Visa Compelling Evidence 3.0 on Stripe: 120 to 365 Day Rules
On a Visa fraud dispute (reason code 10.4), CE 3.0 moves the loss to the cardholder's bank when the same customer paid you at least twice before, 120 to 365 days earlier, with matching details such as the IP address or email.
1. The 120 to 365 Day Window
CE 3.0 covers Visa fraud disputes on payments where the card wasn't present, such as an online checkout. Link the disputed payment to at least two earlier payments on the same card.
Both earlier payments must have settled 120 to 365 days before the disputed one, with no refund and no dispute. Renewals from the last 30, 60, or 90 days don't count.
2. Matching Details and the Device Trap
Across the disputed payment and both earlier ones, at least two customer details must match, and one of them must be a main detail:
customer_purchase_ip), device ID (customer_device_id), device fingerprint (customer_device_fingerprint).customer_account_id), email (customer_email_address), shipping address (shipping_address).3. Where to Find These in Stripe
Stripe checks your payment history for CE 3.0 on Visa fraud disputes. When a dispute qualifies, Stripe tells you on the dispute page and by email, and fills in the evidence. Leave those fields as they are.
The payment's risk insights in Stripe show the customer's IP address for 6 months, when your checkout sends it. For earlier payments older than that, take the IP address from your own logs. Where to find each detail in Stripe.
4. For Developers: the enhanced_evidence Payload
When you answer through the API, pass both earlier charge IDs (ch_...) in evidence., with the same matched details you send on disputed_transaction.
Questions
Yes, on Visa fraud disputes. Stripe tells you on the dispute page and by email when a dispute qualifies, and fills in the evidence. Leave those fields as they are.
No. Both earlier payments in the 120 to 365 day window must stay settled, with no refund, no dispute, and no fraud report from the bank (a TC40).
customer_device_id and customer_device_fingerprint by themselves?
No. Visa doesn't accept those two device fields alone. Also match customer_purchase_ip, customer_account_id, customer_email_address, or shipping_address.
The form opens on a Visa fraud dispute and tests the 120 to 365 day window and the matching details.