Visa Compelling Evidence 3.0: Merchant Guide to Beating Friendly Fraud (2026)
How Visa Compelling Evidence 3.0 works: the two-prior-transaction rule, the 120–365 day window, which data points must match, and how to build a CE 3.0 response for reason code 10.4.
Visa Compelling Evidence 3.0 (CE 3.0) lets a merchant defeat a "fraud" chargeback by proving the same cardholder has bought from them before without complaint. If you can show two earlier, undisputed transactions on the same card that share key identifying data with the disputed one, liability shifts back to the card issuer and the dispute is blocked.
Visa introduced CE 3.0 in April 2023 to address first-party misuse — better known as friendly fraud, where a real cardholder disputes a purchase they actually made. This guide explains the rules in plain English, what data you need to collect, and how to build a response that qualifies.
What problem CE 3.0 solves
Before CE 3.0, a cardholder could claim "I didn't authorize this" and the merchant had to prove a negative. Delivery confirmation alone often wasn't enough, because a fraudster can ship to a real address too. Merchants lost cases they knew were legitimate.
CE 3.0 changes the question. Instead of proving this specific purchase was authorized, you prove a pattern: the same person, using the same card, from the same device or IP address, has bought from you before and never disputed it. That pattern is strong evidence the disputed purchase was genuine too.
Which disputes qualify
CE 3.0 applies only to Visa reason code 10.4 — Other Fraud: Card-Absent Environment. That is the code issuers use for online, phone and other card-not-present "I didn't make this purchase" claims.
It does not apply to:
- "Item not received" (13.1) or "not as described" (13.3) disputes — those are fought with delivery and product evidence. See chargeback reason codes.
- Card-present transactions.
- Mastercard, American Express or other networks, which have their own rules.
The core requirements
To qualify, you must identify at least two prior transactions that meet all of the following:
| Requirement | Detail |
|---|---|
| Same card | Prior transactions used the same payment credential (PAN) as the disputed one |
| Time window | Prior transactions were processed between 120 and 365 days before the dispute was initiated |
| Undisputed | Neither prior transaction has a fraud report (TC40) or a dispute filed against it |
| Matching data | Each prior transaction shares at least two data elements with the disputed transaction |
| Required element | At least one of the matching elements must be the IP address or device ID/fingerprint |
The data elements Visa accepts for matching are:
- IP address of the customer at checkout
- Device ID or device fingerprint
- Shipping address (for physical goods)
- User account ID or login on your site
A typical qualifying match: the disputed order and two orders from five and nine months earlier all came from the same customer account and the same device ID.
Why the 120–365 day window matters
The window is the detail that trips merchants up most. Orders younger than 120 days don't count — Visa wants history that predates any plausible fraud spree. Orders older than 365 days don't count either. A loyal customer who orders every week will usually qualify easily; a customer who orders once a year may fall outside the window.
The window is measured from the date the dispute is initiated, not from the disputed order date, so check it at response time.
What you need to store now
CE 3.0 only works if you captured the data at the time of the original orders. You cannot reconstruct an IP address a year later. Make sure your checkout and order records store, for every transaction:
1. Customer IP address 2. A device ID or fingerprint from your fraud tool or processor 3. Customer account ID (logged-in users) 4. Shipping address 5. Card fingerprint or last four digits plus expiry, so you can match the same card 6. Order date and status, including any refunds or disputes
Many processors capture some of this automatically. Stripe, for example, stores card fingerprints and can record IP data through Radar — see the Stripe dispute evidence checklist. Retention matters: keep this data for at least 13 months, in line with your privacy policy.
How CE 3.0 plays out in practice
There are two points where CE 3.0 data can stop a dispute:
Pre-dispute. Through Visa's pre-dispute tools (Order Insight, operated by Verifi), an issuer can request transaction data before a dispute is filed. If you return qualifying CE 3.0 history, the dispute can be prevented outright — no chargeback fee and no hit to your chargeback ratio.
Dispute response. If the chargeback has already been filed, you submit the CE 3.0 data as part of your representment. When the evidence qualifies, liability shifts to the issuer.
Building a CE 3.0 response, step by step
1. Confirm the reason code is 10.4. If not, CE 3.0 is the wrong tool. 2. Search order history for the same card used 120–365 days before the dispute date. 3. Exclude any prior orders that were refunded as fraud, disputed, or reported as fraud. 4. Compare data elements for each candidate. Keep only orders matching on two or more elements, including IP or device ID. 5. Pick your two strongest matches. More matching elements make a clearer case. 6. Document each transaction — dates, amounts, order IDs and the matching values — in a simple table. 7. Add supporting context: a description of the goods, delivery confirmation for the disputed order, and any customer communications. 8. Submit before the deadline. Visa response windows are short; see chargeback time limits.
Common mistakes
- Matching on shipping address alone. At least one match must be IP address or device ID.
- Counting orders outside the window. A purchase from 90 days ago doesn't qualify, however similar it looks.
- Including disputed history. One prior dispute on a candidate order disqualifies it.
- Not storing device data. If your checkout never captured device IDs, you're relying entirely on IP addresses, which change.
- Using CE 3.0 for the wrong reason code. It won't help with "not received" or "not as described" claims.
Where RecovraFlow fits
RecovraFlow syncs disputes from Stripe and PayPal, keeps your evidence files with each case, and drafts a rebuttal letter with AI from the dispute details and evidence you provide. If you add your CE 3.0 transaction history to the case, the draft will reference it alongside delivery and communication evidence, and you review everything before it's submitted. Matching prior transactions depends on the order data your store and processor hold, so storing IP and device data at checkout is the step that makes CE 3.0 possible. See how it works in automated chargeback management.
Frequently asked questions
When did Visa Compelling Evidence 3.0 take effect?
Visa's CE 3.0 rules took effect on April 15, 2023, and remain the current framework for fighting first-party misuse on reason code 10.4.
Does CE 3.0 guarantee I win the dispute?
When the evidence fully meets Visa's criteria, liability shifts to the issuer. Incomplete or non-qualifying evidence is judged like any other representment, so outcomes aren't guaranteed.
Can I use refunded orders as prior transactions?
Orders that were disputed or reported as fraud don't count. Ordinary customer refunds are a grey area — use clearly undisputed orders whenever you can.
Does CE 3.0 apply to subscriptions?
Yes, if the dispute is coded 10.4. Recurring billing often creates plenty of history from the same card and account, which makes subscriptions good candidates.
Does Mastercard have an equivalent?
Mastercard has its own first-party trust rules and evidence requirements. CE 3.0 itself is Visa-only.
The bottom line
Visa Compelling Evidence 3.0 is the strongest tool merchants have against friendly fraud on card-not-present orders, but it rewards preparation. Capture IP address, device ID and account data on every order today, and you'll have the history to shift liability back to the issuer when a loyal customer later claims "it wasn't me."
