Visa Compelling Evidence 3.0 explained for subscription merchants

Subscription businesses have one advantage in fraud disputes: history. A customer who has paid every month for a year and then disputes the thirteenth renewal as “unauthorized” has left a trail of earlier, undisputed payments on the same card. Visa’s Compelling Evidence 3.0 (CE 3.0), in force since April 2023, turns that trail into a formal remedy.

This guide explains what CE 3.0 is, which disputes it covers, what data you need, and how a subscription business can be ready for it. It relies on Visa’s own documents: the CE 3.0 merchant readiness guide (March 2023), the Evolution of Compelling Evidence merchant FAQ and the Dispute Management Guidelines for Merchants (June 2024), plus Stripe’s CE 3.0 API docs and support article (accessed November 2026). Where sources word a rule differently, we say so.

What CE 3.0 is for

CE 3.0 targets first-party misuse: a cardholder who made a purchase, or whose household did, and then reports it as fraud. Visa’s idea is simple: if the same cardholder, on the same card, made earlier purchases from you that they did not dispute, and the identifying data matches, the disputed purchase was very likely theirs too.

It is not a magic win. Visa’s guidelines state that compelling evidence is not a remedy that guarantees an outcome, and Stripe’s support article says issuers still have discretion. But when the conditions are met, the case is much stronger, and Stripe’s dispute prevention docs describe cases where the issuer must block the dispute when qualifying evidence is shared before it is filed.

Which disputes qualify

CE 3.0 applies only to Visa disputes with reason code 10.4, Other Fraud: Card-Absent Environment. It does not cover 13.2 (cancelled recurring) or other consumer disputes; those need their own evidence (see reason codes for subscriptions).

The conditions

Two prior transactions

You need at least two prior transactions on the same card that:

• were settled between about 120 and 365 days before the dispute. Visa’s 2024 guidelines say 120 to 365 calendar days prior to the dispute processing date; Stripe’s API docs say within 120 to 364 days of the disputed transaction; Stripe’s support article says more than 119 and fewer than 366 days. The differences only matter at the edges;
• were not reported as fraud and are not disputed. Stripe adds that they must be paid and cannot be validation charges (such as a zero-amount card check).

Visa’s FAQ also states the obvious consequence: CE 3.0 is not available for a first-time transaction. A customer in their first four months with you cannot qualify, because no payment is old enough.

Matching data

The prior transactions and the disputed one must share identifying data. Visa’s March 2023 readiness guide describes four core data elements:

Element	Example for a SaaS
User ID	Your customer account ID or login
IP address	IP at checkout or login for that payment
Device ID or fingerprint	A device identifier from your app or checkout
Shipping address	Usually not relevant for digital goods

At least two elements must match, and one of the two must be the IP address or the device ID or fingerprint. Stripe’s API docs describe the same rule in their own terms: two main evidence elements, or one main element plus one secondary element. Because the wording varies between documents, check the current requirements with your processor.

For a subscription, the practical combination is customer account ID plus IP address or account ID plus device ID.

Product description

Stripe also asks for a description of what was purchased for each transaction, and its prevention onboarding asks merchants to pass product descriptions, IP address and customer email on payments so CE 3.0 can work.

The subscription problem: renewals have no IP

Here is the catch for recurring billing. A renewal is merchant-initiated: no customer is at a browser when it runs, so the payment itself has no IP address or device ID attached. If you only record the IP at signup, your history may have one data point, not one per transaction.

What you can do:

1. Record IP and device at every customer session, not just checkout. Store them with timestamps against the customer account ID.
2. Link each renewal to the most recent session before it. When you build evidence, show the IP and device the customer used around each billed period.
3. Pass the customer’s IP when the customer is present, for example on upgrades, card updates and the first payment.
4. Keep the data for at least a year and a few months. The prior transactions can be up to a year old, and the dispute itself can arrive months after the charge.

Whether issuers accept session data in place of transaction-time data is up to Visa’s rules and the issuer; your processor’s CE 3.0 tooling tells you which fields it sends.

How it works on Stripe

Stripe’s CE 3.0 docs describe the flow:

• For Visa 10.4 disputes, Stripe evaluates your transaction history automatically.
• The dispute’s enhanced_eligibility_types includes visa_compelling_evidence_3 when it may qualify.
• You provide the data in the enhanced_evidence object of the dispute evidence: the disputed transaction’s details and the prior transactions with their identifiers.
• The status in evidence_details.enhanced_eligibility.visa_compelling_evidence_3.status is qualified, requires_action or not_qualified.
• Stripe tries to fill in prior transactions automatically when it has the data. If the evidence turns out not to qualify after submission, it is still submitted, just not as CE 3.0.

Stripe’s changelog lists the API support in the 2024-10-28 release. Other processors offer CE 3.0 in their own way; check their docs.

Recent changes to watch

Visa’s merchant business news digest announced two updates: from 17 October 2025, Visa began qualifying some transactions for CE 3.0 automatically through Visa Secure, and from 17 April 2026, Visa introduced a fee associated with successful qualifications. Visa’s merchant FAQ and acquirer FAQ also word the original start date differently (pre-arbitration attempts versus disputes processed on or after 15 April 2023). Ask your processor how these changes apply to your account and who bears the fee.

Building the evidence

A CE 3.0 response for a subscription looks like this:

1. Disputed transaction: date, amount, product description (“Pro plan, monthly, March 2026”), customer account ID, IP and device from the nearest session.
2. Prior transaction 1 and 2: same card, 120 to 365 days old, undisputed, with the same account ID and matching IP or device.
3. Cover note: one paragraph tying them together. “Customer acc_123 has paid 14 monthly renewals on this card since January 2025. The two renewals listed were made from the same account and IP. The account was active on the following dates around the disputed charge.”
4. Supporting usage: logins and activity in the disputed period, which helps even if CE 3.0 does not apply.

Keep it short. The issuer reads structured data first.

Common reasons it fails

• Not 10.4. CE 3.0 does not apply to other codes.
• Prior transactions too recent. Monthly customers under four months old cannot qualify.
• No IP or device data. Account ID alone is not enough.
• Card changed. Prior transactions must be on the same card. A customer who updated their card recently starts again.
• Earlier disputes. If a prior transaction was disputed or reported as fraud, it cannot be used.

Should you rely on it?

CE 3.0 is a strong tool for long-lived subscriptions and useless for new ones. It works best alongside prevention: a clear descriptor, renewal reminders, and an easy cancel so customers do not reach for the fraud button. Fraud disputes still count toward your network ratios even when you win, so preventing them is worth more than winning them.

Doing this with NoChurn

When a Stripe or Braintree dispute arrives, NoChurn gathers evidence automatically: usage and custom data you send by API (such as logins with IP and device), cancel flow answers, emails sent and help desk conversations (read only). It drafts the reply with AI and sends nothing until a person on your team has reviewed it. Whether a case qualifies for CE 3.0 is decided by Visa’s rules, your processor and the issuer. See chargebacks and NoChurn + Stripe.