ChargebackDesk · Guides · Visa Compelling Evidence 3.0

Visa Compelling Evidence 3.0 on Stripe: the rules and the dates

By Dheeraj Kumar, founder · Updated 2026-10-15 · Checked against Visa's Core Rules (18 April 2026 edition) and Stripe's documentation as of 2026-10-15 · How the desk is run

Related network codes

Compelling Evidence 3.0 (CE 3.0) is Visa's rule for card-absent fraud disputes — reason code 10.4 — where the same card has paid you before without a fraud report. If two earlier purchases match the disputed one on the right data points, Visa treats the dispute as invalid. Visa changes the rule for disputes processed on or after 24 October 2026. This page sets out the rule before and after that date, and how Stripe applies it.

The short answer

CE 3.0 applies only to Visa reason code 10.4. You need two earlier transactions on the same card that the issuer didn't report as fraud, processed more than 120 days — and no more than 365 days — before the dispute. Those two must match the disputed transaction on the IP address or device ID/fingerprint, plus at least one more data element, and you describe what was bought in all three. On Stripe, the dispute shows whether it may qualify, and Stripe autofills the evidence when it processed the earlier payments.

The dates that matter

Through 23 October 2026: the current rule — the same Payment Credential in both earlier transactions.
On or after 24 October 2026: the updated rule — the same card or a credential tied to it (such as a token), and earlier transactions can be at one or more merchants.
Look-back window: more than 120 and no more than 365 calendar days before the dispute (Visa's wording); Stripe states its window against the disputed transaction — see below.
Your deadline: the due-by date on the dispute in Stripe. CE 3.0 doesn't extend it.

Key dates at a glance

Date or window	What it means	Source
Disputes processed through 23 October 2026	The current CE 3.0 rule applies (same Payment Credential, two earlier transactions).	Visa Core Rules, Table 11-28
Disputes processed on or after 24 October 2026	The updated rule applies: same card or associated credential, earlier transactions at one or more merchants, and device ID and device fingerprint count as one element.	Visa Core Rules, Summary of Changes and Tables 11-28 / 11-31
Earlier transactions: more than 120 days old	Each earlier transaction must have been processed more than 120 calendar days before the dispute. The 120-day minimum doesn't apply to Original Credit Transactions.	Visa Core Rules, Table 11-28 and footnote 6
Earlier transactions: no more than 365 days old	Not more than 365 calendar days before the dispute's processing date.	Visa Core Rules, Table 11-28, footnote 5
Stripe's stated window	Stripe's API guide: "within 120-364 days of the disputed transaction." Stripe's support article: "more than 119 calendar days and fewer than 366 calendar days prior to the disputed transaction processing date."	Stripe docs (fetched 2026-10-15)
Issuer's filing window for 10.4	120 calendar days from the transaction processing date.	Visa Core Rules, Table 11-29
Your response deadline	The evidence due-by date on the dispute in Stripe (`evidence_details.due_by`) — Stripe says it's usually 7 to 21 days after the dispute opens, depending on the network.	Stripe docs

Visa counts its window back from the dispute; Stripe's two pages phrase theirs against the disputed transaction, one day apart from each other at the far end. Near either edge, don't rely on your own day-count — rely on the eligibility Stripe shows on the dispute.

The rule, before and after 24 October 2026

Under Visa's rules, a 10.4 dispute is invalid when the conditions below are met. This is Visa's rule as written in its Core Rules (18 April 2026 edition); Stripe's implementation follows in the next section.

