Visa expanded its Compelling Evidence 3.0 chargeback defense rules on October 24, 2026, allowing qualified card-not-present fraud disputes to be challenged using a cardholder’s prior transactions with more than one merchant. At the same time, the network tightened the evidence requirements by preventing acquirers from counting a device identifier and a device fingerprint as two independent matching data points.
The changes matter to online financial merchants, payment processors and brokers that accept cards because they alter how an apparently unauthorized purchase can be defended when the payment history suggests the legitimate customer participated. They do not mean that all card-not-present fraud claims become invalid or that customers lose the ability to dispute genuinely unauthorized transactions.
The rules apply to Visa Dispute Condition 10.4, covering fraud in the card-absent environment. Visa’s own April 2026 rules edition explicitly identifies October 24 as the effective date for a broadened form of its liability-protection remedy. The actual impact depends on the quality of historical transaction records and whether the cardholder’s disputed payment satisfies every qualification requirement.
What Changed in Visa Compelling Evidence 3.0 on October 24?
The Visa Core Rules and Visa Product and Service Rules state that the Compelling Evidence 3.0 remedy can now rely on a card or associated token used for two earlier transactions at one or more merchants, provided the issuer had not reported those earlier transactions as fraud and the required historical and identity criteria are met.
Before this revision, the widely used version of the defense generally relied on repeat transactions involving the same merchant and cardholder. The revised approach could help payment providers identify legitimate repeat card activity even when a consumer previously purchased from different merchants within an eligible group of transactions.
That possibility does not give one merchant unconditional access to transaction details held by a competing company. Merchants and acquirers will need a permitted, reliable method to obtain and submit the necessary data while respecting privacy obligations and scheme processing rules. The rule’s availability and a particular merchant’s practical capacity to use it are separate questions.
Visa also restricts which identifiers count as two matching pieces of evidence. It describes a device ID and a device fingerprint as similar elements rather than separately sufficient factors. A merchant that has previously relied on both must identify another qualifying element.
The timing is not hypothetical: the rule change applies to disputes processed on or after October 24, not merely to new purchases made after that day.
What Evidence Must a Merchant Provide to Challenge a Fraud Dispute?
Visa’s rule ordinarily calls for two earlier transactions using the same card or associated credential, made more than 120 calendar days before the dispute was submitted and no more than 365 days before the processing date. Those transactions must not have been reported to Visa by the issuer as fraudulent.
The evidence must also link the earlier legitimate activity to the disputed purchase. Depending on the route used, Visa requires a detailed description of the goods or services, or a qualifying purchase-order-number alternative for certain authenticated or tokenized e-commerce transactions.
At least one suitable device or network element must match, such as a device ID, device fingerprint or public IP address, together with another qualifying identifier such as the account or login ID or complete delivery address. Because device ID and device fingerprint count as similar evidence, supplying those two alone will not satisfy the two-element rule.
The network specifies minimum qualities for technical evidence: the device ID must be at least 15 characters in clear text; the fingerprint must represent a unique device identification based on at least two device or software properties and be at least 20 characters; and a public IP address must be provided in an appropriate readable format.
Some exceptions and additional conditions apply to specific transaction types, including original credit transactions and certain authenticated e-commerce flows. An acquirer should follow the full current rule rather than treating the two-prior-payment checklist as an automatic right to reject every dispute.
Visa’s earlier merchant guidance explained the purpose of CE3.0 as combating first-party misuse, often called friendly fraud, in which an authorized purchaser subsequently claims a transaction was fraudulent. The October revision changes the evidence pathways without changing the basic distinction between a legitimate fraud victim and someone falsely denying an authorized purchase.
Why Can Device ID and Fingerprint No Longer Count Separately?
Device identifiers and device fingerprints can be correlated with the same physical equipment or the same combination of operating-system, browser and hardware attributes. Treating them as two wholly independent pieces of proof risks overstating how much evidence actually ties a purchase to a specific cardholder.
For example, a merchant might submit the same device’s ID and fingerprint for a disputed $200 online payment and two earlier purchases. Under the updated rule, that does not amount to two separate matching categories simply because the data originated in different fields of the merchant’s database.
If a qualifying account login ID or public IP address also matches, the evidence may be stronger, subject to the rest of the rule. But shared IP addresses, dynamic network addresses and household devices show why any one match can be ambiguous. Visa’s standard evaluates a defined combination of historical and contextual evidence, not a claim that every device fingerprint proves who physically initiated a purchase.
