November 2, 2026 · Disputed Team
For the full eligibility and evidence checklist, start with our Visa Compelling Evidence 3.0 merchant guide.
A customer buys from your store for the first time. A few days later, they tell their bank they never authorized the transaction.
You might have a clean authorization, a receipt, and proof of delivery. What you don't have is two earlier purchases from that customer at your store. Under the original Compelling Evidence 3.0 (CE3.0) historical-transaction test, that was a significant limitation.
As of October 24, 2026, Visa permits qualifying previous transactions from other merchants to support a CE3.0 defense against Dispute Condition 10.4 (Other Fraud—Card-Absent Environment). Visa has also expanded eligible linked credentials and explicitly recognized agentic payment-provider login IDs.
But there's a difference between a transaction being eligible under the rule and the evidence being available to submit.
Visa announced the change in its April 2026 rulebook. It updates two rules: Invalid Disputes (Rule ID 0030254) and Pre-Arbitration Processing Requirements (Rule ID 0030257), now §§11.8.5.3 and 11.8.5.6 in the October 24, 2026 edition.
| Requirement | Before October 24 | For disputes processed on or after October 24 |
|---|---|---|
| Prior merchant history | Previous transactions generally needed to be with the same merchant | Qualifying history can come from one or more merchants |
| Payment credential | Same payment credential, such as the card or token | Same Visa card or a payment credential associated with it, including another linked token |
| Customer login evidence | Login at a merchant site or application | Eligible login IDs explicitly include agentic payment providers |
| Purchase-order evidence alternative | Visa Secure ECI 7 transactions with a CAVV only | Adds Visa Token Service (TAVV) and Visa Intelligent Data Exchange (IDX) paths, at the invalid-dispute check only |
The basic threshold remains: two prior qualifying transactions, no disqualifying issuer fraud reporting, the required age window, and matching customer data.
For ordinary purchases, the prior transactions must have been processed more than 120 days before the dispute was submitted and no more than 365 days before the dispute's processing date. At the invalid-dispute check, Visa waives the 120-day floor when the prior transactions were Original Credit Transactions. As printed, the updated pre-arbitration rule does not reference that waiver. The distinction between submission and processing dates can matter at the edge of the window.
Consider three hypothetical payments made with the same underlying Visa card:
Under the expanded rule, Store A's and Store B's transactions could provide the two required earlier transactions for Store C, even though the customer has never purchased from Store C before.
That does not mean the three transactions automatically qualify. The prior purchases must meet Visa's date and fraud-reporting rules, and the disputed purchase must match the earlier transactions on the required customer information. In pre-arbitration, only transactions the submitting acquirer processed count.
This is what makes the October change relevant to merchants with low repeat-purchase rates: the relevant history may exist even when it isn't in the merchant's own order database.
Visa can relate certain payment credentials at the network level. In its public CE3.0 client FAQ from 2022, Visa said it would use the underlying card number (PAN) when matching cardholders and merchants, and discussed merchant IDs and descriptors as part of its original merchant-matching approach.
That is historical context. Visa has not published how cross-merchant matching works under the October 2026 rules.
And credential matching is not the complete CE3.0 test. Visa requires a match on device ID or device fingerprint, or public IP address, plus at least one further qualifying independent element: a customer login/account ID, the full delivery address, or whichever of device or IP wasn't used for the first match.
Visa also sets format requirements:
Device ID and device fingerprint cannot count as two independent matches. Visa treats them as similar data elements, and an acquirer may supply only one of them.
For a merchant operating multiple storefronts, these fields may already be stored consistently. Across unrelated merchants, they may not be. One store's customer ID rarely equals another store's ID, and device fingerprints produced by different systems are not necessarily interchangeable.
Suppose Store C is handling the dispute, while the earlier purchases happened at Stores A and B.
Store C does not automatically get a copy of the other stores' customer or order histories. A chargeback management provider connected to Store C does not automatically receive them either.
For post-dispute pre-arbitration, Visa now states that the submitting acquirer may use only transaction data accepted and processed by that acquirer.
| Scenario | What it means |
|---|---|
| All three purchases were processed by the same acquiring entity | The earlier transactions may fall within the acquirer's permissible submission scope, if the required evidence can be assembled and used. |
| Store B used another acquirer | Store C's acquirer cannot simply submit Store B's transaction data in the CE3.0 pre-arbitration submission. |
| All three stores use the same payment gateway | That alone proves nothing about whether they share the same underlying acquiring entity. |
Even the first case does not guarantee a match. Acquirers have payment-processing data; the merchant or its fraud provider may have the checkout-level IP, device, delivery and login attributes. The systems holding the historical transaction and the evidence required to validate it may be different.
The October update gives merchants and dispute platforms no publicly documented right to request other merchants' customer records.
CE3.0 can be relevant before a formal fraud dispute is opened and in a later dispute process, but the operating paths differ.
Pre-dispute: Participating Verifi Order Insight workflows can supply additional transaction information to issuers before a formal dispute. Visa also announced automatic CE3.0 qualification through Visa Secure in the U.S. beginning October 2025. The updated public rule does not establish a universal API through which every merchant or chargeback platform can retrieve cross-merchant evidence.
Post-dispute: The acquirer may pursue CE3.0 through the Visa pre-arbitration process, subject to the new same-acquirer submission restriction and the required supporting evidence.
A processor saying it "supports CE3.0" is therefore not enough. Merchants should ask which route it supports and whether the October 2026 cross-merchant enhancement is available in that route.
The expanded rule explicitly includes eligible Agentic Payment Provider login IDs among the customer identifiers that can be used in the CE3.0 test.
A payment may be initiated through an agent-associated account rather than through a conventional merchant login. But matching that account identifier does not, by itself, establish what the buyer instructed the agent to purchase or whether every instruction was authorized. Merchants should still retain the actual purchase and fulfillment record.
The October rules also extend a specific alternative to detailed merchandise descriptions: a purchase-order number sent to the cardholder may qualify at the invalid-dispute check (not in pre-arbitration) for certain ECI 7 ecommerce transactions, subject to Visa's specified validations involving Visa Secure (CAVV), Visa Token Service (TAVV), or Visa IDX (Match Key). Every other transaction still needs the item description.
Five questions to settle with your acquirer, processor and team:
If you watch your VAMP ratio: Visa's public VAMP fact sheet identifies CE3.0-qualified TC40 fraud records (the issuer's fraud reports) as excluded from the monitoring ratio, subject to data-extract timing. It separately identifies disputes resolved through qualifying pre-dispute solutions as excluded, also subject to data-extract timing. A win after the dispute is filed doesn't, by itself, remove a TC15 (the dispute record) that is already recorded.
Previously, a merchant with no repeat history often had nowhere to go with the CE3.0 historical-transaction test. Visa has now widened the universe of prior purchases that may qualify.
But history on the network is not the same as evidence in a merchant's dispute workflow.
The benefit will depend on how well acquiring partners and payment providers can find the qualifying transactions, verify consistent customer attributes, and make supported submissions.
Disputed builds the full response to fraud disputes, including checking whether a case has the device, IP and login matches that CE3.0 requires.
For the field-level checklist, see our Visa CE3.0 merchant guide.