Condition	Disputes processed through 23 October 2026	Disputes processed on or after 24 October 2026
Which card	The same Payment Credential (for example a Visa account number or token) was used in the 2 earlier transactions	The same card, or a payment credential associated with that card (for example a token)
Where	Your own transactions — Visa's change notice adds multi-merchant support from 24 October 2026	At one or more merchants
Earlier transactions	2, not reported to Visa as fraud by the issuer, inside the 120–365-day window	The same, with the 120 days counted back from when the dispute was submitted
Description	A detailed description of what was bought in the disputed transaction and both earlier ones (a purchase order number can stand in for certain Visa Secure transactions)	The same; the purchase-order alternative extends to certain Visa Secure, Visa Token Service and Visa IDX transactions
The match	Device ID, device fingerprint, or IP address, plus one or more of: customer account or login ID, full delivery address, device ID, device fingerprint, IP address	The same, except device ID and device fingerprint are "similar data elements": both can't be supplied — another element must be chosen instead. Login IDs now include an agentic payment provider's login.

Visa also changes the pre-arbitration version of this rule from the same date. There, an acquirer may only submit transaction data it accepted and processed itself — so in that stage, earlier purchases count only if your acquirer handled them.

Visa lists other ways a 10.4 dispute can be invalid (certain authenticated Visa Secure transactions, for example). This page covers CE 3.0 only.

The evidence elements, and how they must look

Visa's format rules for each data element are the same either side of 24 October 2026:

Element	Visa's requirement	On Stripe
IP address	The cardholder's public IP address, in clear text, not hashed, in a current format (IPv4 or IPv6)	Main element: customer purchase IP
Device fingerprint	Derived from at least 2 software or hardware properties of the device (for example browser and operating-system version); at least 20 characters; may be hashed	Main element: device fingerprint or device ID
Device ID	A unique identifier the cardholder can verify, such as a device serial number; at least 15 characters; clear text, not hashed	Main element (same slot as fingerprint)
Customer account or login ID	The identifier the cardholder signs in with on your site or app, recognizable to them; clear text, not hashed	Secondary element: customer account ID
Full delivery address	Street, city, state or province, postal code and country; clear text, not hashed	Secondary element: shipping address
Email address	Not named as its own element in Visa's list (an email the buyer signs in with is a login ID)	Secondary element: customer email address

Stripe's match test: the disputed transaction and both earlier ones must share either two main elements, or one main element and one secondary element. A device fingerprint together with a device ID is not a valid pair.

How CE 3.0 works on Stripe

Which disputes: Visa disputes with network reason code 10.4. Stripe usually shows these with the reason fraudulent; the network code is on the dispute (network_reason_code).
Which earlier payments count: at least two on the same payment method as the disputed one — paid, undisputed, and not validation charges.
Descriptions: a product description for the disputed transaction and each earlier one, and the disputed transaction marked as merchandise or services.
Eligibility on the dispute: in the API, enhanced_eligibility_types includes visa_compelling_evidence_3, and the CE 3.0 status reads requires_action (with a list of what's missing) or qualified. In the Dashboard, required fields carry a "Required for Visa CE 3.0" badge.
Autofill: Stripe queries your payment history and fills in what it can — but only when Stripe processed all of the earlier undisputed transactions. You fill any required field left empty.
If it doesn't qualify: after you submit, the status can change to not_qualified; the evidence still goes through, as a standard response. So fill in the ordinary evidence too — Stripe recommends it, because that's what the issuer reads if CE 3.0 doesn't hold.
No certainty: Stripe's support article says submitting under CE 3.0 doesn't mean an automatic win.

Stripe and the 24 October 2026 change. As of 2026-10-15, Stripe's CE 3.0 documentation still describes earlier payments on the same payment method that Stripe processed. It doesn't yet say how Stripe will apply Visa's update (associated credentials such as tokens, earlier purchases at other merchants). Until it does, treat the eligibility Stripe shows on your dispute as the answer for your case — we'll update this page when Stripe documents the change.

