Visa 10.4 — Card-absent fraud and Compelling Evidence 3.0

What this code means

Match the card brand and payment_method_details.card.network_reason_code first. For this row that pair is Visa and 10.4. The network name is Other Fraud — Card-Absent Environment. The packet category is fraud.

Stripe’s category guide says these disputes are hard to win, and that a confusing billing descriptor causes many of them. If the payment was real fraud, accepting the dispute is a valid outcome. This page does not say which of those is true for a given charge. That depends on the order you already have.

The ordinary rebuttal is AVS and CVV results, the purchase IP, and the order confirmation. Stripe adds the 3-D Secure ECI itself when liability shift applies. Both the ordinary packet and Compelling Evidence 3.0 need a product description of the disputed transaction.

Nearby codes are not this case. Visa 10.3 is card-present fraud and does not use Compelling Evidence 3.0. Visa 10.5 is the Visa Fraud Monitoring Program. Stripe says Visa does not accept evidence for 10.5, so there is no packet. Visa 10.1 and 10.2 are chip-terminal liability shifts. They are also fraudulent on Stripe’s map, and they are not a card-absent story.

Response deadline

Use the due date on the dispute you are answering. In Stripe that timestamp is dispute.evidence_details.due_by. On Shopify, use the evidence due date shown for that dispute. Do not replace either date with the network figures below.

Stripe’s responding guide says the merchant window is usually 7–21 days, depending on the network. Miss it and you lose. If due_by is 0, the bank does not allow a response. You get one submission. You cannot add files later.

Secondary guides cite 30 calendar days for Visa acquirer representment. That figure was not re-confirmed against the Visa Core Rules in the 2026-10-11 pass. It is the acquirer clock. It does not extend due_by or the Shopify evidence due date. Stripe usually allows less time.

Some merchant blogs say the cardholder has 75 days to file a 10.4. That number was not in the Stripe pages checked for this matrix. Do not use it.

Compelling Evidence 3.0

Compelling Evidence 3.0 applies only to Visa reason 10.4. It does not apply to 13.1, 13.3, Mastercard, American Express, or Discover. There is no Compelling Evidence 3.0 object for Mastercard.

Send it only when evidence_details.enhanced_eligibility.visa_compelling_evidence_3 says the dispute qualifies. When that object is present, trust it instead of counting days by hand. Also fill the ordinary evidence fields. Stripe resubmits those if Compelling Evidence 3.0 is disapproved. A disapproved packet is refiled as a standard response.

What Stripe’s API requires

The dispute is Visa 10.4.
Exactly two prior transactions on the same payment method.
Those priors were paid, were not disputed, and were not validation charges. They were not reported as fraud.
Stripe processed them.
Product descriptions for the disputed charge and both priors.
merchandise_or_services set to merchandise or services.

How far back the two priors can be

Stripe states the date window two ways. Do not invent a third number.

Where Stripe says it	Wording
API guide	Priors fall within 120–364 days of the disputed transaction.
Stripe Support	Processing was more than 119 and fewer than 366 calendar days before the disputed transaction processing date. That is the 120–365 window merchants usually quote.

Which data elements have to match

You need the same match on all three transactions: the disputed charge and both priors. The match is either two main elements, or one main element plus one secondary element. At least one match must be an IP address or a device identifier.

Main	Secondary
Customer purchase IP	Shipping address
Customer device fingerprint, or customer device ID	Customer email address
	Customer account ID

A device fingerprint must be at least 20 characters.
A device ID must be at least 15 characters.
A fingerprint paired only with a device ID does not qualify. Stripe says that pair is not a valid combination.
An email plus a shipping address, with no IP and no device ID or fingerprint, does not qualify.

The Stripe field for this block is enhanced_evidence.visa_compelling_evidence_3. It is an object, not a file upload. It needs the disputed transaction plus exactly two prior_undisputed_transactions. Delivery or login records can still go in the ordinary evidence fields. They do not replace this data-element test.

Evidence checklist

Levels below are the Visa 10.4 row. Compelling Evidence 3.0 is strong evidence, and only when the eligibility field says the dispute qualifies. It is not a substitute for the required lines.

Required

Proof the cardholder participated in this card-absent payment, or that 3-D Secure authenticated it.

Stripe fields: customer_name, customer_email_address, customer_purchase_ip, billing_address, receipt, uncategorized_text.

AVS and CVV results, the purchase IP, and the order confirmation are the ordinary rebuttal. State whether 3-D Secure authenticated the payment. Stripe supplies the ECI automatically when 3-D Secure applies. The fraud-category fallback also treats the buyer’s name, email, purchase IP, and receipt as required, plus a statement of what was sold.

What was sold.

Stripe field: product_description.

The issuer has to be able to tie the charge to an order. A recognizable order plus a clear billing descriptor is what the category note says turns an unrecognized charge into a specific purchase.

Strong

Visa Compelling Evidence 3.0: exactly two prior undisputed transactions on the same card.

Stripe field: enhanced_evidence.visa_compelling_evidence_3.

Submit this only when evidence_details.enhanced_eligibility.visa_compelling_evidence_3 says the dispute qualifies. Keep the ordinary fields filled so Stripe can fall back if Compelling Evidence 3.0 is rejected.

Delivery or digital-use records tying the order to the cardholder.

Stripe fields: shipping_address, shipping_carrier, shipping_date, shipping_documentation, shipping_tracking_number, access_activity_log, customer_communication, customer_signature.

Stripe’s fraudulent compelling-evidence list treats shipment to an AVS-matched address, a signature or ID at pickup, access logs, and communications as evidence the cardholder has or used the product. Use only the fields that match the product type. These facts do not replace the Compelling Evidence 3.0 data-element test.

