Visa Compelling Evidence 3.0 (CE3.0): What the October 2026 Change Means for Subscription Businesses

By Risk team, CatalystPay 

 

Quick answer

Visa Compelling Evidence 3.0 (CE3.0) lets a merchant invalidate a Visa 10.4 "card-absent fraud" dispute by proving the same cardholder made two earlier, undisputed purchases 120 to 365 days before the dispute, with matching device or IP data. From 24 October 2026, those two earlier purchases can come from one or more merchants and from a token linked to the card, not only from your own history. Subscription businesses are best placed to qualify, because recurring billing builds exactly the purchase history the rule needs.

Contents

1. What is Visa Compelling Evidence 3.0?
2. What changes on 24 October 2026
3. Why subscription businesses are the best fit for CE3.0
4. Where CE3.0 will not help you
5. The multi-acquirer catch in pre-arbitration
6. Your checklist before 24 October
7. How CatalystPay helps
8. FAQ

What is Visa Compelling Evidence 3.0?

Compelling Evidence 3.0 is the remedy in Visa's dispute rules for Dispute Condition 10.4: Other Fraud, Card-Absent Environment. That is the reason code an issuer uses when a cardholder says "I didn't make this online purchase".

Some of those claims are first-party misuse: the cardholder, or someone in their household, did make the purchase and later reports it as fraud. Visa introduced CE3.0 in April 2023 to counter rising first-party misuse and to balance the cost of cardholder behaviour more fairly between issuers and merchants. It gives you a structured way to prove the cardholder took part, using transaction history.

If your evidence meets the rule, the dispute is invalid. Visa gives merchants two routes: before a dispute is raised, through Verifi Order Insight when the issuer queries the transaction, or after it, through your acquirer in pre-arbitration.

Here is what the rule asks for today, in plain terms:

 

Requirement	What Visa asks for
Dispute type	Visa Dispute Condition 10.4 (card-absent fraud) only
Prior history	2 earlier transactions on the same payment credential that the issuer did not report as fraud
Age of that history	Processed more than 120 calendar days before the dispute, and no more than 365 calendar days before it
Matching data	The device ID or device fingerprint, or the IP address, plus at least one more element that matches between the earlier and the disputed transactions: customer account or login ID, full delivery address, device ID or fingerprint, IP address
Description	A detailed description of what was bought in the disputed transaction and both earlier ones (or, for some Visa Secure transactions, a purchase order number)

The data rules are strict. The account or login ID, delivery address, device ID and IP address must be in clear text and not hashed. A device ID must be at least 15 characters. A device fingerprint must be built from at least two device properties and be at least 20 characters, and it is the only element that may be hashed.

What changes on 24 October 2026

Visa's April 2026 rules update describes the change as expanding the availability and application of CE3.0 to reduce friendly fraud, and adding support for multi-merchant transactions as evidence. It touches two rules: Section 11.7.5.3 (Invalid Disputes, ID# 0030254) and Section 11.7.5.6 (Pre-Arbitration Processing Requirements, ID# 0030257).

We compared the old and new wording line by line. These are the differences that matter.

	Disputes processed up to 23 October 2026	Disputes processed from 24 October 2026
Whose history counts	The same payment credential (for example the card number or a token) used in 2 previous transactions	The same card, or a payment credential associated with it (for example a token), used at one or more merchants in 2 previous transactions
The 120-day point	More than 120 calendar days old (and no more than 365)	More than 120 calendar days before the dispute was submitted (and no more than 365 before its processing date)
Purchase order number instead of a description	E-commerce transactions using Visa Secure with ECI 7 and a CAVV	E-commerce transactions with ECI 7 using Visa Secure (valid CAVV), Visa Token Service (valid TAVV) or Visa Intelligent Data Exchange (valid IDX Match Key); the purchase order number must be the one sent to the cardholder
Account or login ID	The ID the cardholder uses on your site or app	Also includes login IDs for an agentic payment provider
Device ID and fingerprint	Clarified for pre-arbitration only	Visa states for both routes that they are similar data elements: you cannot submit both as your two matches
Pre-arbitration evidence	No acquirer restriction stated	The acquirer must only submit transaction data it accepted and processed
Scope	Global	Global, except Chile

Three things stand out.

1) Тokens and the card are now explicitly joined up. Subscription merchants increasingly store network tokens rather than card numbers. The new wording ties a token back to the card it represents, so history built on a token and a dispute on the same card can be connected.

2) Тhe history can sit outside your business. "At one or more merchants" opens the door to purchase history from other merchants on the same card. How that history reaches you in practice, especially before a dispute, is not spelled out in the public rules, so treat it as a door opening rather than something you can switch on today.

3) Pre-arbitration stays acquirer-bound. If you fight the dispute after it lands, through your acquirer, the evidence can only include transactions that acquirer processed. More on why that matters in section 5.

Why subscription businesses are the best fit for CE3.0

Our risk team's view is simple: CE3.0 is hard for most merchants to use, because you need two earlier undisputed transactions on the same card, 120 to 365 days before the disputed one. A one-off shop rarely has that history. A subscription business builds it automatically with every renewal.

That makes CE3.0 most useful for recurring models, which in high-risk is a long list: dating and adult memberships, nutra and peptide continuity programmes, trading education and signal subscriptions, and skill-game or sweepstakes passes.

How soon does a subscriber qualify?

The 120-day floor is the constraint. Here is how it plays out for a subscriber billed from day 0, assuming the dispute is submitted about 10 days after the charge it disputes. This is an illustration of the arithmetic, not a Visa rule.