Before a dispute: CE 3.0 blocks

CE 3.0 can also stop a dispute from being filed at all. If you're enrolled in Visa's Order Insight through Stripe's dispute prevention, and a cardholder queries a charge with their bank, Visa picks the 2 to 5 most recent non-fraud earlier transactions and asks for their data. Stripe's description: if at least two of them have complete product descriptions, matching IP addresses, and at least one matching email address or delivery address, the issuer must block the dispute — so no dispute is filed and no dispute fee applies. Stripe charges a fee per CE 3.0 block (see Stripe's pricing page). For blocks to work, Stripe needs that data on your earlier charges: the IP address, the customer's email, product descriptions, and an address where you have one.

What it means for digital products

No delivery address. Most course, software and download sales don't collect one, so the realistic match on Stripe is the purchase IP or a device fingerprint, plus the customer's email or account ID.
Automatic renewals. A renewal charged without the buyer at checkout may carry no purchase IP or device for that payment. Check what your records actually hold for those charges before counting them.
Recent payments don't count. Last month's renewal is inside the 120-day minimum. A buyer whose first payment was less than about four months ago has no qualifying history yet.
Payments Stripe didn't process. If earlier charges ran through another processor, Stripe won't autofill them — and Stripe's CE 3.0 evidence fields identify each earlier payment by its Stripe charge.
Record it at checkout. CE 3.0 can only use what you recorded when the buyer paid: pass the purchase IP, email and a real product description with each charge, not just "Order #123".

Worked example (sample — fictional)

SAMPLE · fictional business, fictional data

Sampleford Learning Co. (fictional) sells online courses through Stripe Checkout. A buyer's course purchase on 3 November 2026 is disputed as Visa 10.4, and the dispute is processed on 20 November 2026 — after 24 October, so Visa's updated rule applies.

Payment (same card, on Stripe)	Date	Counts for CE 3.0?
Starter course	10 February 2026	Yes — well inside the window
Live workshop	18 May 2026	Yes — well inside the window
Monthly community renewal	1 October 2026	No — less than 120 days before

The two counting purchases and the disputed one share the purchase IP 203.0.113.24 (main element) and the customer email (secondary element). Each has a product description. That's the shape Stripe's match test asks for: one main element plus one secondary. The packet still carries the ordinary 10.4 evidence — the buyer's course activity after 3 November — in case CE 3.0 doesn't hold.

Common mistakes

Counting recent renewals. Anything inside 120 days doesn't count, however many there are.
Using it on the wrong code. CE 3.0 is for Visa 10.4 only — not other Visa codes, and not Mastercard, Amex or Discover.
Pairing device ID with device fingerprint. Stripe rejects the pair, and from 24 October 2026 Visa's rule says so explicitly.
Thin product descriptions. Visa asks for a detailed description of what was bought in all three transactions.
Relying on CE 3.0 alone. If the evidence doesn't qualify, the standard evidence is all the issuer has. Submit both.

Sources and what we checked

Visa, Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition: Summary of Changes ("Updates to Compelling Evidence 3.0 for Dispute Condition 10.4", effective 24 October 2026); Section 11.7.5.3, Table 11-28 (invalid disputes); Table 11-29 (dispute time limit); Section 11.7.5.6, Table 11-31 (pre-arbitration).
Stripe, Visa Compelling Evidence 3.0 disputes (fetched 2026-10-15).
Stripe, How does Stripe support Visa Compelling Evidence 3.0? (fetched 2026-10-15).
Stripe, How dispute prevention works — Order Insight and CE 3.0 blocks (fetched 2026-10-15).
Stripe, Respond to disputes — the response window.

This is our summary of Visa's and Stripe's published rules, not legal advice. Visa revises its rules regularly; where this page and Stripe's dispute screen differ, follow Stripe's screen and tell us at hello@thechargebackdesk.com.

Check my dispute — free See a finished sample packet

Want the packet built for you? Start my case. You get a finished, sourced packet, and nothing is submitted without your approval — today you submit it yourself in Stripe, with no Stripe login and no integration. Our fee is 20% of what you recover, charged only if you win. If you lose or we decline, our fee is $0. Stripe's own dispute fees are separate. If a case isn't worth fighting, we'll tell you before you spend time on it.