Visa Compelling Evidence 3.0 (CE 3.0) for Subscriptions

Who this helps: you run a subscription business, some of your Visa disputes are "I didn't authorize this" claims from customers who clearly did, and you want to know whether CE 3.0 can stop them, what data it needs, and what changes in October 2026.

A customer who forgets a subscription can report the charge as fraud with one tap in a banking app. Until April 2023, a merchant could only argue back, and the customer's bank was free to disagree. Visa's Compelling Evidence 3.0 changed the outcome: when the customer's own purchase history matches, the fraud claim is invalid. Here is what qualifies, what to do when a fraud dispute lands, what changes on October 24, 2026, and where subscriptions fall short.

What is Visa Compelling Evidence 3.0?

Compelling Evidence 3.0 (CE 3.0) is a Visa rule, in force since April 15, 2023, that makes a fraud claim invalid when the customer's own purchase history shows they made the purchase. It covers one dispute type, a fraud claim on an online purchase (Visa's reason code 10.4), and when the evidence qualifies, the customer's bank takes the loss instead of you. Visa writes it CE3.0, and its rulebook calls it the remedy rule.

In chargebacks, compelling evidence is the proof a merchant sends to show the customer really made the purchase. What CE 3.0 changes is the outcome: ordinary evidence is an argument the customer's bank weighs and can reject, while CE 3.0 evidence is what Visa calls a way to “remedy the dispute rather than supply compelling evidence”, so a qualifying claim ends there.

Visa built it for friendly fraud, the dispute a genuine customer files against a purchase they made. For a subscription business, that is often a customer who forgot the subscription or didn't recognize the charge.

What does a dispute need to qualify for CE 3.0?

Three things, all on the same card: two earlier charges that were never reported as fraud, a description of what was bought each time, and customer data that matches across all three charges. The two earlier charges must have been processed more than 120 days and no more than 365 days before the dispute, counted from the dispute rather than from the charge being disputed.

You need two matches. One must be the IP address or the device; the other can be any other item below, but a device ID and a device fingerprint never count as two.

The data Visa can match for CE 3.0 (as of October 2026)

Processors word the rule slightly differently. Stripe's documentation, for example, counts 120 to 364 days from the disputed charge and accepts the customer's email as a second match, so check your processor's version before relying on a dispute near the edges of the window.

Does CE 3.0 work for subscription renewals?

Yes. Visa's published FAQ says CE 3.0 is available for recurring transactions, and that the merchant supplies the data from the original signup for the disputed renewal and both earlier charges.

Renewals run without the customer present, so no IP address or device is captured when they are charged. Save that data at signup and keep it with the subscription: the IP address, the device fingerprint or ID, and the login, held while the subscription runs and for at least 120 days after its last charge, the time a customer's bank has to file a fraud claim.

Digital subscriptions have one option fewer. Visa does not let a billing address stand in for a delivery address when nothing is shipped, so a software or content subscription qualifies on the IP address or device plus the login.

When can a subscriber's dispute qualify?

About five months after signup on a monthly plan, about seven on a quarterly plan, and never on an annual plan renewing on its own. The rule needs two earlier charges more than 120 days before the dispute, and a subscriber builds that history only with time.

Omar signs up for your $19 monthly language app on January 10, from his phone. On July 5 he reports his June renewal as fraud. His January and February charges were processed 176 and 145 days before the dispute, neither was reported as fraud, and all three charges carry the IP address and login from his January signup, so the claim is invalid and his bank takes the loss. Had he disputed his April renewal on May 5, none of his charges would have been more than 120 days old.

A dispute on the first paid charge after a free trial can never qualify. There are no earlier charges, and Visa's FAQ confirms CE 3.0 is not available for first-time transactions.

Should you use CE 3.0 before or after the dispute is filed?

Before, whenever you can. Visa accepts the same evidence at two points, and only the first keeps the dispute off your record.

Before the dispute exists, the evidence goes through Order Insight, a Visa service run by Verifi that shows your order details to the customer's bank while the customer is still asking about the charge. When those details meet the CE 3.0 rules, Visa rejects the dispute before it is created, and Visa says a dispute stopped this way doesn't count toward your dispute numbers at all. Stripe states that it carries no dispute fee either. Ask what your provider charges for Order Insight itself, and weigh that against the fee and the mark on your record it saves.

