ChargebackDesk · Reason codes · Visa 10.4

Visa reason code 10.4: Other Fraud — Card-Absent Environment

The cardholder told their bank they did not authorize a purchase made online, by phone, or in-app. It's Visa's fraud code for card-absent purchases — the one online sales fall under. For a course, app, or download, the answer is the record of the buyer's account receiving and using what was bought.

At a glance
Network	Visa
Family	Fraud (10.x)
In Stripe	Usually shown with the reason `fraudulent`; the network code is on the dispute where Stripe exposes it (`network_reason_code`)
Network timeframe	Under Visa's current rules, the cardholder's bank typically has 120 calendar days from the transaction processing date to file
Your deadline	The due-by date on the dispute in Stripe — Stripe says it's usually 7 to 21 days after the dispute opens, depending on the network

What it means

10.4 covers card-absent transactions where the cardholder says neither they nor anyone they authorized made the purchase. It doesn't claim the product was bad or missing — it claims the purchase wasn't theirs. So your evidence has to connect the purchase and the product's use to the cardholder's own account, not just prove the card details were valid.

Response deadline

The deadline that binds you is the evidence due-by date on the dispute in Stripe (evidence_details.due_by). If you don't respond by then, you automatically lose the dispute — work to this date, not to the network's own limits.
Evidence is effectively a single submission — submit a complete packet, because you generally cannot add to it afterwards.
Work backwards: aim to submit at least 72 hours before the due-by date.
If you get an early fraud warning before any chargeback, it isn't a dispute yet — but act on it. Refunding a flagged charge before a chargeback is filed can be cheaper than fighting one, especially when the charge is no bigger than the dispute fee.

What evidence wins

Access / activity log for the buying account. Logins, lesson views, license activations, API calls, downloads — timestamped, after the purchase. Excerpt the first event, the most recent event, and the busiest session, with totals stated.
Delivery tied to the buyer. Account creation on or after purchase, license issuance, or a welcome email delivered to the email on the charge.
Customer communication. Support tickets or emails from the buyer about the product, as complete threads.
Receipt + product description. What was sold, when, for how much, how it was delivered.
Purchase IP and device as corroboration only. They can corroborate account activity. They are not proof of who a person is.

Compelling Evidence 3.0 (CE 3.0)

Visa's rule, as Visa describes it. Under Visa's current rules, Compelling Evidence 3.0 applies to 10.4 only. In outline: if the same card was used with you in at least two earlier transactions the issuer didn't report as fraud, processed more than 120 and no more than 365 days before the dispute, and those transactions match the disputed purchase on at least two data points — the device ID/fingerprint or IP address, plus at least one more from customer account or login ID, full delivery address, device, or IP — the dispute is invalid and liability stays with the cardholder's bank. Visa sets the exact rules and is expanding them for disputes processed on or after 24 October 2026 (including qualifying prior transactions at other merchants). This outline is our summary of Visa's rule, not yet checked against Visa's own guide — Stripe's implementation below is what decides your dispute on Stripe.

On Stripe: what Stripe's CE 3.0 implementation requires

Timing: at least two prior transactions within 120–364 days of the disputed transaction (counted from the disputed transaction, not from the dispute).
Which prior transactions count: the same payment method as the disputed transaction; paid; undisputed; and not validation charges.
The match: two main elements, or one main element plus one secondary element. Main: the purchase IP address; the device fingerprint or device ID. Secondary: the shipping address; the customer email address; the customer account ID. A device fingerprint plus a device ID together is not a valid pair.
Descriptions: product descriptions for the disputed transaction and the prior ones, and the disputed transaction categorized as merchandise or services (merchandise_or_services).
Autofill: Stripe fills in the CE 3.0 evidence for you only when Stripe processed all of the prior undisputed transactions. Stripe flags disputes that may qualify (in the API, see enhanced_eligibility_types on the dispute) — check your dispute's eligibility in Stripe rather than assuming it.

For digital sellers with repeat buyers or renewing subscriptions, this can matter more than anything else in the packet — when the earlier payments fall inside that window.

Digital-goods specifics

Online courses: lesson-completion and video-progress events are the clearest evidence. A buyer who finished four modules after purchasing is hard to describe as unauthorized.
SaaS: logins, created projects, API keys generated, seats invited. Earlier paid renewals on the same payment method can help under CE 3.0 — but on Stripe they count only when they fall 120–364 days before the disputed transaction, so last month's renewal doesn't.
Downloads and licenses: download logs and license activations, with timestamps and the activating account.
Memberships and communities: posts, comments, event attendance, and DMs from the member's account after the charge.
No logs? Without post-purchase activity this code is usually hard to answer. The fix is turning on log retention now, before the next dispute.

The minimum checklist

The same minimum we apply in our fraudulent-dispute guide — below it, we refuse the case:

ME-F1 — at least one post-purchase access event with a timestamp at or after purchase.
ME-F2 — purchase IP present AND at least one access-log IP present (exact match not required).
ME-F3 — customer name and email from the charge record.
ME-F4 — delivery provable: delivery email log, license record, or account creation on/after purchase.

Common mistakes

Leading with AVS/CVC matches. They show the card details were valid, which a stolen card also passes. Usage is the rebuttal.
Calling a checkbox a signature. It isn't one; presenting it that way undercuts everything around it.
Speculating about the cardholder. State what was bought, delivered, and used. Nothing about motives.
Missing CE 3.0 when it was available. If the buyer has paid you before on this payment method, look for prior transactions 120–364 days before the disputed one before writing anything else.

Fight or accept?

Fight it when

Post-purchase activity on the buying account is in your logs.
The buyer has earlier paid, undisputed purchases on the same payment method, 120–364 days before the disputed transaction, that may qualify for CE 3.0.
The buyer contacted support about the product after paying.

Accept it when

There is no access, download, or activation after the purchase, and no prior relationship with the buyer.
Your own records show signs of real card testing or account takeover (a burst of new accounts, mismatched details, no usage).
The amount is smaller than the time it would take you to assemble the evidence.

Accepting a chargeback in Stripe closes it (accepting an inquiry doesn't resolve it — answer it with evidence or a full refund instead). Don't try to refund an open chargeback — the disputed amount has already been withdrawn from your balance, and Stripe doesn't allow refunds outside the dispute process while the dispute is open.

Got it as an inquiry? (Rare — Stripe notes Visa no longer uses that stage; Amex and Discover do.) Answer it with a narrative plus the single strongest exhibit — for 10.4, the access-log excerpt for the buying account. If the cardholder is right, a full refund resolves an inquiry with no Stripe dispute fee; accepting an inquiry doesn't resolve it.

Run this checklist on your dispute — free See a finished sample packet

Want the packet built for you? Start a case. You get a finished, sourced packet, and nothing is submitted without your approval — today you submit it yourself in Stripe, with no Stripe login and no integration. Our fee is 20% of what you recover, charged only if you win. If you lose or we decline, our fee is $0. Stripe's own dispute fees are separate. If a case isn't worth fighting, we'll tell you before you spend time on it.