Visa 10.4 fraud chargeback (card-absent): how Compelling Evidence 3.0 wins it

What a 10.4 dispute claims

Reason code 10.4 is Visa’s “other fraud, card-absent environment” dispute: the cardholder says they didn’t authorize an online transaction. Some of these are real fraud. Many are “friendly fraud”, where the cardholder did make the purchase and doesn’t recognize it or regrets it.

Two things separate the winnable ones. Real fraud usually has no history behind it. A genuine customer has a history of orders you can match.

You get one submission on Shopify Payments and Stripe. Check your processor’s own CE 3.0 eligibility before you build the response.

How Compelling Evidence 3.0 works

Compelling Evidence 3.0 is a Visa program for 10.4 disputes that moves liability to the cardholder’s issuer when you can show a pattern of earlier, undisputed use. In Visa’s merchant guidance, it needs:

• Two earlier transactions on the same card, with the same merchant.
• Each at least 120 days old and no more than 365 days old, measured from the dispute.
• No active fraud report or fraud dispute on either one.
• At least two of the same identifying details matching the disputed transaction (user ID, IP address, shipping address, device ID or fingerprint), with one of them being the IP address or the device.

Processors apply the rules slightly differently. Stripe states the age window as 120 to 364 days and doesn’t accept a device ID and device fingerprint together as two separate matches. Your processor’s eligibility check has the final word.

Why subscription brands have an edge

CE 3.0 asks for transactions at least 120 days old. A one-off store has to hope a customer ordered before. A subscription brand’s customer, four or more months in, has several monthly renewals already: undisputed, on the same card, often from the same device and account.

To use that, record the identifying details at purchase and at each renewal: IP address, device ID or fingerprint, account or user ID, email and shipping address. If you didn’t capture them, you can’t match them later.

The evidence that wins

The order to argue it in

1. Address and CVV checks passed at authorization.
2. The cardholder has a history of undisputed orders with the same device, IP, or address (Visa CE 3.0 when it qualifies).
3. The goods were delivered to the cardholder's verified address.

Mistakes that lose winnable 10.4 cases

• Using prior transactions that are too new. Anything under 120 days old doesn’t count for CE 3.0.
• Using a prior transaction that was itself disputed.
• Matching only on email or name. CE 3.0 needs the IP address or device as one of the matches.
• Not capturing IP and device at purchase, so there’s nothing to match.
• Fighting a real fraud case with no history. Accept the loss and tighten fraud screening.

CE 3.0 is a Visa program. For Mastercard 4837 and Amex F29 you argue from authorization checks, delivery to a verified address and customer history without the same liability shift.

The same dispute on other card networks

Questions

Related guides