Billing cycle	Charges (day)	First disputed charge with 2 qualifying earlier charges	Why
Monthly	0, 30, 60, 90, 120, 150 ...	The day-150 charge (the 6th payment)	Dispute submitted around day 160; the day-0 and day-30 charges are both more than 120 days old
Quarterly	0, 90, 180, 270 ...	The day-270 charge (the 4th payment)	Dispute submitted around day 280; the day-0 and day-90 charges both qualify
Annual	0, 365, 730 ...	None on your own history	There can never be 2 of your own charges inside the 365-day window

In practice, CE3.0 protects your established subscribers, not your newest ones.

Renewals have no IP address. Visa allows for that.

A merchant-initiated renewal happens without the customer being on your site, so there is no live IP address or device to capture. Visa's merchant FAQ on CE3.0 confirms that CE3.0 works for recurring merchant-initiated transactions, and that the IP address from the customer's first customer-initiated transaction can be carried onto the later renewals used as evidence.

The practical consequence: the sign-up session is your most valuable piece of evidence. If you do not store the IP address, device fingerprint and login ID from sign-up, and attach them to every renewal record, your renewals cannot qualify, however long the customer has been paying.

Where CE3.0 will not help you

Be realistic about the boundaries. CE3.0 does not help with:

• Cancelled-subscription disputes. "I cancelled and you charged me" is Dispute Condition 13.2 (Cancelled Recurring Transaction), not fraud. CE3.0 applies to 10.4 only. For 13.2, your defence is clear cancellation flows and the subscription controls Visa already requires (see our guide to Visa rule 0031078 and subscription management controls).
• New subscribers and first purchases. No history, no remedy.
• Annual plans on their own history. As the table shows, the 365-day window cannot hold two of your own annual charges.
• Earlier transactions already reported as fraud. A prior transaction only counts if the issuer did not report it as fraud before the dispute was processed. (A prior non-fraud dispute on it does not disqualify it.)
• Data you hashed or never captured. Hashed login IDs, hashed IP addresses and partial addresses do not meet the rule, and a single missing element can mean you no longer have the two matches you need.

The multi-acquirer catch in pre-arbitration

From 24 October, when your acquirer submits CE3.0 evidence in pre-arbitration, it must only submit transaction data that it accepted and processed.

For a single-acquirer merchant, that changes little. For a subscription business routing across two or more acquirers, it matters a lot.

Imagine a subscriber whose renewals alternate between Acquirer A and Acquirer B, and who disputes a charge processed by Acquirer A. Only the earlier renewals that Acquirer A processed can be used in that pre-arbitration. If routing spread the history evenly, you may have split one qualifying customer into two non-qualifying halves.

That does not mean you should give up acquirer redundancy. In high-risk, a back-up acquirer is what keeps you trading when one changes its appetite. It means your routing logic should treat recurring renewals differently from one-off payments:

• Keep each subscriber's renewals on the acquirer that processed their sign-up, wherever approval rates allow.
• When you must move a subscriber (a decline, a cap, an acquirer exit), know that their CE3.0 history with the new acquirer starts again for pre-arbitration purposes.
• Log which acquirer processed each renewal, so your dispute team knows which history it can use before filing.

Your checklist before 24 October

1. Capture the sign-up session in full. Public IP address in clear text (IPv4 or IPv6), a device fingerprint of at least 20 characters from at least two device properties, and the customer account or login ID in clear text.
2. Carry it forward. Attach the sign-up IP address and fingerprint to every merchant-initiated renewal record, so each renewal can serve as evidence later.
3. Store full delivery addresses where you ship. Physical continuity products (nutra, peptides, supplements) can use the delivery address as a second match.
4. Write descriptions a cardholder recognises. Plan name, term and price on every charge, because the rule needs a detailed description of the disputed and earlier transactions.
5. Keep your descriptor consistent. Visa's guidance is to keep merchant descriptors as consistent as possible: keep the leftmost characters stable and put any variable part on the right.
6. Use tokens, and know they count. The new wording links tokens to the card, which removes one reason older history used to fail to match.
7. Use Visa Secure or Visa Token Service where you can. For e-commerce transactions with ECI 7 and a valid CAVV or TAVV, a purchase order number sent to the cardholder can replace the detailed description in the invalid-dispute evidence. The pre-arbitration requirements still ask for a detailed description, so keep both.
8. Ask your acquirer and gateway three questions. Do you support CE3.0 through Order Insight before the dispute and in pre-arbitration after it? Which data fields do you pass through? How will you handle the new acquirer-only rule in pre-arbitration?
9. Make routing subscription-aware. See section 5.

How CatalystPay helps

At CatalystPay, we work with high-risk merchants that already run their own payments, and we know the gap between a rule being published and a merchant actually benefiting from it.

Here is how we would approach CE3.0 with you:

• Data readiness review. We check that your gateway and acquirers receive and pass the fields CE3.0 needs, in the right format, from sign-up through every renewal.
• Subscription-aware routing. Across our 30+ regulated acquirers, we design routing that keeps redundancy without splitting each subscriber's dispute history. See payment strategy and optimisation.
• Dispute strategy beyond CE3.0. CE3.0 sits alongside Visa RDR, clean cancellation flows and the chargeback controls subscription merchants need. We help you decide which tool handles which dispute.

If you run recurring billing in dating, adult, nutra or another high-risk vertical, talk to us about getting your CE3.0 data right before your next dispute lands.

 

Related reading: Subscription payment processing in 2026 and VAMP · Visa's Acquirer Monitoring Program (VAMP) · Network tokens explained · Chargeback prevention tools for 2026 · Dating payment solutions · Adult payment processing · High-risk merchant accounts