This is closely related to DaveFinances’ analysis of behavioral biometrics in brokers and exchanges, where valid credentials or familiar technical attributes alone cannot settle whether activity was genuine. That article covers a different technology, but the underlying evidence-quality question is similar.
The update can require merchants to alter how they collect and store user IDs and delivery details. Payment processors may also need to update automated chargeback packets that previously attempted to use two technically overlapping device fields.
How Could Multi-Merchant Evidence Affect Crypto Platforms and Brokers?
Crypto exchanges, financial apps and CFD brokers frequently process card-not-present deposits or purchases through external acquirers. Depending on the exact payment type, an allegedly fraudulent purchase may enter Visa’s 10.4 dispute process, creating a financial and operational burden even when a legitimate customer received the purchased service.
Under the October change, eligible transactions at more than one merchant can potentially support a defense if the relevant card, dates, non-fraud history and matching identifiers satisfy the scheme criteria. A payment provider capable of connecting permitted transaction histories across merchant relationships might have more usable evidence than an isolated merchant relying solely on its own limited records.
However, the rule does not eliminate chargebacks on cryptocurrency purchases, override financial regulation, or make blockchain settlement irreversible from the card issuer’s perspective. The card payment and the resulting crypto transfer remain different processes with distinct risk allocations.
That is particularly important when customers claim that a payment reversal was misclassified as a chargeback. DaveFinances investigated complaints involving TakeProfitTrader payment reversals and account restrictions. Those allegations are unrelated to Visa’s CE3.0 change, but illustrate why classifying a dispute correctly matters before any fraud-defense evidence is evaluated.
Payment providers can also be affected by the growing use of agentic purchasing software. In discussing who bears liability when an AI shopping agent makes an unauthorized purchase, DaveFinances examined how delegated authority complicates customer consent. Notably, the updated Visa rule text refers to login IDs associated with agentic payment providers, giving this evidence framework relevance beyond conventional online stores.
Does the Revision Make It Harder for Real Fraud Victims?
The expansion is intended to help merchants defend transactions against first-party misuse, but the evidence still must satisfy documented conditions. A real victim whose card information was stolen may have legitimate grounds to dispute a payment, even if a different transaction shares a household IP address or device attribute.
Data matching does not guarantee that the cardholder made the transaction, and merchants cannot simply assert that a customer used their card previously to defeat a new fraud claim. The issuer’s reporting history, nature of the earlier payments, the matching elements and relevant exceptions all matter.
The new framework can also produce operational challenges if historical data is incomplete. Some e-commerce services do not retain an exact device ID, some do not collect a shipping address, and some payment processors use tokens or different identifiers that need to be mapped correctly.
For privacy, retaining device and account identifiers long enough to support eligible disputes should be balanced against applicable data-protection obligations. The Visa rule specifies what evidence can be submitted; it does not give payment providers unlimited permission to gather or exchange customer information for unrelated purposes.
Providers such as Stripe describe how merchants can supply earlier transaction histories under CE3.0. Its merchant support guidance illustrates that qualification depends on evidence structure and processing support, not simply attaching a screenshot and declaring the buyer a repeat customer.
What Must Merchants and Payment Processors Update Now?
Acquirers should first verify that their systems correctly distinguish dispute condition 10.4 from other chargeback reasons. A contract or purchase contested for another reason does not automatically qualify for the same fraud remedy.
Next, they should audit CE3.0 evidence generation: confirm the two earlier non-fraud transactions fall within the applicable age window, verify the same card or linked token, and check that device ID and device fingerprint are not counted as distinct qualifying categories.
For multi-merchant use, providers need to establish whether the necessary prior-transaction history and authentication identifiers can be submitted accurately and legally. This requires operational cooperation and a clear audit trail; the rule update alone does not mean a small merchant can query every other merchant’s customer records.
Finally, merchants should track the percentage of cases deemed qualified, actual liability outcomes, rejection reasons and incremental dispute-management costs. No official figure yet establishes how much the October changes will reduce friendly-fraud losses for crypto exchanges, brokers or the payments sector as a whole.
Visa’s October 24 update therefore represents both an expansion and a tightening: qualifying historical transactions from multiple merchants may now support a fraud-defense claim, but overlapping device identifiers cannot substitute for independent evidence. The winners will be businesses able to document legitimate activity without confusing statistical matching with proof of customer authorization.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574