Posted: September 09, 2026 | Updated: September 09, 2026 at 4:17 PM
Buy online, pick up in store shopping has become one of the fastest-growing checkout options in retail. It gives customers speed and convenience, and it gives merchants a way to compete with same-day delivery without the shipping cost.
That convenience comes with a hidden trade-off. A BOPIS order skips most of the verification steps built into home delivery, from a shipping address to a carrier’s proof of delivery. Once the sale moves to the pickup counter, the merchant is often left with the weakest evidence in the entire order lifecycle.
That gap is exactly what BOPIS chargeback exploits. Disputes on pickup orders are climbing as fast as the channel itself, and most retailers are still defending them with fraud tools designed for shipped goods, not for a face-to-face handoff.
A buy online pickup in store (BOPIS) chargeback is a situation where the consumer disputes a BOPIS purchase with their card issuer after the purchase has been made. In these situations, the consumer purchases the item online, but doesn’t receive the item until they pick it up at the store.
The majority of these types of disputes are filed as “item not received.” In a BOPIS situation, this terminology is incorrect, as the item was received. It was simply exchanged at the counter, as opposed to being received through the mail.
The majority of standard e-commerce fraud screening models were created prior to the BOPIS model. These models rely heavily on the comparison of a shipping address and billing address. A BOPIS order does not have a shipping address because, by nature, nothing is shipping.
The lack of one simple piece of data is the reason why pickup orders (BOPIS) are drastically increasing order fulfillment fraud undetected. It also explains why so many merchants only learn of a discrepancy after the dispute notification is sent to the merchants.
Fraud thrives off of convenience, and BOPIS is very convenient. Card-not-present fraud is extremely easy. From the perspective of the fraudster, there is no need to drive to a location and sign for a package. There is no need to even approach a building. All the fraudster needs to do is walk up to a counter, say the name on the order, and take merchandise.
What many loss prevention personnel have long suspected based on their experience has also been proven by many studies. According to fraud prevention analysts, the checkout and fulfillment data for a large number of transactions show that there is a “significantly” more serious attempt at fraud for BOPIS orders.
Source: Fingerprint (fingerprint.com) and Founders Guide, sourcing reported fraud rate attempts for buy-online-pickup-in-store compared to other online order types.
Three examples keep popping up in the reports relating to this issue. In criminal fraud, orders are placed with stolen card details and there is no shipping address, which eliminates a flag. Friendly fraud happens when a customer legitimately buys an item and then disputes the charge. It occurs accidentally or intentionally, after the customer has changed their mind about the item and has decided they do not want to go through with the return. Guest checkout fraud happens when a retailer has no online verification, and at the counter the employee does no verification either, so no verification is done throughout the entire transaction.
There is a fourth pattern, and it also deserves to be included. Internal mistakes, such as when a staff member has given an order to the wrong customer, are charged back. Retailers that use pickup as a fulfillment option are taking on four risks at the same time and do not even realize which of the four have resulted in the loss of revenue.
Pickup shopping is not a convenience any longer. It is now how people shop and this trend will only continue.
Compiled using several industry research estimates, here is an illustrative trend (Capital One Shopping Research; ElectroIQ; Accio Business Research). Figures are estimates and vary by source.
According to analysts, purchases made through Buy Online Pickup In Store (BOPIS) shopping will likely continue to increase through 2026 and possibly beyond. As more purchases move through the same channel, more transactions will be processed with fulfillment models designed around speed and convenience.
Because pickup models are designed around speed and convenience, they are easy to exploit. The growth of a channel that is this easily exploitable, coupled with a lack of adequate controls, will lead to more exposed merchants. Larger pickup volumes mean the cost of ignoring BOPIS fraud will be more painful to merchants who previously ignored it.
Card networks provide a reason code for every dispute a cardholder files. Knowing the reason code allows the merchant to determine the correct course of action to remedy the situation, as providing the wrong evidence can result in the loss of a case that could be won.
Most Visa disputes on pickup orders occur under reason code 13.1: “Merchandise/Services Not Received.” The cardholder says they paid for something and did not receive it.
The acquirer will have a set amount of time, often 30 days, to respond after the issuer files the dispute. The best evidence a merchant can submit is a signed pickup log with a matching photo ID and a time-stamped receipt of the pickup.
Mastercard consolidates dispute chargeback claims under its cardholder dispute chargeback framework, which previously included code 4855 for goods or services not provided, but these are now consolidated under a single code. Mastercard’s chargeback code standard requires that the order was fulfilled as promised.
Lacking a carrier, a tracking number also has no benefit for a BOPIS transaction. Whatever evidence exists is the responsibility of the store, and was captured at the moment the order was transferred.
| Detail | Visa 13.1 | Mastercard 4853/4855 |
| Common claim | Merchandise or service not received | Goods or services not provided |
| Category | Consumer dispute | Cardholder dispute |
| Merchant’s best evidence | Pickup log, ID match, timestamp | Pickup log, ID match, timestamp |
| Weak evidence | Shipping tracking number alone | Shipping tracking number alone |
While fraud prevention measures have improved, most still focus on the checkout phase. Many stores still leave the pickup counters unprotected, which is the last line of defense for the entire transaction.
