When a cardholder says they did not make an online purchase, the merchant bears the loss unless it can show otherwise. Visa has a rule for that, known as Compelling Evidence 3.0, and on 24 October 2026 it widens. The evidence can now include the cardholder's earlier purchases at other merchants, not only the one being disputed.
It is a change to one dispute type and it is narrower than the headlines suggest. It is still worth knowing before the date, because it changes what a merchant is able to prove and what an acquirer is allowed to submit.
What the rule is
The rule applies to Visa dispute condition 10.4, other fraud in a card-absent environment. This is the claim that the cardholder did not make or authorise an online or telephone purchase. Some of these claims are what the industry calls friendly fraud: the cardholder did make the purchase and either forgets it or disputes it anyway.
Compelling Evidence 3.0 lets the merchant answer with history. If the same cardholder made two earlier purchases that the issuer never reported as fraud, and enough details match the disputed one, the rules treat the claim as invalid, and an acquirer can use the same kind of evidence when answering a dispute in pre-arbitration.
What changes on 24 October
For disputes processed on or after that date, the rule moves in three ways.
| Until 23 October | From 24 October | |
|---|---|---|
| Whose earlier purchases | The same payment credential, such as the card number or a token | The same card, or a credential linked to it such as a token, at one or more merchants |
| Substitute for a product description | A purchase order number, for Visa Secure transactions only | A purchase order number, for ECI 7 transactions with a valid CAVV, a valid TAVV from Visa Token Service or a valid Match Key from Visa Intelligent Data Exchange |
| Login ID as matching evidence | The login on the merchant's own site or app | Also logins at an agentic payment provider |
In pre-arbitration there is a new limit. An acquirer may submit only transaction data that it accepted and processed itself.
What stays the same
- The two earlier purchases. Two qualifying earlier purchases are still required. A buyer with no earlier history that meets these criteria, at this merchant or any other, cannot be defended this way.
- The age of the purchases. Each must be more than 120 calendar days before the dispute was submitted and no more than 365 days before its processing date. The 120-day minimum does not apply to original credit transactions.
- No fraud reported. The issuer must not have reported either earlier purchase as fraud before the disputed one was processed.
- The matching details. The device ID or device fingerprint, or the IP address, must match, together with at least one of the other listed details: the login ID, the full delivery address, the device ID or the device fingerprint, or the IP address. A device ID must be at least 15 characters and in clear text. A device fingerprint must be at least 20 characters and may be hashed. The IP address must be public and in clear text.
- The description. A detailed description of what was bought is needed for the disputed purchase and for both earlier ones.
What the rule does not do
- It does not cover other disputes. Goods not received, not as described and cancelled subscriptions are different conditions with their own evidence.
- It is not a guarantee. It sets what a merchant may submit, and the issuer can still decline liability.
- It does not replace the 3-D Secure rules. 3-D Secure has separate authentication and liability-shift rules, which this change does not replace. We explain them in our article on the liability shift.
- It does not apply to Mastercard. It is a Visa rule.
- It does not apply everywhere. In Chile the cross-merchant provision for invalid disputes does not apply.
One point is not settled by the rule text. It does not say how a merchant would obtain another merchant's purchase data, and the pre-arbitration limit means an acquirer can use only its own. Whether the wider rule helps a given merchant will depend on data-sharing services and on what its acquirer supports. Ask the acquirer before relying on it.
What to do before 24 October
For merchants:
- Keep the data. The evidence window runs to 365 days, so we advise keeping order records with the login ID, delivery address, device details and IP address for each payment for at least that long, in a form that can be matched later. Visa's rule sets the window, not a retention period, and your own privacy obligations still apply.
- Capture it cleanly. Match details must be in clear text, with a minimum length for device identifiers. A hashed value is acceptable only for the device fingerprint.
- Describe what was sold. Apart from the narrow purchase-order-number route in the table above, an order number alone is not a detailed description of the goods or services purchased.
- Ask your provider. Ask whether it supports the October change and in what form the evidence has to reach it.
For acquirers and providers:
- Check the submission path. Make sure the evidence your merchants send meets the new formats and that your systems submit only data you processed.
- Mind the device data. The rule counts the device ID and the device fingerprint as similar, so an acquirer cannot supply both and must offer a different data element for the second.
- Brief the merchants. Those with a high rate of card-absent fraud claims have the most to gain, and the most to get wrong.
Why it matters beyond one dispute
Every chargeback counts against a merchant's ratio, and providers treat that ratio as a sign of risk. A rule that lets a merchant defeat friendly fraud with history is therefore also a rule that keeps a ratio down. Our article on chargebacks explains why the ratio matters, and the one on high-risk merchant accounts shows what a provider does when it rises.
How Payments Marketplace can help
Payments Marketplace does not process payments or contest disputes, and it cannot change what Visa allows. What it does is help a business find a provider that suits it before it applies. Its free pre-flight check scores your business against each provider's published underwriting rules and scans your website for the policies and company details whose absence tends to lead to disputes, so you can fix them first.
You can then send an anonymised application to the provider you choose. It sees no name or contact details until it accepts, and a match is an introduction, not an approval: the provider still decides. Providers receive applications already screened against their criteria, with the merchant's identity withheld until they accept.
Merchants can run the free pre-flight check. Providers can read how it works for providers, and ISOs how it works for ISOs.
Sources
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: the Summary of Changes entry for 24 October 2026, and sections 11.7.5.3 and 11.7.5.6 on Dispute Condition 10.4
- Pulse: Visa's Compelling Evidence 3.0 changes on 24 October