Applies to
Visa 10.4 onlyIntroduced
April 2023Prior transactions required
2 minimumWindow
120–365 days before disputeEffect
Shifts liability to issuerVisa Compelling Evidence 3.0 (CE 3.0): The Merchant's Guide to Winning 10.4 Disputes
Compelling Evidence 3.0 is the most significant rule change for merchants disputing Visa 10.4 fraud chargebacks in years. If you're not using it, you're leaving wins on the table.
What is Compelling Evidence 3.0?
Before April 2023, if a cardholder filed a Visa 10.4 fraud dispute and you didn't have 3DS authentication, you had almost no path to winning. The cardholder's claim of "I didn't authorise this" was essentially unchallengeable without an authentication result.
Compelling Evidence 3.0 changed that. Visa introduced a mechanism that allows merchants to shift chargeback liability back to the issuing bank — even in the absence of 3DS authentication — if they can prove the cardholder had a prior relationship with the merchant through non-disputed transactions. The logic is: if this cardholder successfully completed multiple purchases with you before, and those purchases were never disputed, then the claim that they had no connection to your store is undermined.
Which Disputes CE 3.0 Applies To
This is exclusively for Visa 10.4
CE 3.0 applies only to Visa reason code 10.4 (Other Fraud — Card-absent Environment). If you received a different reason code, CE 3.0 is not available. See the relevant reason code guide instead.
CE 3.0 does not apply to:
- ✗Visa 13.x consumer disputes (goods not received, not as described, etc.)
- ✗Mastercard, Amex, or Discover disputes
- ✗Any dispute other than Visa 10.4
The 5 CE 3.0 Requirements
- 1
At least 2 prior undisputed transactions
You must identify a minimum of two transactions with this same cardholder — or from the same device or IP address — that were completed successfully and were never disputed as fraud. One prior transaction is not enough.
- 2
Transactions within the 120–365 day window
The prior transactions must have occurred between 120 and 365 days before the dispute date. Transactions less than 120 days old don't qualify (too recent to establish a pattern). Transactions older than 365 days don't qualify (too stale). The window is specific and you must verify the dates.
- 3
Shared data elements
Each prior transaction must share at least 2 of the following data elements with the disputed transaction:
- ✓IP address
- ✓Device ID
- ✓Device fingerprint
- ✓Email address
- ✓Shipping address (full address, not just city)
The more data elements that match, the stronger the case. Matching just IP address alone on two transactions is weaker than matching IP address AND device fingerprint.
- 4
Prior transactions must not have been reported as fraud
None of the qualifying prior transactions can have been reported as fraudulent — either by you (through your fraud prevention system) or by the card network. If a prior transaction was later disputed or flagged as fraud, it cannot be used as CE 3.0 evidence.
- 5
The disputed transaction must match
The disputed transaction itself must match at least one data element from the prior transactions. You can't use completely unrelated historical transactions to build a CE 3.0 case for a new device and IP address that has no overlap with the prior orders.
What Data You Need to Start Collecting Now
CE 3.0 evidence can only be built from data you already have. You cannot retroactively collect device fingerprints or IP addresses from past transactions if you didn't log them at the time. The time to act is now — every transaction you process without capturing this data is a missed opportunity.
Data to log for every transaction:
- ✓IP address at time of checkout
- ✓Device fingerprint (a hash of device characteristics — browser, OS, screen resolution, etc.)
- ✓Device ID (if your platform supports it)
- ✓Email address used at checkout
- ✓Full shipping address
- ✓Transaction timestamp
- ✓Dispute status (log whether each transaction was ever disputed)
Where to get this data:
- Shopify: Logs IP address and has built-in fraud analysis — check the order detail page. Device fingerprints require a third-party app.
- Stripe: Logs IP address in Radar data. Device fingerprints available through Stripe Radar rules.
- WooCommerce + Stripe: Similar to above — IP from Stripe dashboard, device fingerprint from Radar.
- Third-party fraud tools (Sift, Signifyd, Kount): These log full device fingerprints and IP history, and some can generate CE 3.0 reports directly.
Store this data for at least 400 days (to cover the full 365-day qualifying window plus buffer).
How CE 3.0 Evidence Changes the Outcome
When CE 3.0 is successfully invoked, Visa shifts the chargeback to the issuing bank. This means the dispute is removed from your chargeback count — it doesn't count against your VAMP ratio. This is particularly valuable for merchants who are close to the 0.9% threshold, where exceeding it triggers Visa's monitoring programme and its associated penalties and fees.
When submitting your dispute response, the prior transaction data should be presented as a structured report, not as ad-hoc notes. For each qualifying prior transaction, include: transaction date, amount, IP address, device fingerprint or device ID, email address, and shipping address. Many processors have a dedicated CE 3.0 submission field — use it rather than burying the data in a general notes section. Label this as an exhibit in your rebuttal letter and reference it explicitly.
If Visa or the issuer doesn't accept the CE 3.0 claim — typically because the data elements don't meet the 2-element match requirement or the transactions fall outside the window — the dispute proceeds as a standard 10.4. You don't lose anything extra. The CE 3.0 submission forms part of your overall evidence package, so including it costs you nothing when the data is solid.
CE 3.0 Step-by-Step Submission Checklist
- 1Confirm the reason code is Visa 10.4 — CE 3.0 only applies here
- 2Pull your transaction history for this cardholder/device/IP going back 365 days
- 3Identify 2+ non-disputed transactions within the 120–365 day window
- 4Verify each prior transaction shares at least 2 data elements with the disputed transaction
- 5Confirm none of the prior transactions were ever disputed or fraud-flagged
- 6Compile the prior transaction data into a structured report: date, amount, IP, device fingerprint, email, shipping address
- 7Include this report as Exhibit A in your rebuttal letter, alongside your standard 10.4 evidence
- 8State in the letter that you are invoking CE 3.0 and reference the exhibit
Frequently asked questions
What is Visa Compelling Evidence 3.0?
CE 3.0 is a Visa rule introduced in April 2023 that allows merchants to dispute 10.4 fraud chargebacks by proving the cardholder had prior non-disputed transactions with the same device or IP address. When accepted, it shifts the chargeback liability back to the issuing bank.
Does CE 3.0 work for Mastercard or Amex disputes?
No. CE 3.0 is a Visa-only mechanism and applies exclusively to Visa reason code 10.4. Mastercard and American Express do not have an equivalent programme, though prior transaction history can still be used as supporting evidence in those disputes.
What if I don't have device fingerprint data?
CE 3.0 requires at least 2 shared data elements per prior transaction. If you don't have device fingerprints, you can use IP address combined with email address or shipping address as your 2 elements. However, IP addresses alone are weaker because they can be dynamic. Start collecting device fingerprints through your payment processor or a fraud tool immediately.
How many prior transactions do I need for CE 3.0?
A minimum of 2 prior undisputed transactions, each within the 120–365 day window before the dispute date, each sharing at least 2 data elements with the disputed transaction. More qualifying transactions strengthen the case, but 2 is the minimum.
Related guides
Dealing with a Visa 10.4 chargeback?
Generate a CE 3.0 dispute response in minutes, or let ChargeMate handle your 10.4 disputes end to end.
3 free generations included · No credit card required