debit cards... fraudulent charges in debit card transactions will deduct money straight from your account. Debit card users should be aware that protections might not be as robust as those for credit cards." The reason isn't in the scheme rules or the law - it's in the cash flow:

• When credit fraud happens: the bank has not yet demanded payment from you (the statement cycle can run up to 30 days). You have time to dispute before facing payment pressure. If you don't pay the disputed portion, there's no immediate financial consequence for you personally.
• When debit fraud happens: the money is already gone from your account. Auto-debits for rent, electricity, or an incoming paycheck deposit can fail due to insufficient balance. You need the bank to issue provisional credit as soon as possible - and Circular 18/2024 doesn't mandate immediate provisional credit (only compensation after the investigation concludes).

2.4 - A practical recommendation: credit for online, debit only for familiar POS + ATM

A lesson found across every US financial-safety guide - and increasingly agreed on by the VN/SG fintech community - boils down to one simple rule:

• Online purchases, travel abroad, long-running subscriptions, high-value goods → credit card. Stronger legal rights (FCBA billing error), smaller cash-flow impact if fraud occurs, and if there's a dispute, the bank investigates while its own money is on the line - meaning the bank has a real incentive to close the case.
• POS at merchants you know well, ATM withdrawals at your own bank → debit card. Low fees, no accumulating balance, no interest if paid late. Fraud risk is lower in a familiar environment.
• Set a low debit limit; set a high credit limit. If one card is compromised, the maximum loss shrinks. You can hold two debit cards: one for salary (low limit), one for spending (top up as needed).
• For online payments: use a virtual / one-time card if available (Privacy.com in the US; Timo, Cake, TPBank Evo in VN offer virtual cards). If it's compromised, you just lock it - no impact on your main card.

This recommendation doesn't depend on national law - it holds true in the US, SG, VN, Indonesia, Thailand. The cash-flow structure is universal; what differs between countries is only the strength of the legal framework behind you once things have already gone wrong.

III. Which Cases Are Eligible For Dispute - What Most Users Don't Know

Network rules allow chargebacks across the four groups above. Applied to daily life, eight specific situations account for nearly all real-world disputes. Note: the "merchant dispute" situations (non-delivery, defective goods, cancel a subscription) are a hard legal right only for US credit cards via the FCBA - for a debit card, or a card issued in SG/VN, this is a voluntary right under scheme rules. The bank can refuse:

Note what cannot be disputed (under standard network rules): a transaction you later decide "wasn't worth the money" after receiving exactly what was described; a tip with no receipt; gambling losses; a penalty fee already written into the terms. And most importantly: a transaction successfully authenticated with OTP/3DS - this is the gray zone, and also where national law splits into four different directions.

IV. The Legal Frameworks - Three Ways Of Treating The Cardholder

Same Visa/Mastercard network, same rulebook, but each country's law adds its own layer - deciding when you get your money back, who has to prove what, and what happens if the bank refuses. This is the part that separates an American from a Vietnamese cardholder.

4.1 - The US: two different laws for two card types - and that's a feature, not a bug

The US has the most complete card-payment protection framework - not because Americans are smarter, but because the law drew a sharp line between credit and debit as far back as 1968 (TILA) and 1978 (EFTA). The two card types fall under two different statutes, two different sets of regulations, two different liability caps - all detailed in Part II. To summarize here:

• Credit card · Reg Z + FCBA: a maximum liability of $50 for any unauthorized transaction, with no timing tier. The issuer must acknowledge the dispute within 30 days and finish investigating within two billing cycles or 90 days. There's a right to dispute goods/services with the merchant (billing error plus holder-in-due-course defense).
• Debit card · Reg E: a tiered liability of $0/$50/$500/unlimited depending on when it's reported. The bank must issue provisional credit if the investigation runs >10 business days. Reg E does not cover merchant disputes - only pure EFT (electronic fund transfer) issues. A merchant dispute on debit only goes through Visa/MC's voluntary chargeback process.
• On top of that, Visa/Mastercard's voluntary "zero liability policy" pushes most unauthorized cases down to $0 - as long as the user "used reasonable care".

This is a structural difference from every East Asian country: the US has a statutory floor that a bank isn't allowed to override in its T&Cs. Americans may not love the $50 cap, but they always have that $50 cap - even if the bank wants to pressure them into voluntarily accepting more liability. The VN/SG framework has no such floor.

4.2 - Singapore: no statute, but there is FIDReC

Singapore has no statute equivalent to Reg E / Reg Z for card disputes. The dispute process sits entirely within bank policy - overseen by MAS through the ABS guideline. The practical framework:

• File a dispute resolution form within 14 days of the card statement date (at most banks).
• Bank processing takes 4 weeks for simple cases, 12 weeks for complex ones.
• DBS/OCBC/UOB give provisional credit within 5 business days; investigations can run up to 60 days.
• OCBC: only 7 days from receiving the SMS alert about a strange transaction - far stricter than the 14-day statement window.