Weak or not relevant

A refund policy or a cancellation policy, unless the real complaint is a renewal the cardholder is calling fraud.
A signed card-present receipt when the payment was card-absent.
Compelling Evidence 3.0 elements that are only an email plus a shipping address, with no IP and no device ID or fingerprint.
A device fingerprint paired only with a device ID.
Prior transactions that were disputed, reported as fraud, or were validation charges.
Arguments about merchandise quality. Those belong to Visa 13.3, not 10.4.

Stripe evidence fields

Names and types are from the Dispute object. File fields are the ID of an uploaded file. Every field is nullable.

Field	Kind	What the API field is for
`customer_name`	Text	Name of the customer.
`customer_email_address`	Text	Email address of the customer.
`customer_purchase_ip`	Text	IP address used when the customer made the purchase. Also a main Compelling Evidence 3.0 element.
`billing_address`	Text	Billing address provided by the customer.
`receipt`	File	Receipt or message that notified the customer of the charge.
`uncategorized_text`	Text	Any additional evidence or statements.
`product_description`	Text	Description of the product or service sold. Required on the disputed transaction and on each Compelling Evidence 3.0 prior.
`enhanced_evidence.visa_compelling_evidence_3`	Object	Visa Compelling Evidence 3.0. Only for a qualifying Visa 10.4. Disputed transaction plus exactly two prior undisputed transactions.
`shipping_address`	Text	Address a physical product was shipped to. Include as much of the address as possible. Secondary element for Compelling Evidence 3.0, not enough on its own.
`shipping_carrier`	Text	Delivery service. Separate multiple carriers with commas.
`shipping_date`	Text	Date a physical product began its route, human-readable.
`shipping_documentation`	File	Proof of shipment to the address the customer provided.
`shipping_tracking_number`	Text	Tracking number. Separate multiple numbers with commas. Stripe expands these with carrier delivery detail when it compiles the packet.
`access_activity_log`	Text	Server or activity logs proving the customer accessed or downloaded a digital product. Include IP addresses and timestamps.
`customer_communication`	File	Emails, chats, or a written account of a phone call.
`customer_signature`	File	A document or contract showing the customer’s signature. Weak if the payment was card-absent and this is only an in-person slip.

Common mistakes

Sending Compelling Evidence 3.0 when the eligibility object does not say the dispute qualifies, or on any code other than Visa 10.4.
Counting the 120–364 day API window and the 120–365 Support window into a third range. If the eligibility object is present, follow it.
Using a 75-day cardholder filing window. It was not confirmed.
Matching only email and shipping address, or pairing a device fingerprint only with a device ID.
Using a fingerprint shorter than 20 characters, or a device ID shorter than 15 characters.
Using priors that were disputed, reported as fraud, validation charges, or not processed by Stripe.
Leaving the ordinary evidence fields empty because a Compelling Evidence 3.0 block was attached.
Answering 10.3, 10.1, or 10.2 with an online-IP story, or building any packet for 10.5.
Leading with a refund or cancellation policy, unless the cardholder is calling a renewal fraud.
Arguing quality or “not as described.” That is 13.3.
Treating the 30-day acquirer figure as the date you must hit inside Stripe or Shopify.

Example rebuttal

Facts only. Brackets are synthetic placeholders. Delete any line you cannot fill from the order. Include the Compelling Evidence block only when the eligibility field says this dispute qualifies. Do not add a sentence about how the issuer should decide.

Visa reason code 10.4. Stripe reason: fraudulent. Card-absent.
Order [ORDER ID] on [ORDER DATE] for [PRODUCT DESCRIPTION].
Customer [CUSTOMER NAME], email [CUSTOMER EMAIL].
Purchase IP [PURCHASE IP]. Billing address [BILLING ADDRESS].
AVS result [AVS RESULT]. CVV result [CVV RESULT].
3-D Secure: [3DS RESULT OR NOT USED].
Order confirmation sent to [CUSTOMER EMAIL].

Use the next lines only if a physical shipment or digital use exists.
Shipped [SHIP DATE] by [CARRIER] to [SHIPPING ADDRESS], tracking [TRACKING NUMBER].
Access log: [ACCESS DATE] from [ACCESS IP].

Use the next lines only if evidence_details.enhanced_eligibility.visa_compelling_evidence_3 says this dispute qualifies.
Prior Stripe charge 1: [PRIOR ORDER 1 DATE], [PRIOR PRODUCT 1], paid, not disputed, not a validation charge.
Prior Stripe charge 2: [PRIOR ORDER 2 DATE], [PRIOR PRODUCT 2], paid, not disputed, not a validation charge.
Same match on all three: [IP OR DEVICE ID, AND THE SECOND ELEMENT IF USED].
merchandise_or_services: [merchandise OR services].

Sources

Stripe reason-code defense guide. Visa 10.4 description and ordinary evidence.
Stripe dispute categories. 10.4 maps to fraudulent. 10.5 has no evidence path.
Stripe: Visa Compelling Evidence 3.0. Eligibility, the 120–364 day API wording, and main versus secondary elements.
Stripe Support on Compelling Evidence 3.0. More than 119 and fewer than 366 calendar days (the 120–365 window).
Stripe Dispute object. Evidence fields, evidence_details.due_by, and enhanced_evidence.visa_compelling_evidence_3.
Stripe: responding to a dispute. The merchant window is usually 7–21 days. One submission.
Secondary summary of acquirer response windows. Visa cited as 30 calendar days. Not re-checked against the Visa Core Rules in this pass.
Secondary summary of the same response windows. Same 30-day Visa figure. Secondary.