Photo ID checks for government-issued IDs against the order name can reduce the gap significantly. Staff should check the order number or confirmation email on file. Faking someone’s name is easy, and with a copy of their confirmation email it is even easier.
Some stores conduct additional measures by asking to see the credit card that was used in the original purchase or by sending the customer a temporary code that must be shown at the checkout counter to finalize the order. These measures only take a matter of seconds.
The trade-off is real and should be addressed. Measures that increase checks also increase wait times for legitimate customers who want to get their bag and go. Balanced check measures apply increased checks to high-risk orders (i.e., brand new accounts, large order amounts) while decreasing checks for low-risk orders (i.e., prior order history, repeated orders).
A chargeback really is a paperwork battle first and foremost. The party with the better paper trail will most often win, even if they told a worse version of the story, when the paperwork is the final argument.
Every pickup should yield a log entry with a timestamp. This log entry should include the staff member, the type of ID checked, and a digital signature or a physical signature of the customer confirming that they received their order in a good state. Evidence tied to the transaction, even a webcam photo, is evidence that is very difficult for a cardholder to refute when providing a dispute review.
This record should be maintained as long as the chargeback window is active. Both Visa and Mastercard give the issuers a few months, not a few days, to dispute a purchase after it was made. A “pickup” log that is set to auto-delete after 30 days, is typically long gone when it is needed to defend a claim.
Curbside pickup and third-party pickup apps both introduce the same issue for retailers. An unverified customer never even goes inside the store, meaning the handoff is the only point of verification.
Curbside pickup orders should require the customer to verify their order over the phone or through the app before an employee brings the order to a vehicle. Third-party pickup orders require the delivery platform to verify the order, which should be separate from the check the store does for an in-person pickup. A lot of retailers treat curbside pickup orders the same as in-store pickup orders and this is a costly mistake. The controls designed for verification for in-store pickup orders rarely work for curbside or app-based pickup orders.
Curbside pickup orders also give fraud opportunities that are compounded when placed during the holiday shopping season. A misread license plate or a passenger picking up an order for another customer increases opportunities for fraud. This leads many retailers to release unverified pickup orders. Retailers typically lose controls that ensure a customer has verified an order when an employee brings it to the customer during peak shopping periods.
Not all disputes lead to a chargeback. Some alerts from card networks and third-party services flag a transaction as disputed before it becomes a chargeback. These alerts give merchants a short time to process a refund or provide evidence.
In the case of BOPIS, or buy online, pick up in store, these alert services are most effective when combined with screening of orders initiated at the time of checkout. One of the more effective signals is order velocity, or rapid placing of pickup orders by an account or a device. A new account placing several high-value pickup orders in a short time frame is very different from an account which is a member of the loyalty program and is making a normal grocery store pick up order. Screening tools can apply very different levels of friction to these orders.
None of what was described displaces the counter-level ID check. It only focuses the major efforts of the merchant on the orders which require the highest level of scrutiny before the customer gets to the pick up location.
Closing these gaps is more effective for reducing BOPIS chargebacks than an expensive, complex technology solution. Building a guest checkout option for pickup orders exposes the merchant to the risk of a chargeback because the customer does not need to supply a verifiable phone number or email address. Merchants have nothing to verify the legitimacy of the dispute should one arise.
Requiring a photo ID at the counter that matches the name on the order prior to release of the merchandise protects the merchandise from being stolen. A documented receipt of each transaction that includes the staff initials and the customer’s signature turns a “he said, she said” dispute into a valuable piece of evidence that can be reviewed by the bank. Merchandise should be held until pick-up verification is complete, and orders should be screened for high risk prior to releasing the merchandise.
While none of these methods will eliminate the BOPIS chargeback, the combination of these will eliminate most of the attractive features of pickup orders to the fraudster.
BOPIS (buy online pick up in store) chargebacks occur for a single reason. Home delivery contains controls and checks that build trust automatically without having to think about it. BOPIS lacks several of these control mechanisms.
There is no delivery address to enter and check for a possible mismatch. There is no proof of delivery with a carrier’s tracking number. The only evidence that merchants typically have is the physical evidence captured at the moment of delivery to the customer.
Consequently, two things need to happen simultaneously—controls need to be added to both checkout and to pickup. The control mechanisms at checkout need to incorporate more ID verification and controls, and at pickup, verification needs to be more than just a name with a smile (even a friendly one), from a store staff. Incorporating both controls consistently has led to greater success in reducing disputes and increasing the percentage of chargeback disputes won by merchants.
The merchants who act as if each pickup is an in-person, card-present sale have measurably protected their revenues. Those who continue to act as if pickup is an afterthought will continue to fund that choice one chargeback at a time.
First of all, they both use the same reason code. A BOPIS chargeback does not have a shipping carrier to prove delivery, which means the merchant has to use the records of the in-store pickup.
Visa tends to use reason code 13.1. Meanwhile, Mastercard consolidated its former code 4855 into cardholder dispute code 4853.
Yes. Checking a government-issued ID against the name on the order prevents the ordered item from being released to an individual using a stolen credit card (a common method of BOPIS fraud).
A log with the time of the order, initials of the staff member, the ID checked, and a signature or digital agreement to the terms and conditions of the order. This is usually the strongest evidence in a dispute.