After the dispute is filed, the remedy still works, but later. Your processor or acquiring bank (the bank that holds your merchant account) sends the evidence in its response, a step called pre-arbitration, and Visa removes the fraud report, called a TC40. The dispute itself has already arrived, with your processor's dispute fee ($15 at Stripe, for example).

Visa's monitoring program, the Visa Acquirer Monitoring Program (VAMP), counts fraud reports and disputes together and leaves out only disputes resolved before they are filed. Stripe's documentation notes that a charge in both reports counts twice, so clearing a 10.4 before it is filed can take two marks off your VAMP ratio, while clearing it afterwards takes one.

What should you do when a fraud dispute arrives?

Three checks, in this order. The last one decides whether you submit CE 3.0, send other evidence or accept the dispute.

1. Check the code. CE 3.0 only helps on Visa reason code 10.4. A canceled recurring dispute or any other consumer dispute needs a different response.
2. Count back from the dispute date. Look for two charges on the same card more than 120 days and no more than 365 days before it, neither reported as fraud, carrying the same signup data.
3. Submit or decide. If they qualify, submit CE 3.0 through your processor before its response deadline; Stripe, for example, flags eligible disputes and fills in the evidence. If they don't, send Visa's standard evidence or accept the dispute, using the math in our guide to whether to refund, fight or keep.

What changes on October 24, 2026?

Visa widens CE 3.0 on October 24, 2026, and the largest change is where the two earlier charges can come from. Until then they are charges at your business; from that date, Visa's rule allows them to be “at one or more Merchants”.

CE 3.0 before and after October 24, 2026

On paper, history from other merchants narrows the gap for new subscribers, whose card may already have charges elsewhere. In practice, those charges still have to match your disputed charge on the IP address or device plus one more item, and only a processor or network that sees both sides can make that match. Ask your processor whether it will use other merchants' history, and from what date.

What does CE 3.0 not cover?

Four kinds of dispute, and a subscription business meets all of them. CE 3.0 covers only Visa's fraud code, only customers with enough history, and only Visa cards.

1. "I canceled" disputes. Visa itself notes that subscription disputes are often filed as canceled recurring transactions, reason code 13.2, rather than as fraud, and CE 3.0 does nothing for them.
2. New customers. A first purchase, a trial conversion and a monthly subscriber's first few months have no qualifying history.
3. Annual plans. A plan that charges once a year never has two charges inside the window on renewals alone.
4. Mastercard. Mastercard's First-Party Trust works differently and does not publish its thresholds.

For fraud claims CE 3.0 misses, Visa's standard compelling evidence still applies, as an argument rather than a remedy. For a recurring charge, Visa accepts three things together: a contract with the customer, proof the customer is using the service, and an earlier charge that was not disputed. For digital goods, it accepts two or more signals such as the IP address, the device, and records that the customer used your site or app on or after the charge date.

For "I canceled" disputes the answer sits earlier in the process: an alert from Visa's RDR and CDRN or Mastercard's Ethoca networks that lets you refund before a chargeback, a statement descriptor customers recognize, and a cancellation that works.

What should a subscription business set up now?

Five things, in the order to do them. Each one decides whether a future dispute qualifies.

1. Store the signup data. Save the IP address, the device fingerprint or device ID in Visa's formats, and the login with each subscription, and keep them for at least 120 days after its last charge.
2. Describe every charge. Keep a specific description of each charge, such as "Pro plan, monthly, March 2026". Visa requires one for all three charges.
3. Keep your descriptor's start fixed. Visa matches your charges by descriptor from left to right, so keep the leftmost characters the same and put any variable part on the right. Evidence cannot cross separate business lines.
4. Turn on the pre-dispute route. On Stripe, CE 3.0 blocks run through its built-in dispute prevention; on other processors, Order Insight comes through a Verifi partner. Either way, the processor or partner answers Visa's lookups with your CE 3.0 data.
5. Check where your history lives. Stripe's documentation, for example, requires that Stripe processed the earlier charges, so a monthly subscription base moved to Stripe has no CE 3.0 history there for about five months after the move.

FAQ

Rules checked against the Visa Core Rules (18 April 2026 edition), Visa's Compelling Evidence FAQs, Visa's VAMP fact sheet, and Stripe's Compelling Evidence 3.0, dispute prevention and monitoring programs documentation. Last reviewed 7 October 2026.