Compelling Evidence 3.0: What It Covers and What It Does Not

The table gives the short answers and the Visa document each comes from. Where Visa's documents word a test differently, the section below says so.

Two of the sources are guidance and one is the rule text. Visa's guide and FAQ both state that the Visa Rules prevail if there is any difference.

Visa's merchant FAQ, dated March 2023, explains the purpose. First-party misuse occurs when cardholders report fraud on transactions they authorized. To address it, and to rebalance the cost between issuers and merchants, Visa updated the rule for condition 10.4 with effect for responses processed on or after 15 April 2023. In the FAQ's words, the updated rule invalidates a dispute if the evidence supports that the cardholder, or an authorized person, participated in the transaction.

The dispute guide describes the method. Traditional fraud responses focus on the disputed transaction. CE3.0 may consider historical transaction information and identifying data that show a pattern of prior interaction between the cardholder and the business. The guide says the evaluation focuses on historical patterns and consistent identifying information, and does not turn on proving the cardholder's intent.

The name has a history. Visa's rules already allowed compelling evidence, meaning documents that help show the cardholder took part in or benefited from a transaction. The guide describes that general category as an opportunity to respond that is neither a remedy nor a guarantee. CE3.0 is the more structured version for condition 10.4.

The FAQ lists the mandatory fields: an item description, and at least two of four identifiers that are the same in the disputed and undisputed transactions. The four are the customer account or login ID, the delivery address, the device ID or device fingerprint, and the IP address. One of the two must be the device ID, the device fingerprint or the IP address.

On timing, Visa's documents agree on the 120 days and differ slightly on the 365. The FAQ says two transactions 120 to 365 days prior to the dispute processing date. The Visa Rules refer to two previous transactions processed more than 120 calendar days earlier, not to exceed 365 calendar days prior to the processing date of the dispute. The October 2026 guide says the prior transactions must generally have been processed within 365 calendar days before the disputed transaction and more than 120 calendar days before the dispute was submitted. Your acquirer applies the rule text.

A prior transaction with a fraud report cannot be used. The FAQ adds that a prior transaction with a non-fraud dispute would still qualify, and the guide says refunded or credited transactions that were not disputed may still be considered. Visa uses the underlying card number to pair merchant and cardholder, so a tokenized transaction counts when the underlying number is the same.

The pre-dispute route runs through Order Insight, a Verifi service. The guide explains that participating issuers can request transaction details when a cardholder questions a charge and no dispute has yet been reported to Visa. If the merchant returns qualifying CE3.0 information at that point, the guide says it may help resolve the inquiry without a dispute being initiated.

The post-dispute route is the response. The FAQ calls this the pre-arbitration response process, delivered through the merchant's acquirer. The merchant picks prior transactions that meet the criteria, and the FAQ advises choosing the most recent ones that fit the time frames.

The timing affects more than the single case. Visa's fact sheet for its acquirer monitoring program says the monitoring ratio excludes fraud reports qualified for Compelling Evidence 3.0, depending on when the data is extracted. A qualifying response therefore bears on a merchant's ratio as well as on the disputed amount.

The FAQ answers the first part directly. CE3.0 is available for recurring transactions. For subscription merchants processing recurring merchant-initiated transactions, the IP address from the first customer-initiated transaction can be populated for the later merchant-initiated transaction that is being used as evidence.

The same FAQ states both limits. On history, if the merchant does not have multiple transactions for the cardholder within 365 days, the rule will not be supported, which rules out an annual plan with one charge a year. On classification, the FAQ notes that subscription disputes are often classified as cancelled recurring and not as condition 10.4.

The 120-day test produces a gap at the start of a monthly plan. Take a customer charged on day 0 and day 30. Both charges are more than 120 days old only from about day 151. A fraud dispute raised in the first five months has no two qualifying prior transactions, unless the customer made earlier one-off purchases on the same card. This is arithmetic from Visa's criteria, and your acquirer can confirm how the dates are measured.

The guide lists the weak cases in general terms. CE3.0 is less likely to apply to a first-time purchase, to a customer with limited or no history, or to a guest checkout, where no account or login ties the purchases together.

Condition 13.2, cancelled recurring transaction, is a claim that the merchant kept charging after the cardholder cancelled. The guide says a response there depends on showing the cancellation request date, the effective cancellation date and, where relevant, use of the service. Prior undisputed charges do not answer that claim.

Condition 13.5, misrepresentation, covers a cardholder who says they were misled about the terms. Visa's rules extend it to a card-absent purchase made through a trial or introductory offer where the cardholder was not clearly advised of further transactions. The guide says the question there is whether the information presented before the purchase was clear, accurate and complete.

For those disputes the general compelling evidence category still exists. The guide's examples for subscriptions and recurring payments are a valid contract, proof of usage and a previous undisputed charge. For digital goods it lists IP address, device ID, the name and email linked to the customer profile, and evidence that the site or app was accessed on or after the transaction date.

Misuse of the rule carries a penalty. The Visa Rules say that if Visa determines a merchant is falsifying the data submitted to gain protection, the merchant loses the ability to use the remedy until the acquirer or merchant confirms in writing that the activity has been corrected.

The October 2026 edition of Visa's guide keeps the structure of the 2023 FAQ: condition 10.4 only, two prior transactions, the 120 and 365 day tests, and matching device or IP data plus another identifier. It adds a set of questions and answers, including that an email address or phone number counts as an account identifier only if the merchant uses it to authenticate the cardholder.

Chargebacks911, a dispute vendor, reports that from 18 April 2026 the rule also covers fraud reports that were not disputed. Visa's fact sheet for its monitoring program, dated 2025, already lists fraud reports qualified for CE3.0 as an exclusion from the ratio. We did not find a Visa document describing an April 2026 change, so treat the vendor's account as unconfirmed.

Mastercard's counterpart is the First-Party Trust program. Mastercard said in March 2024 that it would launch in the United States that year, and in June 2025 that it was expanding to Canada, Latin America, the Caribbean and Asia-Pacific. Merchants can share data at authorization or during a dispute, and Mastercard says the program includes new rules defining compelling evidence, with chargeback protection for disputes that meet its data-sharing requirements. The detailed criteria were not in the public Mastercard documents we could open.

CE3.0 cannot be assembled after the fact. The identifiers have to have been captured when each earlier transaction happened. The guide says that maintaining accurate customer, transaction and fulfillment records helps ensure the information is available when a dispute arises.

Visa's FAQ adds a point about descriptors. To help Visa match transactions to the same merchant, descriptors should be as consistent as possible, and where they vary, the leftmost characters should stay the same.

The list below follows the data elements named in Visa's documents. It is a starting set drawn from those documents, and your acquirer or dispute tool will have its own field requirements.

• IP address and device ID or fingerprint for each customer-initiated purchase
• The account or login ID the customer used to authenticate
• The full delivery address, where goods are shipped
• A plain description of what was bought in each transaction
• For recurring charges, the link back to the first customer-initiated transaction
• Login and usage records after each charge