Visa CE 3.0 — turning prior orders into a defense

Visa Compelling Evidence 3.0 is a network rule that lets a merchant win a 10.4 (Card-Absent Other Fraud) chargeback by submitting evidence of two prior undisputed transactions from the same customer, with the same payment method, between 120 and 365 days before the disputed transaction. If the merchant produces matching data points across the prior transactions and the disputed one, the chargeback is reversed in their favor.

The reasoning: if the customer has paid you twice without disputing before, and the data points (IP, device, address, email, account ID) match across all three transactions, then the disputed transaction is plausibly the same customer — even if the cardholder is now claiming fraud. The most common pattern is friendly fraud: the customer made the purchase, forgot, and disputed when the statement arrived.

• Reason code: Must be Visa 10.4 only. Not 10.1 (counterfeit), 10.2 (lost/stolen), 10.3 (card-present other), 10.5 (Visa Fraud Monitoring Program), or any 13.x consumer-dispute code.
• Two prior undisputed transactions from the same customer, paid with the same payment method (same card / same Apple Pay / same Google Pay token).
• Window: 120–365 days before the disputed transaction. Less than 120 days = too recent (no track record yet); more than 365 days = too stale.
• Prior transactions must not have been previously reported as fraud. One prior chargeback against either of them disqualifies them as CE 3.0 candidates.

You need two main elements OR one main + one secondary element matching across all three transactions.

Note: Device Fingerprint + Device ID is not a valid combo (Visa considers them too similar). Pair one of them with IP for a clean two-main match, or with shipping address for a main+secondary.

10.4 is the dominant reason code for ecommerce friendly fraud — far and away the most-cited fraud-coded chargeback. Most merchants lose these because the cardholder claims unauthorized use and the merchant has no way to prove it's the same person.

CE 3.0 inverts the dynamic. If you collect IP + device fingerprint + email + shipping address at every checkout (which any modern stack does), you have the raw material to defeat most 10.4 disputes from repeat customers. The win rate on CE 3.0 cases when properly filed is reportedly very high — Visa designed the rule to be definitive, not advisory.

The catch is that every single chargeback-defense product claims to support CE 3.0. The actual quality of support varies:

• Stripe Smart Disputes supports CE 3.0 via the enhanced_evidence sub-tree but requires you to have collected ≥15-char account IDs and ≥20-char device fingerprints — which most SMB stacks don't.
• Chargeflow doesn't explicitly publish CE 3.0 coverage; it's implied via “ChargeScore signals.”
• ChargePay / Disputifier don't mention CE 3.0 in their public docs.
• Victava ships a dedicated gather-ce3 specialist that fires on every 10.4 + Visa dispute. It queries your full Stripe charge history for the same payment method, filters by the 120–365-day window, cross-references against any prior charge.dispute events, and surfaces eligible candidates with the matching data points highlighted.

• Oct 17, 2025: Visa began auto-qualifying transactions for CE 3.0 through Visa Secure (including Visa Data Only authentication). If your checkout flow uses Visa Secure / 3D Secure, more transactions are pre-qualified without you needing to gather all six data points.
• Apr 17, 2026: Visa introduced a fee for successful CE 3.0 qualifications (amount varies by region). The fee is paid by the merchant on a win, but net of recovered transaction value the math still favors filing.
• Pre-dispute and pre-arbitration usage: CE 3.0 isn't just for representment — it can be invoked at the pre-dispute layer (via Verifi RDR / Order Insight) to deflect the chargeback before it's filed. Merchants with Verifi integration win these cases at much lower cost than full representment.

1. Verify your checkout collects: customer purchase IP, device fingerprint (via your fraud SDK), customer email, and shipping address. Most Shopify checkouts do this by default; if you have a custom checkout, audit explicitly.
2. Persist these fields per transaction so a CE 3.0 lookup can find them 365 days later. Stripe stores most of these on the Charge object; Shopify stores them on the Order object.
3. When a 10.4 dispute lands, run the CE 3.0 lookup on the customer's prior transactions in the 120–365-day window. Look for two main matches or one-main-plus-one-secondary. If you find them, file CE 3.0 as the primary defense.
4. Monitor Visa Secure auto-qualification. Post-Oct 2025, more transactions are pre-qualified. Stripe's enhanced_evidence.visa_compelling_evidence_3 hash tells you per-dispute whether auto-qualification applies.

Victava automates all four steps. The gather-ce3 subtask runs on every 10.4 + Visa dispute, returns matched candidates with field-level provenance, and pre-populates the Stripe enhanced_evidence sub-tree before the merchant approves.