When the bank refuses, the user can escalate to FIDReC (Financial Industry Disputes Resolution Centre) - an intermediary body backed by MAS. Mediation is free; adjudication (a formal ruling) has a nominal fee of S$50. The claim ceiling is S$150,000 (since 1 July 2024, up from S$100k). It must be filed within 6 months of the bank's "final reply".

This structure has two important properties. First, there is no statutory floor for zero liability - a bank is free to write into its T&Cs that "an OTP-authenticated transaction = customer liability". Second, FIDReC is not a court - an adjudication decision binds the bank if the customer accepts it, but there's no power to compel the bank to fix a systemic pattern. Singaporeans compensate for this with an unusually fast process and a MAS that's very strict about internal reporting - not with strong statute.

4.3 - Vietnam: Circular 18/2024 - a new regulation, but OTP remains a gray zone

Vietnam belongs to the regulatory group - no statute on the level of Reg E / Reg Z, but Circular 18/2024/TT-NHNN (effective 1 July 2024, replacing Circular 19/2016) sets out fairly detailed rules. One point worth flagging immediately: Circular 18/2024 does not clearly distinguish between credit cards and debit cards in the claims/complaints section - Article 19 applies uniformly. The real-world consequence still differs because of the cash-flow structure (debit money leaves instantly) - discussed in Parts II and VI.

Article 19 sets a clear timeline:

• The cardholder gets a minimum of 60 days from the transaction date to file a claim/complaint.
• Processing within ≤30 business days for cards on an SBV-issued domestic BIN; for an international BIN (Visa/MC), it's set by contract but must be reasonable.
• After receiving a suspected-fraud report, the bank must lock the card and process it within 5 business days (domestic BIN) or 10 days (international BIN).
• Compensation within ≤5 business days after notifying the outcome, provided it's "not the cardholder's fault" and not force majeure.
• If the deadline passes without determining fault, there's 15 business days to negotiate; failing that, it's "resolved under the law" - meaning a civil lawsuit.
• The bank must offer at least 2 complaint channels: a 24/7 recorded hotline plus a branch; a paper form plus an electronic form. From 1 January 2025, it must also offer online complaint-status lookup.

Anyone reading this far might think "not much worse than Singapore." The paperwork structure is actually good. The problem sits in the last three words of Article 19: "not the cardholder's fault". This is the gray zone that Vietnamese courts, in major 2023–2024 cases, have repeatedly interpreted in the bank's favor - the subject of Part V.

V. Singapore In Practice - The OTP Gray Zone, With FIDReC As The Last Shield

Singapore has the second-best theory after the US. Real life tells a different story - not a bad one, but one that pulls users into a very wide gray zone around OTPs.

These two cases, along with a string of threads on HardwareZone and r/singaporefi, paint the same pattern: whenever merchant evidence shows "an OTP was used," Singaporean banks default to pushing liability onto the customer. The bank's logic: an OTP is a second authentication factor (2FA); if it was used, either the customer did it themselves, or the customer was socially engineered - either way, not the bank's fault. This is written explicitly into the card contract's T&Cs.

This is exactly where FIDReC becomes important. When DBS/UOB refuses a refund, the user files with FIDReC; a case manager will mediate - meaning they don't rule right or wrong but push both sides toward a compromise. In many cases, the bank agrees to refund 50–80% to avoid adjudication (fearing it would set a precedent). If no agreement is reached, the customer pays S$50 to escalate to adjudication, where an adjudicator rules based on "facts and merits". Adjudication binds the bank - but not the customer: the customer can reject the outcome and go to civil court instead (very rare).

VI. Vietnam In Practice - When The Bank Says "The OTP Was Entered, No Grounds For A Claim"

Vietnam has Circular 18/2024, with its 30-day, 60-day, 5-day-compensation framework - on paper, not bad at all. But there's another truth that anyone who has ever had to dispute a card transaction in Vietnam knows: whenever a transaction shows successful OTP/3DS authentication, the bank's default answer is "no grounds for a claim". This isn't the fault of any one bank; it's how Circular 18/2024 gets interpreted whenever the "cardholder's fault" clause runs into an authentication log.

Vietnam Law Magazine sums up the general trend: "in most cases, banks blame the customer's carelessness, while claiming their payment systems are secure because they've invested in advanced security technology." This pattern isn't limited to card disputes - it applies to nearly every dispute between a bank and a customer where an authentication trail exists.

This is a logic very familiar across East Asia: the OTP was entered = the cardholder's will = not the bank's fault. This logic makes sense in a case where a user voluntarily shares an OTP with a friend; it becomes absurd in a case of sophisticated social engineering (fake bank-support agents, fake delivery notices, fake government officials). But the law doesn't distinguish motive - only fact: where the OTP was, who entered it, on which device. Circular 18/2024 doesn't clearly define "cardholder's fault" in this context, leaving room for case-by-case interpretation that defaults toward whichever side holds the documentation - which is the bank.

