Visa Compelling Evidence 3.0 (CE3.0) lets a merchant answer a card-absent fraud chargeback with proof from the customer’s earlier purchases. If you can show two undisputed transactions from the same cardholder, between 120 and 365 days before the disputed one, and key data points match, liability can shift back to the issuer. It applies to one dispute code, Visa 10.4 (Other Fraud, Card-Absent Environment), and it is a remedy, not a guarantee.

This guide explains what qualifies, how to assemble the data, where merchants fail, and what to do before a dispute ever reaches Visa’s system.

Davincipay
Strengthen Your Dispute Response
DavinciPay supports online merchants with chargeback mitigation, fraud prevention tools, and payment processing for complex ecommerce businesses.
Explore payment solutions

TL;DR

  • CE3.0 covers Visa dispute condition 10.4 (Other Fraud, Card-Absent Environment) only. It does nothing for “item not received” or quality disputes.
  • You need two prior undisputed transactions dated 120 to 365 days before the disputed one, neither reported as fraud.
  • At least two core data elements must match (user ID, IP address, shipping address, device ID or fingerprint), and one must be the IP address or device fingerprint.
  • Acquirers often get one shot at the submission. Collect and verify data before you respond, not after.
  • The best use of CE3.0 is upstream: capture the data at checkout, share it in real time, and stop disputes from forming.

Table of Contents

What CE3.0 actually is

Friendly fraud, also called first-party misuse, happens when a cardholder disputes a purchase they made or authorized. They say “I didn’t make this charge,” and the issuer files a 10.4 dispute. Under older rules, merchants could rebut with one earlier transaction, and the matching requirements were rigid.

Visa’s CE3.0 update took effect on April 15, 2023. It lets the acquirer remedy the dispute using a historical footprint of the customer: prior purchases made with the same credentials, device or login pattern. When the data meets the criteria, liability shifts back to the issuer and, ultimately, to the responsible party.

As of October 2026, Visa’s published rules describe the remedy as expanded, including support for multi-merchant transaction data as evidence. Check the current rules with your acquirer before you rely on cross-merchant data, because eligibility details can change.

The qualification criteria, step by step

Visa’s merchant readiness guide and rules set out the test. Here is how to read it.

  1. Find two prior transactions. They must be undisputed and never reported as fraud. They cannot carry an active fraud dispute.
  2. Check the dates. Each must have processed more than 120 days and fewer than 365 days before the disputed transaction. The 120-day floor exists so a fraudster cannot seed a fake history just before the attack. Visa’s readiness guide notes the 120 days does not apply to original credit transactions.
  3. Match the data. At least two core elements must match between the earlier transactions and the disputed one: user ID, IP address, shipping address, or device ID/fingerprint. One of the two matches must be the IP address or the device ID/fingerprint.
  4. Confirm the merchant. Readiness materials describe transactions from the same merchant. Multi-merchant data is a newer extension, so confirm how your acquirer supports it.
  5. Submit through your acquirer. The data goes in the pre-arbitration response in VROL, Visa’s dispute system, or earlier through a pre-dispute service.

A worked example

A customer buys a 90-day supply of a supplement on March 3 from a laptop and ships it to their home. They reorder on June 20 from the same laptop and address. On November 10 a third order is placed, and the cardholder tells the bank they never made it.

The March 3 order is 252 days before November 10. The June 20 order is 143 days before. Both fall inside the 120 to 365 day window. If neither was disputed, and the IP address or device fingerprint plus the shipping address match across all three, you have a qualifying submission.

Change one fact. If the June 20 order was 90 days before, it falls outside the window and does not count. This is why date math should be automated, not eyeballed.

A worked example — overview diagram

What CE3.0 does not do

Most failed submissions come from expecting CE3.0 to do more than it does.

  • It only addresses 10.4. Practitioners stress that CE3.0 is not a universal fix for friendly fraud. Fraud claims coded differently, and disputes about delivery, quality or subscriptions, need other evidence.
  • It does not guarantee an outcome. Visa’s own FAQs describe it as a liability-shifting initiative. Issuers can still request an exception review if their own evidence suggests the rejection was invalid.
  • It does not make a transaction immune. A qualified transaction can still enter the dispute process if it passes VROL edits. Stay alert for pre-dispute opportunities, especially if you take part in Rapid Dispute Resolution (RDR).
  • It is not a second chance. If the data elements are wrong or incomplete, the system declines the submission and you cannot retry the same CE3.0 remedy on that dispute.

For merchants who want the legal and regulatory angle on card infrastructure and where liability sits when issuers push back, card infrastructure and dispute resolution advisory covers how that framework is structured.

Build the data before you need it

The merchants who win with CE3.0 treat it as a data problem. You cannot reconstruct an IP address or device fingerprint six months later. You have to capture it when the order happens.

