Posted by the FileFreight team. We build a flat-rate delivery tool for digital sellers: secure download links, per-buyer PDF stamping, and license keys. This is a practical guide to dispute evidence for downloads — including the parts where the evidence runs out. It is general information, not legal advice.
A chargeback on a physical product has a simple answer: a tracking number. A chargeback on a digital download has no box, no carrier, and no signature — so many sellers assume it's unwinnable and don't respond at all.
That's a mistake. Downloads leave a different paper trail: timestamps, download events, and license activity. Used honestly, that trail wins some disputes and loses others. Here's what each piece actually proves.
What a dispute is really asking
When a buyer disputes a charge with their bank, your processor (Stripe, PayPal, or your merchant-of-record platform) asks for compelling evidence the buyer got what they paid for. For digital goods, that generally means showing three things: a real order (who, what, when, how much), delivery (the product made available to that buyer after payment), and use or acceptance (any signal the buyer accessed it). A single screenshot rarely covers all three; a small bundle of boring records, kept per order, does.
The records that help — and their limits
Order and payment records. The invoice, buyer email, product, price, and payment timestamp. This proves a transaction existed and what it was for — not delivery: an unfulfilled paid order looks identical at this layer.
Timestamped delivery. A record that a download link was sent to the buyer's email at a specific time after payment. This proves delivery was initiated to the address the buyer themselves provided. It does not prove they opened the email — spam folders and abandoned inboxes are real, and banks know it.
Download events. A log line showing the file was actually downloaded — when, how many times, and often the IP address and device/browser that fetched it. This is stronger: something at that address retrieved the file. But be honest about the ceiling: an IP address is a network, not a person. It doesn't prove the cardholder personally downloaded it (shared households, work networks, and VPNs all blur this), and it says nothing about whether the product was any good.
License validation events. If your product activates, each validation check is a dated signal: this key, issued for this order, was used at this time. Repeated activations over days or weeks are among the most persuasive evidence a download seller can present — it's hard to argue "I never received it" about a product that kept checking in. The limit: validation proves the key was used, not by whom, and it only exists if your product phones home.
Per-buyer stamping. If a PDF is stamped with the buyer's identity at download, a copy carries its origin with it. In a dispute, that stamped copy is concrete evidence the file was personalized for — and reached — that buyer. It proves provenance, not satisfaction with the contents.
Your terms, shown before purchase. A refund policy and license terms visible at checkout, plus any record the buyer accepted them. This doesn't prove delivery, but it answers the other common dispute reason — "not as described" — by showing what was promised.
What no log can prove
- Quality. Logs prove access, not that the product was good, complete, or as described. A separate, accurate product page and description carry that argument.
- Identity, conclusively. Email + IP + timestamps make a strong circumstantial case. They are not a fingerprint, and a bank can still side with its customer.
- A guaranteed win. Evidence improves your odds, especially against "product not received" claims where a download demonstrably happened. "Friendly fraud" — a buyer who got the product and disputes anyway — is sometimes still lost. Anyone who promises otherwise is selling something.
Keep the records before you need them
Disputes arrive weeks or months after the sale, so the time to build your evidence bundle is at delivery, not when the dispute email lands:
- Keep records per order, tied together — order, delivery timestamp, download events, and license activity, all findable from one order ID or buyer email.
- Keep them longer than feels necessary. Chargeback windows commonly run around 120 days from purchase, sometimes longer. Deleting delivery records at 30 days is deleting your defense.
- Don't let a platform be your only copy. If your records live only inside a tool you later leave — or that closes your account — your evidence leaves with it. Export periodically.
- Revoke on refund, automatically if you can. A refunded buyer who keeps working access undermines your policy and your credibility in the next dispute.
Where FileFreight fits — stated plainly
FileFreight's model is relevant here for one structural reason: payments run through your own Stripe account, so a chargeback is your dispute to answer in your own Stripe dashboard, with your own evidence — the money was never sitting in our account.
What FileFreight itself provides, per our homepage: each buyer gets a unique, tokenized download link, with per-product download limits and link expiry you set — so a delivery is tied to one buyer, not a public URL. PDFs are stamped with the buyer's identity on first download, so a disputed copy traces back to its source. If you enable license keys, a key is issued with every paid order, your software validates keys with one API call (POST /api/licenses/validate), and you can revoke any key at any time. When Stripe reports a refund, entitlement and keys are revoked automatically.
One honest limit: FileFreight is a delivery tool, not a dispute-resolution service. We don't fight chargebacks for you, and we won't claim features our homepage doesn't state.
The caveats, in the open
- FileFreight is not a merchant of record. You handle your own sales tax and VAT. MoR platforms handle that for you — and, in exchange, they also control the dispute process.
- No automatic importer yet. The first 20 sellers get a free white-glove migration — products, files, and license keys rebuilt by hand within 48 hours.
- Not a Shopify app. Every product gets a standalone buy link you can paste anywhere.
- Delivery only. No marketplace and no discovery — you bring your own buyers.
The short version
You can't tracking-number a download. But a timestamped delivery record, a download event, a license that kept validating, and a PDF stamped with the buyer's own name add up to a real answer to "I never got it." Keep those records per order, keep them for months, and keep expectations honest: evidence wins disputes about delivery. It was never going to win the ones that aren't.
FileFreight is $19/month flat on Pro with 0% per-sale fees (free plan: $0 + 5% per sale): getfilefreight.com.
Top comments (0)