6.1 - What's actually plausible: foreign transactions, non-delivery, duplicates

The picture isn't entirely bleak. Within the same Circular 18/2024 framework, some dispute types are genuinely plausible and usually win:

• CNP fraud with no 3DS (an international transaction where the merchant didn't require an OTP) - Visa/MC scheme rules shift liability to the acquirer. Vietnamese banks open the chargeback and almost certainly win, since the merchant has no evidence to fight it with.
• Duplicate / wrong amount - a refund-instead-of-cancel resulting in double FX charges (the Tinhte 2024 case: a $5,400 USD refund cost about VND 8 million in two-way FX). Banks usually support this because the merchant's error is clear.
• Non-delivery / goods not as described with clear evidence - chats, photos, emails - banks still open a chargeback under VCR/Mastercom.
• An uncancelled subscription - Netflix, Spotify, global software - Vietnamese banks open a chargeback if there's cancellation evidence.

What's not plausible: a domestic transaction with an OTP already used, phone-based fraud, or any case where the bank can point to a successful authentication record. The system defaults to one answer: "the OTP was entered, no grounds for a claim."

6.2 - A structural shift worth watching: passkeys, biometrics, in-app authentication

Regulators have seen the problem. Since 1 July 2024, the SBV has required biometric authentication for transactions above VND 10 million/transaction or VND 20 million/day. This is a shift from OTP-via-SMS to device-bound 2FA - much harder for social engineering, since the attacker doesn't have physical access to the real device. The legal significance may matter even more than the technical one: if a transaction lacks biometric verification, the bank will find it harder to argue "customer's fault" as before; if it has biometric verification, that path to a dispute is almost entirely closed off.

An open question: as biometrics become standard, will the definition of "cardholder's fault" narrow along with it? The answer will shape Vietnamese financial consumers' rights over the next five years - and it doesn't sit in scheme rules, but in how Vietnamese courts interpret Article 19 of Circular 18/2024.

VII. A Six-Step Playbook - When You've Just Spotted A Strange Transaction

Compiled from ABS Singapore, the SBV, and the US CFPB - six steps that apply across all three regions, ordered by priority:

1. Report to the issuer within 24 hours - through every channel available

   Call the 24/7 hotline (the number on the back of the card), send a message via the app, note the reference number. US: within 2 days = $50 cap. SG: within 7 days (OCBC) or 14 days (most banks). VN: ≥60 days is the legal minimum, but sooner is always better - the bank can verify the timestamp more easily while the event is fresh. Request that the card be locked immediately.

2. Request temporary credit and a reference number in writing

   US: Reg E mandates provisional credit within 10 business days. SG: 5 days (DBS). VN: Circular 18/2024 doesn't mandate provisional credit - you must specifically request it and get it documented. Get the ticket/reference number via email - not over the phone. Reference that number in every subsequent call.

3. File the official dispute form (paper or digital) within the window

   Each bank has its own form. SG: within 14 days of the statement. VN: VCB Digibank online; Techcombank/ACB via app + branch. The more specific the form is about the reason code, the better: state clearly "unauthorized CNP", "duplicate charge", "non-delivery of service ABC ordered on XYZ" - this helps the issuer file it under the correct VCR/Mastercom category.

4. Document everything - chats, emails, photos, tracking, screenshots

   The issuer needs evidence to open a chargeback. The default question: "have you contacted the merchant yet?" You need evidence you tried the merchant first. For fraud: the SMS alert, IP/location if available, transaction history before/after. For non-delivery: a tracking number, a photo showing "not received," a record of the merchant not responding.

5. When the bank refuses - escalate to the right place for your country

   US: file a CFPB complaint (consumerfinance.gov/complaint) - the bank must respond within 15 days. SG: FIDReC - mediate $0, adjudicate S$50, ceiling S$150k, within 6 months of the bank's "final reply". VN: the SBV has supervisory authority; the Competition and Consumer Protection Authority (Ministry of Industry and Trade) handles B2C matters; civil court is the last resort - expensive and slow.

6. Understand the real limits - OTP-authenticated transactions are very hard to win in VN/SG

   This is the part rarely said out loud. If a transaction was successfully authenticated by OTP/biometric, banks in VN/SG default to saying "no fault on our end," and courts usually agree. Filing a VCR Fraud (10.x) chargeback in these cases has a <20% chance of success. Focus on the two genuinely plausible avenues instead: (a) a merchant-side issue (non-delivery/defective), (b) a processing error (duplicate/wrong amount). Avoid betting on "proving malware was involved" - the burden of proof is heavy and the outcome uncertain.

VIII. Four Closing Lessons