Scheme12 Oct 2026

Visa widens Compelling Evidence 3.0 for card-absent fraud disputes from 24 October

From 24 October, merchants fighting Visa 10.4 fraud disputes can use prior purchases from other merchants and token matches, with limits in pre-arbitration.

What changed

Visa is changing how merchants can rebut card-absent fraud disputes under Compelling Evidence 3.0 (CE3.0). According to the April 2026 edition of the Visa Rules, as analysed by Pulse, the new wording applies to disputes processed on or after 24 October 2026; the existing rule stays in force until 23 October. Trade coverage on 12 October put the date back in front of online merchants. CE3.0 lets a merchant defeat a dispute under condition 10.4 (Other Fraud, Card-Absent Environment) by showing two earlier undisputed purchases, made 120 to 365 days before the disputed one, that share identifying data with it. Under the new text, those earlier purchases may come from one or more merchants rather than only the merchant being disputed. They must use the same card or a credential linked to it, such as a network token, rather than the identical credential. The account or login ID element now explicitly covers IDs held by an agentic payment provider, and the purchase-order-number route for certain ECI 7 e-commerce transactions extends to transactions carrying a valid token cryptogram or Visa match key. Some things do not change. Two qualifying prior transactions are still required, so a cardholder's first purchase cannot be defended this way, and the rule covers only 10.4 fraud claims, not disputes such as goods not received. Mastercard's process is unaffected. There is a catch for pre-arbitration. A footnote limits the data an acquirer may submit at that stage to transactions it accepted and processed itself, so cross-merchant evidence may only work where your acquirer also handled the other purchases. How evidence from other merchants will be assembled at the pre-dispute stage has not yet been spelled out. The change matters most to merchants with high friendly-fraud volumes and those seeing token-based or agent-initiated checkouts.

What merchants must do

Ask your acquirer and dispute tool whether they will support multi-merchant and token-linked CE3.0 evidence for disputes processed from 24 October. Make sure device ID, IP, shipping address and login ID are captured and kept for at least 365 days on every card-not-present order, including agent-initiated ones. Review 10.4 disputes you currently accept and flag repeat customers who may now qualify for a CE3.0 defence.