What to capture at checkout

Data element Why it matters Common mistake
IP address Strongest match signal, one of two required anchors Logging the proxy or CDN address instead of the customer’s
Device ID / fingerprint The other accepted anchor Rotating or discarding it after the session
Shipping address A match element that is easy to verify Storing it unformatted, so identical addresses look different
User ID / account login Ties repeat orders to one account Guest checkout with no persistent identity

Habits that make submissions work

  • Store the date and status of every order so you can query for undisputed transactions in the 120 to 365 day range.
  • Flag any transaction ever reported as fraud so it is excluded automatically.
  • Normalize addresses before storing them.
  • Encourage accounts over guest checkout. A login history is a durable identity signal, especially for subscription and reorder customers.
  • Keep a log of each submission and its outcome so you can spot patterns by product or channel.

Keep the response focused

Visa’s dispute management guidance favors clarity and direct relevance to the dispute condition over volume. Adding general terms and conditions to a fraud response slows review and can weaken the case.

For a 10.4 dispute, the story is simple: the same person, using the same device or network, bought from us before and was never disputed. Present the two transactions, the matching elements and the dates. Stop there.

Stop disputes earlier with pre-dispute tools

Winning a dispute costs time even when you win. The better outcome is the dispute never being filed.

In April 2026 Visa announced new dispute services, including a Dispute Recovery Manager that uses generative AI to automate representment and score the likelihood of a win. The same announcement describes merchants using CE3.0 within Order Insight to share evidence with banks about suspicious transactions, which can clear up confusion before it becomes a dispute.

Two practical moves follow:

  • Share transaction details in real time. When a cardholder calls the bank and the bank can see the earlier orders and the matching device, many questions end there.
  • Use clear billing descriptors and receipts. Some “fraud” claims are just an unrecognized charge.

Know the consumer side

Your customer’s rights shape how disputes arrive. Under the federal Fair Credit Billing Act, consumers must dispute a billing error in writing within 60 days of the first statement showing it. Issuers must acknowledge within 30 days and resolve within two billing cycles, up to 90 days. That timeline is why your evidence needs to be ready fast, and why you should not assume a dispute window has closed just because a few weeks passed.

FCBA dispute and issuer response timeline

The FTC also publishes a sample dispute letter that shows what cardholders are told to include: the amount, date and an explanation of the error. Knowing what the cardholder’s claim looks like helps you match your response to it.

Our perspective

We work with merchants whose chargeback ratios decide whether they keep a processing account. Supplement brands, telehealth providers and subscription businesses reorder heavily, which makes them well suited to CE3.0. A customer who buys every 30 to 90 days builds exactly the history Visa wants to see.

Here is what we tell merchants.

Treat CE3.0 as infrastructure, not a rescue plan. The merchants who struggle are those scrambling to find an IP address after the dispute arrives. Your gateway, fraud tools and reporting should capture the data from the first order.

Do not use it as a catch-all. It handles 10.4. Pair it with delivery proof, clear subscription disclosures and cancellation records for other dispute types.

Watch your ratios. CE3.0 helps with the dispute you are fighting. Your acquirer and the card networks still look at the overall rate, so prevention matters as much as representment.

We understand how a sudden freeze or reserve increase hurts a growing business. That is why we build processing around specialized underwriting, real-time monitoring and built-in chargeback mitigation tools, so you can scale with fewer surprises.

— Peter

Processing built for high-risk merchants

If your business sells supplements, telehealth services or recurring subscriptions, your processing setup should support the data capture CE3.0 depends on. DavinciPay offers telehealth payment processing and supplements payment processing, with fraud prevention, chargeback mitigation and real-time reporting in the same stack. Ready to talk? Apply now and our team will walk you through underwriting.

A quick readiness checklist

  1. Confirm your gateway stores IP address and device fingerprint for every order.
  2. Confirm your acquirer supports CE3.0 submissions and ask how multi-merchant data is handled.
  3. Build a report that lists undisputed orders 120 to 365 days old, grouped by customer.
  4. Set a rule that excludes any order ever flagged as fraud.
  5. Write a one-page response template for 10.4 disputes: two transactions, matching elements, dates.
  6. Enroll in pre-dispute tools offered by your acquirer and monitor them weekly.
  7. Review outcomes monthly and note which submissions were declined, and why.

FAQ

What is the difference between CE3.0 and the old compelling evidence rule?

The earlier rule relied on a single prior transaction and a rigid set of matching fields. CE3.0 uses two prior undisputed transactions and a defined set of core data elements, with the IP address or device fingerprint required as one match.

Does CE3.0 apply to Mastercard?

No. CE3.0 is a Visa rule. Mastercard has its own dispute framework and evidence requirements, so check with your acquirer for those.

Can I resubmit if my CE3.0 response is declined?

Usually not for the same remedy on that dispute. Visa’s acquirer readiness guidance says incorrect or incomplete data is declined and the same CE3.0 remedy cannot be retried. Verify everything before the first submission.

Does a strong CE3.0 submission mean I always win?

No. It shifts liability when the criteria are met, but issuers can still request an exception review. Treat it as a strong tool, not a certainty.

Which businesses benefit most?

Merchants with repeat customers, such as subscriptions, supplements and telehealth refills, because they naturally build the 120 to 365 day purchase history the rule requires.

Sources