Visa's CE 3.0 Expansion Starts October 24: You No Longer Need a Repeat Customer to Win

The rule that required repeat customers

Visa's strongest tool against friendly fraud has carried one limitation since it launched in April 2023. Compelling Evidence 3.0 lets you defeat a card-absent fraud dispute by showing the card's own purchase history, but only purchases at your store counted. A customer who bought from you once, then disputed the order while using the same card at other merchants every week, was out of reach.

That restriction ends on October 24, 2026. Visa's April 2026 rulebook expands CE 3.0 to count earlier transactions "at one or more Merchants" on the same card or a related credential, such as the tokenized card in a phone wallet. Visa's stated goal is to further reduce friendly fraud. For sellers whose customers buy once or twice a year, furniture, jewelry, consumer electronics, B2B equipment, this is the first structural improvement to their fraud win rate in years.

Most advice about this change will tell you to update evidence templates. That skips the two things that decide whether you actually benefit: what your checkout logs today, and whether your acquirer can submit multi-merchant data at all.

What CE 3.0 requires today

A CE 3.0 defense against a 10.4 card-absent fraud dispute needs, under the Visa Core Rules (April 18, 2026 edition):

Two prior transactions on the same card or credential
Each processed more than 120 days and no more than 365 days before the disputed order, counted back from the dispute date
Neither prior ever reported as fraud by an issuer
A device ID or device fingerprint, or the cardholder's public IP address, matching the disputed order, plus at least one more element: account login, full delivery address, or the device identifier
Clear text data for login, address, device ID and IP. Only the fingerprint may be hashed. A device ID needs at least 15 characters. A fingerprint needs 20 or more, built from at least 2 device properties such as browser version and OS version

Meet every condition and Visa's rules treat the dispute as invalid, with liability shifting back to the issuer. Miss one and you are back to arguing with soft evidence that analysts weight lightly. Visa also warns that a CE 3.0 submission can be attempted only once, so a sloppy packet burns the tool on that dispute for good.

What moves on October 24

First, prior transactions no longer need to be yours. The two-transaction minimum still stands, but those transactions can now sit at other merchants, on the same card or a related credential. Your customer's other online purchases on that card can complete the pair that defends your $900 order.

Second, device ID and fingerprint stop stacking. Until now a merchant could match device ID plus fingerprint and call that two elements. From October 24, Visa treats them as similar data, one category. Pair the device or IP match with a login or a delivery address instead.

Third, the data path stays narrow. The rule limits your acquirer to submitting transaction data it accepted and processed. History from other merchants arrives through Visa's cooperative data channels, with Verifi's Order Insight as the documented route for CE 3.0 evidence before a dispute is even filed. If Order Insight is not active on your account, ask your provider how they intend to source multi-merchant history, because that detail decides whether the expansion ever reaches your cases.

Who gains the most

Frequency businesses never had a problem here. A subscription customer on monthly billing generates a stack of qualifying priors without anyone trying. The merchants locked out were the low-frequency, high-ticket ones, and that is exactly who the multi-merchant rule rescues.

Worked example. A customer orders a $1,400 dining table from your store on June 10, 2026. It delivers. On October 20, 2026, the issuer processes a 10.4 dispute: the cardholder claims she never authorized the charge.

Count back from October 20: the qualifying window for priors runs from October 20, 2025 to June 21, 2026, which is 120 to 365 days before the dispute. She has bought from you exactly once, and that purchase is the disputed order itself. Under the old rule you had nothing. Case lost, table gone, $1,400 plus a chargeback fee against you, and a fraud report plus a dispute counted toward your Visa ratio.

From October 24, her card's purchases at other merchants inside that window can supply the second prior, provided the required data elements match: her device or public IP, plus one more element such as her delivery address. The win no longer depends on whether she was a repeat customer. It depends on whether anyone captured the data.

What does not change

The two-prior minimum and the 120-to-365-day window
The matching data requirement and the format rules, including clear text for IP and login
The one-submission limit per dispute
Eligibility is still limited to 10.4 card-absent fraud disputes

Log this data now, not in December

None of this works on data you never captured. An IP address that was never logged at checkout cannot be reconstructed after the dispute lands. Four fields to verify this week:

Public IP address at checkout, stored in clear text, on every order including guest checkout
Device fingerprint, 20 or more characters, built from at least 2 device properties
Device ID where your stack exposes one, 15 or more characters, clear text
Full delivery address and account login tied to the order record

Then run the test that matters: pull any 10.4 dispute you received in the last 90 days and check whether you could have produced two qualifying priors with matching data. If the answer is no for orders you shipped this month, that gap is exactly what October 24 changes for you. Closing it takes a developer day, not a replatform.

Two questions for your provider before October 24

Ask your acquirer or dispute provider these, in writing:

Will CE 3.0 submissions on our account include multi-merchant priors, and through which channel?
Is Order Insight, or equivalent pre-dispute deflection, active? Deflection resolves the claim before it becomes a chargeback, which keeps the dispute half of that double-count off your ratio.

The ratio angle is worth restating. Since April 1, 2026, Visa's Excessive Merchant threshold sits at 150 basis points, 1.5% of settled card-not-present transactions, across the US, Canada, EU and Asia Pacific, down from 220. A single friendly fraud event can hit your numbers twice: once as the issuer's fraud report, again as the dispute. Merchants who resolve claims at the alert stage keep the dispute half off the board entirely.

If the evidence pipeline and provider management are more than you want to own, this is the kind of work ChargeGuard's done-for-you service handles end to end: data capture checks, evidence assembly, submissions, ratio monitoring. The $149/mo tool covers monitoring and alerts if you would rather keep the wheel yourself.

The short version

October 24 widens CE 3.0 from "prove this customer shops with you" to "prove this card is real." Merchants with clean device and IP logging gain a win condition they never had. Everyone else now loses to a rule that rewards data they skipped capturing. Verify your logging and your provider this week. The disputes that test the new rule will arrive with the holiday season, and December is a bad time to retrofit an evidence pipeline.