Visa Compelling Evidence 3.0 (CE 3.0)
explained.

Why CE 3.0 exists

Visa describes first-party misuse as cardholders reporting fraud on transactions they actually authorized. CE 3.0, effective for disputes submitted on or after 15 April 2023, makes a 10.4 dispute invalid when the merchant can show the cardholder participated, using their own purchase history with you.

The qualifying criteria (Visa's acquirer FAQ)

• Reason code: Visa 10.4, Other Fraud: Card-Absent Environment. See the Visa 10.4 guide.
• Two prior undisputed transactions on the same payment credential, processed 120 to 364 days before the dispute processing date. Visa matches on the underlying card number, so tokenized transactions count if the underlying card is the same.
• At least two matching data elements between the disputed transaction and the prior ones, from: customer account or login ID, delivery address, device ID or device fingerprint, and IP address.
• At least one of the two matches must be device ID, device fingerprint or IP address. Account plus delivery address alone does not qualify.
• Item description of the purchase is mandatory.
• No fraud on the prior transactions. Visa's FAQ says a prior transaction with a non-fraud dispute can still be used; only prior transactions with fraud activity are excluded.
• Outcome: issuer liability.

How Stripe implements it

Stripe's documentation describes the same idea with its own fields: the prior charges must be paid, undisputed, not validation charges, and within 120 to 364 days of the disputed transaction; you must categorize the purchase as merchandise or services and describe the products. Stripe groups IP address and device fingerprint or ID as main elements and shipping address, email and customer account ID as secondary ones, requiring two main elements or one main plus one secondary (a device fingerprint plus a device ID does not count as two). All prior transactions must have been processed on Stripe.

When CE 3.0 can be used

Visa's FAQ describes two paths: in the pre-dispute phase through Verifi Order Insight, in real time before the dispute is created, or in the post-dispute pre-arbitration response through your acquirer. Processors such as Stripe expose it as enhanced evidence on the dispute itself.

Visa continues to adjust the program. Its Merchant Business News Digest lists, for the US, automatic qualification of transactions for CE 3.0 through Visa Secure from 17 October 2025 and a fee for successful qualifications from 17 April 2026. Check with your acquirer for the rules that apply to you today.

A worked example

A customer buys a $95 jacket in March and a $60 sweater in June from the same browser and home IP, logged into the same store account, shipping to the same address. In November they report a $140 order as fraud under 10.4. The March order is 240 days old and the June order 150 days old: both inside 120 to 364. Each shares IP address and account ID with the disputed order, so each has two matching elements including IP. The case qualifies. If the June order had been placed only 90 days earlier, it would be too recent, and with only one other prior order the case would not qualify.

Subscriptions and recurring billing

Visa's FAQ says CE 3.0 is available for recurring transactions, and the IP address from the initial customer-initiated transaction can be used for later merchant-initiated charges. It also notes subscription disputes are often filed as cancelled recurring, not 10.4, and annual plans with no other charges in the window will not qualify.

Common mistakes

• Not capturing IP or device data at checkout. Without it no prior order can qualify, however loyal the customer.
• Inconsistent descriptors. Visa's FAQ advises keeping descriptors consistent (keep the leftmost characters the same) so transactions match. See merchant descriptor.
• Using it for the wrong reason code. CE 3.0 is a 10.4 remedy only.
• Relying on CE 3.0 alone. Stripe recommends also filling the standard evidence in case the CE 3.0 submission is not accepted.

How Verdikx helps

Verdikx is a fraud, chargeback and dispute platform for e-commerce and SaaS merchants, made by Verdikx LLC. Verdikx supports Visa CE 3.0 where prior orders qualify. Its qualifier applies the rule conservatively: at least two prior undisputed, not fraud-reported transactions 120 to 364 days before the dispute, each sharing two or more of IP address, device ID, shipping address and customer account ID with the disputed order, at least one of them IP or device, and on the same card where the processor can tell. For Stripe disputes on Growth and Pro, Verdikx builds Stripe's enhanced evidence only when Stripe marks the dispute eligible and two prior charges on the same card fingerprint qualify. For Shopify orders, Verdikx captures the checkout IP, customer account and a hashed shipping address from new orders after you connect, so qualifying history builds over time. When there is not enough history, the packet says so instead of guessing. See friendly fraud.