Spot an online charge you don't recognize, tell your bank "that wasn't me," and — since 2023 — the store has been able to fight back with your own purchase history. From October 24, 2026, that history gets bigger: the purchases a merchant uses against your fraud claim no longer have to be purchases at that store. Buys you made at other stores, on the same card, can now be Exhibit A.
Visa's stated reason is "to further reduce friendly fraud" — people disputing purchases they actually made. That's a real problem for merchants. But the evidence this rule runs on matches devices, internet connections and addresses, not people — and that gap is exactly where ordinary households get caught. This guide explains the rule as it now stands, what changes on the 24th, and the moves that still protect a genuine claim.
Compelling Evidence 3.0 ("CE 3.0") has been part of Visa's rules since April 15, 2023. It applies to exactly one kind of dispute: condition 10.4, fraud on a card-absent purchase — the online or in-app order where you tell your bank you didn't authorize it. It does not apply to in-store chip purchases, and it has no role in product disputes (never arrived, not as described), which run under Visa's separate 13.x conditions.
To make a 10.4 dispute invalid, the merchant — through its payment processor — must supply two earlier purchases that meet all of these tests:
Meet that bar and the issuer is expected to resolve the dispute in the merchant's favor — the fraud claim is treated as invalid, because the card's own history supposedly proves the cardholder was the one buying all along.
For disputes processed on or after October 24, 2026, Visa's April 2026 rulebook (section 11.7.5.3, Table 11-28) widens where those two earlier purchases can come from:
Everything else about the test — two purchases, the 120-to-365-day window, the mandatory IP-or-device match plus one more element — stays as it was. What changed is purely the size of the net: for a large share of online shoppers, two undisputed purchases somewhere in the last 120–365 days is no longer a high bar.
Our free checker applies the CE 3.0 criteria — old rule and October expansion — to your situation, and tells you what to say to your bank either way.
Read the matching elements again: device, IP address, delivery address, login. Not one of them is you. Anyone who uses your saved card the way you use it — on the family laptop, over your home Wi-Fi, ordering to your house, inside a shared shopping account — produces a purchase history that is, to this rule, indistinguishable from your own.
So the most exposed Visa cardholder after October 24 isn't a fraudster. It's a parent whose teenager orders from the family computer with the card saved in the browser; a couple sharing one streaming-and-shopping login; anyone who ever let a relative "just use my card this once" on a shared device. If a charge from that pattern gets disputed as fraud — by either party — the merchant's history packet will look airtight, because on the data elements Visa counts, it is.
Two honest consequences follow. First, hygiene: pull your card out of shared logins, family shopping accounts and devices you don't control, and give household members their own payment methods where you can. Second, honesty: a purchase made by someone you gave the card to is generally not "unauthorized," and disputing it as fraud because CE 3.0 makes other claims hard is a good way to lose twice. If a household member made the charge, the truthful routes are to settle it with them, ask the merchant, or dispute on the basis that actually fits.
Visa's rulebook decides a fight between your bank and the merchant over who absorbs the loss. It does not rewrite your rights as a cardholder:
A few details from Visa's published rules that matter at the margins. A device ID and a device fingerprint count as similar elements — together they are one matching item, not two; a qualifying device ID is a serial-type identifier, and a fingerprint is built from multiple device properties. Login IDs under the expanded rule can include accounts held with an "Agentic Payment Provider" — a service that shops on your behalf. There are exceptions to the 120-day floor: earlier purchases that were original credit transactions can be younger. And Visa's rules exclude Chile from the expanded cross-merchant provision. None of this changes the consumer picture above; it explains why two superficially identical claims can come out differently.
Sources: Visa Core Rules and Visa Product and Service Rules, April 2026 edition, §11.7.5.3 (Table 11-28); Visa's Compelling Evidence 3.0 acquirer materials; 15 U.S.C. §1643; 15 U.S.C. §1666.
Visa is expanding Compelling Evidence 3.0, its rule for fraud disputes on card-absent purchases (condition 10.4). For disputes processed on or after October 24, 2026, the two earlier purchases a merchant uses as evidence can come from one or more merchants — not just the store being disputed — as long as they were made with the same card or an associated credential such as a wallet token. Visa says the change is meant "to further reduce friendly fraud."
Two earlier purchases on the same card that were never reported as fraud, each processed more than 120 days and no more than 365 days before the dispute, plus transaction details for them. The earlier purchases must match the disputed one on at least two data elements — and one match must be the IP address or the device ID/fingerprint. The second match can be the customer account/login ID or the full delivery address. Device ID and device fingerprint count as one element, not two.
No. Visa's rule says an acquirer — the merchant's payment processor — must only submit transaction data it accepted and processed itself. So the earlier purchases have to come from stores that use the same processor as the merchant you are disputing. The merchant does not get access to other stores' customer records.
No. Visa's network rules decide whether your bank can send the charge back to the merchant. Federal law is separate: it caps your liability for unauthorized use of a credit card at $50 (15 U.S.C. 1643), and if the issuer tries to collect, the burden is on the issuer to show the use was authorized. Your Fair Credit Billing Act rights — including written notice of a billing error within 60 days of the statement — are unchanged.
Ask your issuer for the documentation the merchant submitted, then answer it point by point — people move, devices get replaced, addresses change, and household members share hardware. Ask the issuer to reopen the claim with your response. If the issuer mishandles the claim, you can escalate with a complaint to the CFPB at consumerfinance.gov.
