The Two Data Elements That Win a Visa Compelling Evidence 3.0 Dispute

The one rule that pays for itself

Most chargeback tools help you write a better argument. Compelling Evidence 3.0 is different in kind. It is a remedy rule, which means meeting a defined checklist produces a defined result rather than a discretionary judgment call by an analyst. Satisfy the criteria for a 10.4 card-absent fraud dispute and the chargeback is reversed. You are not persuading anyone. You are meeting a specification.

The part that makes it worth real effort is what happens to your ratios. A validated CE 3.0 win reverses the disputed amount and keeps your fraud ratio flat. That matters because your fraud ratio is the number that governs your standing in Visa’s monitoring programs. If you have been watching the tightening thresholds, you already know how little room there is: we covered the newest limits in our breakdown of Visa lowering the chargeback threshold under VAMP. CE 3.0 is one of the only ways to claw back a fraud dispute without the reversal costing you ratio headroom.

Hold those numbers in mind, because the whole rule turns on them. Roughly three in four chargebacks are first-party, or friendly, fraud, where the buyer really did make the purchase. That is exactly the population CE 3.0 was built to resolve, and it is why authentication alone will not save you. Authentication proves a card was verified at the moment of sale. It does not prove the same person came back and bought again, which is the story CE 3.0 wants you to tell. We drew that distinction in detail in 3D Secure versus Evidora.

The qualification recipe

Here is the specification, plainly. To qualify a 10.4 dispute for the CE 3.0 remedy, you point Visa to two prior undisputed transactions from the same cardholder. Those transactions must be between 120 and 365 days old relative to the disputed order, and they must not themselves have been charged back as fraud. Then you match two data elements across those prior orders and the disputed one. And here is the clause that decides everything: at least one of the two matching elements must be the IP address or the device ID.

Read that mandatory line again, because it is where the game is won or lost. Shipping address and login ID are useful, but on their own they are not enough. Visa is asking for a technical fingerprint of the session, the IP or the device, tying the disputed purchase to earlier ones the same person made. It is the single element hardest to fake and hardest to argue with, which is precisely why Visa made it the anchor of the whole remedy.

Why most merchants cannot qualify

Now the uncomfortable part. When a 10.4 dispute arrives, you are looking backward. The qualifying orders happened 120 to 365 days ago, which means the deciding evidence had to be captured long before you knew there would be a dispute. You cannot go back and collect an IP address from a purchase last spring. Either it was recorded and stored in a way you can retrieve and match today, or it was not, and if it was not, you cannot qualify no matter how obviously legitimate the customer is.

This is the trap, and it is a data-retention trap rather than a strategy problem. Your payment processor was built to move money, authorize a card, settle a batch, and manage the dispute correspondence. It was not built to be a searchable, year-long archive of the session-level fingerprint of every buyer. Many processors capture an IP somewhere in a log, but capturing is not the same as retaining it in a form you can pull up a year later, line up against two other specific orders, and submit as matched evidence. The device ID is often not captured at all. So the exact element CE 3.0 treats as mandatory is the one most stacks quietly drop.

The dispute is decided by data you had to capture a year before you knew the dispute existed. That is the whole game, and it is why prevention and proof are not the same job.

This is the same lesson that shows up across every dispute type. Winning is less about the letter you write at dispute time and more about what you were quietly recording all along. We made that case in the five things that actually win chargeback disputes, and CE 3.0 is the sharpest example of it. The rule practically names the evidence for you. The only question is whether you kept it.

Capturing it next to your processor

The fix is not to replace your payment processor. It is to sit an evidence layer beside it that captures and retains exactly what CE 3.0 asks for, on every transaction, whether or not that transaction ever gets disputed. This is where Evidora fits. A single line of code on your checkout captures the session as it is rendered to that specific buyer, and it records the elements the remedy rule turns on.

Because Evidora captures alongside the payment flow rather than inside it, the integration is seamless and processor-agnostic. Your checkout does not change, your authorization path does not change, and the buyer notices nothing. What changes is that every completed purchase now carries a retained, matchable record: the IP, the device ID, the rendered confirmation the customer actually saw, a tamper-evident timestamp, and the order and customer details around it. That is not only the CE 3.0 fingerprint. It is also the cardholder purchase history the rule wants you to point back to, building quietly with every sale.

When the 10.4 dispute lands on that Tuesday, the work is already done. You are not hunting through processor logs hoping an IP survived. You are selecting two prior orders whose device ID matches the disputed one and producing the packet. The same capture approach underpins the Mastercard side of the house too, which we walk through in the Mastercard First-Party Trust guide, and it starts from the same idea we introduced in recording your checkout page: capture now, produce later.

What changes on October 24

CE 3.0 is not static, and a meaningful expansion is dated. Effective October 24, 2026, Visa widens the application of the 10.4 remedy rule and, importantly, adds support for multi-merchant transactions as qualifying evidence. In plain terms, a cardholder’s purchase pattern across more than one merchant can help establish that a disputed transaction is legitimate, not only their history with you alone.

That broadens who can win, but it does not change the underlying currency. The evidence is still the session fingerprint, the IP and device ID, tied to real rendered purchases with reliable timestamps. A wider rule rewards the merchants who have been capturing that record consistently and does nothing for the ones who have not been keeping it. If anything, the October change raises the payoff for having a clean, retained evidence trail in place before the rule expands. You can read the mechanics directly in Visa’s Compelling Evidence 3.0 merchant readiness guide and in the current Visa Core Rules.