Visa CE 3.0 Is Now Live: Purchases at Other Stores Can Block Your Fraud Dispute

The short answer: from October 24, 2026, a merchant defending a Visa card-absent fraud dispute (reason code 10.4) may use two earlier, undisputed purchases made at other merchants on the same payment processor — not only purchases at its own store. That is the Compelling Evidence 3.0 expansion in Visa's April 2026 rulebook. It changes the bank-versus-merchant fight; it does not remove your federal protections against unauthorized use, and it only works if the merchant's evidence clears every condition.

What changed on October 24, 2026

Compelling Evidence 3.0 (CE 3.0) is Visa's route for a merchant to answer a card-absent fraud claim — you say you did not make an online purchase — with the card's own history. Before October 24, 2026, the two earlier purchases the merchant relied on had to be at that same merchant. For disputes processed on or after October 24, 2026, Visa's April 2026 rulebook expands the rule: the earlier purchases may be at one or more merchants, provided they were accepted and processed by the same acquirer (the merchant's payment processor). Visa's stated aim is to further reduce friendly fraud.

The shared-device trap is real and worth understanding. If a family member used your saved card on the family laptop, the device, IP address and delivery address may all match a later disputed purchase — even though you did not make that purchase. Matching data is evidence of a pattern, not proof that you personally clicked buy. That distinction is exactly what to put to your bank (below).

The exact bar the merchant must clear

CE 3.0 is an all-or-nothing test. Industry summaries of Visa's rules describe the same four conditions, and a merchant that misses any one of them has not met the rule:

Two earlier transactions on the same card or an associated credential (such as a token in a phone wallet), neither reported to Visa as fraud.
Age window: each earlier transaction more than 120 days and no more than 365 days before the dispute is processed.
Matching data: at least two matching elements between the earlier purchases and the disputed one — from device ID or device fingerprint, IP address, account or login ID, and delivery address — and one of the two matches must be the device ID/fingerprint or the IP address.
Same acquirer: the earlier transactions must have been accepted and processed by the same acquirer as the defending merchant. A merchant cannot borrow purchase history from a store on a different processor.

Note the age window carefully: a purchase from last week cannot be used, and neither can one from two years ago. If your bank tells you CE 3.0 applies, ask which two transactions it means and check their dates first.

What this does not change

CE 3.0 decides liability between the merchant's side and your issuer. It does not rewrite federal law. Under the Fair Credit Billing Act framework, your liability for unauthorized use of a credit card is capped at $50 (15 U.S.C. § 1643), most issuers waive even that, and in a collection action the issuer bears the burden of showing the use was authorized. A merchant meeting CE 3.0 does not make a genuinely stolen-card charge yours to pay — it means the issuer, not the merchant, may end up absorbing it, and the issuer may still owe you the FCBA process: acknowledgment, investigation, and a written explanation.

It also does not apply to every dispute. CE 3.0 is a fraud-dispute rule (10.4, card-absent). It is not a defence to a not-received claim, a not-as-described claim, or a cancelled-subscription claim, which run under their own reason codes and clocks.

If your bank cites CE 3.0 on your dispute

Ask for the two transactions in writing: dates, merchants, and which matching elements were relied on. Check the 120–365-day window yourself.
Ask whether the same-acquirer condition is met and how the bank verified it.
Explain the real story in your own words: stolen card, account takeover, a family member using a saved card, a device you no longer own. Matching device data from a shared household device is not the same as your authorization.
Put it in writing to the billing-inquiries address within the FCBA's 60-day window from the statement date, even if you already called — a phone call alone does not trigger FCBA protections (see our calling-vs-writing guide).
If the investigation is mishandled, escalate: a CFPB complaint is the standard next step for a denied or badly handled dispute.

How to protect a genuine fraud claim

Report fraud the day you spot it, lock or replace the card, and keep the police or fraud report reference if you make one — your bank may not demand a police report before investigating, but a reference strengthens the file. Keep a separate note of who else uses your devices and saved cards: if a dispute ever turns on device matching, that note is your explanation. And check every new dispute against the deadline calculator before the 60-day FCBA window and the network's roughly 120-day window close.

FAQ

Does Visa CE 3.0 mean my fraud dispute will automatically be denied?

No. CE 3.0 only helps a merchant if it can show two undisputed earlier purchases in the 120–365-day window, with the required matching data, from the same acquirer. If any condition fails, the rule does not apply — and your federal unauthorized-use protections still apply regardless.

Can a merchant use my purchases at a completely different store?

Only if those purchases were processed by the same acquirer (payment processor) as the defending merchant. Purchases on a different processor do not count, and the merchant cannot access another merchant's customer records — only transaction data its own acquirer accepted and processed.

I share a laptop with my family. Does that kill my fraud claim?

Not by itself. Shared device and IP matches are common in households, and they are evidence of a pattern, not proof you authorized a specific purchase. Tell your bank exactly who uses the device and when, in writing, and ask it to weigh that against the CE 3.0 evidence.

Does CE 3.0 change the $50 liability cap?

No. Federal law still caps your liability for unauthorized credit-card use at $50, and most issuers waive even that. CE 3.0 governs how liability is shared between the merchant's side and your issuer — it does not increase what you owe.