Visa Compelling Evidence 3.0: The Evidence Checklist That Wins 10.4 Disputes

Most merchants lose fraud chargebacks for a boring reason: their evidence is in the wrong format.

The customer made the purchase. Their device, email, and IP match two older orders. The case is winnable. But the packet you send to the issuer reads like a support ticket, and the analyst reviewing it spends about 90 seconds deciding. The chargeback stands, you eat the sale, the fee, and the merchandise cost, and your Visa ratio ticks up.

Since Visa rolled out Compelling Evidence 3.0 (CE3.0), that outcome is avoidable for a large share of card-not-present fraud disputes. The rule tells you exactly what evidence wins a reason code 10.4 dispute, and it is narrower than most merchants expect. Here is what it requires, why it matters more this year than it did in 2025, and how to build a packet that clears the bar.

What CE3.0 actually requires

Compelling Evidence 3.0 applies to fraud disputes on card-not-present transactions, the 10.4 disputes where a real cardholder claims they did not authorize a charge. To flip liability back to the issuer without a signature, a delivery photo, or 3DS, your evidence must meet three conditions:

Two or more prior transactions from the same cardholder account, each dated more than 120 days but fewer than 365 days before the disputed transaction.
None of those prior transactions was ever disputed as fraud. One earlier fraud claim and the whole packet fails.
Each prior transaction shares at least two data elements with the disputed one. Visa counts four: IP address, email address, physical address, and phone number.

That is the whole rule. If your packet meets it, the issuer should resolve the dispute in your favor. If it misses on any single condition, you are back to arguing your case the old way, with soft evidence that carries less weight.

The 120-day floor trips people up. Merchants with long customer lifespans reach for their best evidence, which is often a purchase from two years ago. Too old. Visa wants recent history, close in time to the disputed charge, because that is what indicates the same person is still using the card willingly.

Why the stakes went up in 2026

Two changes make CE3.0 worth real attention this year.

First, Visa folded its fraud and dispute monitoring programs into one program, VAMP. The ratio now counts TC40 fraud reports plus TC15 disputes over your settled card-not-present transactions, and the Excessive Merchant threshold dropped to 150 basis points on April 1, 2026 for the US, Canada, EU, and Asia Pacific, down from 220. A single friendly fraud event can hit that ratio twice, once as the fraud report and again as the dispute. Fines, reserves, and acquirer pressure follow once you cross the line.

Second, friendly fraud keeps growing as a share of what merchants face. In Chargebacks911's 2026 Chargeback Field Report, merchants estimated friendly fraud at 43.8% of their chargebacks, while Chargebacks911's own case data put the figure at 86%. Whatever the true number in your book, first-party misuse is the dominant dispute type for most online sellers, and 10.4 is its reason code. CE3.0 is the network's official answer to it.

There is also a structural bonus: disputes resolved through CE3.0 do not count against your VAMP ratio the same way contested losses do. Every 10.4 you close with a qualifying packet protects the number that decides whether you land in the program.

The win rate trap

Merchants who fight their chargebacks win about 44.6% of them, per the same Chargebacks911 report. That sounds tolerable until you look at net recovery: 10.7% of all chargeback dollars come back, because most disputes go unfought and some first-cycle wins get reversed at second cycle. The gap between 44.6% and 10.7% is where most merchants bleed.

A win rate near 50% on disputes you bother to answer is not a strategy. CE3.0 gives you something better than effort: a checklist. When your packet qualifies, the outcome stops depending on how an analyst feels about your brand story.

How to build the packet

Structure the representment around the rule, not around your feelings about the customer. A packet that works looks like this:

Lead with the match table. One page. Rows are the disputed transaction plus the two prior transactions. Columns are the four CE3.0 data elements. Highlight every match. The analyst should be able to verify qualification in under a minute.
Use only clean prior transactions. Check your dispute history before you submit. If a prior transaction was ever fraud-disputed, swap it out. Submitting a contaminated packet reads as sloppy and taints the rest.
Add transaction-level proof behind the table. AVS and CVV match results, the device fingerprint or login record, order confirmations sent to the cardholder's email, and delivery confirmation for physical goods. This is supporting evidence. The match table qualifies you; this corroborates.
Show the customer knew. Password-protected account logins, saved payment method indicators, and any post-purchase emails the customer opened or replied to all push against "I did not authorize this."

Where merchants fail

Four failures cover most rejected CE3.0 attempts:

Only one qualifying prior transaction. One is not enough. Two is the floor.
A prior transaction that was itself fraud-disputed. Usually discovered after the fact. Audit before you submit.
A single shared data point. Matching only the email, when the customer's IP and phone changed, fails the two-element test.
Records that do not go back far enough. You need clean history reaching at least 120 days before the disputed charge. If you purge order data at 90 days, you cannot qualify, full stop.

That last one is a policy decision, not a technology problem. Keep order-level records for 13 months. It costs storage, and it is what makes CE3.0 available to you at all.

Fix the inputs, not just the output

CE3.0 is a representment tool, but its requirements tell you what to capture at checkout and after. Confirm you are storing IP address, email, billing and shipping address, and phone on every order, and that they stay linked to the transaction record. Normalize customer identity across orders so repeat buyers are recognizable. And watch your descriptor: every 10.4 you prevent because the customer recognized the charge is one you never have to fight.

The merchants doing well under VAMP are not winning arguments. They are running a records discipline that turns first-party fraud disputes into checkbox qualifications. The rule rewards the boring work. Do the boring work.