Navigating Visa's compelling evidence rule 3.0 for card-not-present transactions

In the dynamic world of online transactions, security and trust are paramount. Visa introduced the Compelling Evidence Rule 3.0 (CE3.0) in April 2023 specifically tailored for card-not-present transactions. This rule serves to protect businesses and customers from fraudulent activities, chargebacks, and disputes. In this article, we'll break down the rule in straightforward terms, explain its necessity for card-not-present transactions, and provide practical guidance for businesses to comply effectively.

Why does the rule exist?

The CE3.0 is a direct response to the growing unique challenges posed by card-not-present transactions, specifically to combat “friendly fraud”. The rule aims to establish a fair and transparent process to resolve such issues by requiring merchants to provide compelling evidence supporting their case during disputes. This tailored approach ensures a secure and trustworthy payment ecosystem for online transactions, where the physical card is not presented.

Understanding CE3.0

1. The first step for businesses is to familiarize themselves with CE3.0. In order to qualify, the following criteria must be met:

• Established historical transaction footprint
• Two transactions from the same PAN that are between 120 and 365 days from the dispute date
• No fraudulent transactions or activities
• Transactions must be from the same business entity

2. Data validation

• Minimum of two transactions on the same payment method that settled at least 120 days prior to the dispute date. Each must be non-dispute and non-fraud.
• At least two of the core data elements (User ID, shipping address, IP address and device ID) must match between prior transactions and the disputed transaction and one of the two must be either IP address or device ID.

3. What are your responsibilities

• Evaluate whether your systems collect the correct historical data required in order to provide the evidence, as necessary.
• Review the case checklist for Compelling Evidence 3.0 and assess whether you can meet the conditions. Then choose to advise us whether you can provide new remedy or compelling evidence based on the criteria.
• The evolution of CE 3.0 requires access to the data elements supplied by the merchant which Visa needs to validate. Therefore, the merchant needs to decide carefully on docs/info they will present as it determines the response to Issuer and if liability can shift or not.

In conclusion

Visa's Compelling Evidence Rule 3.0 for card-not-present transactions is a crucial element in creating a secure and reliable online payment environment. By understanding the rule, maintaining meticulous records, responding promptly, communicating clearly, and utilizing fraud prevention tools tailored for card-not-present scenarios, businesses can build trust with customers, reduce the likelihood of chargebacks, and contribute to a safer online marketplace for everyone involved.

Talk to us today for more information and to understand if your business is optimized for the CE3.0 rule.

FAQs

What is the difference between previous versions of Compelling Evidence and the latest version, Compelling Evidence 3.0 (CE3.0)?

The rules have been updated with CE3.0 (effective in April 2023) to allow us, your payment processor, to remedy the dispute as opposed to supplying evidence that the cardholder may continue to dispute. If you are unable to meet the remedy criteria, all of the available compelling evidence types today will still be available after April 2023.

How can I ensure my business is ready for CE3.0?

Establish a business strategy for supplying CE3.0 data elements and communicate with us on a post-dispute strategy.

What if I don’t do anything to prepare for CE3.0?

Visa will only evaluate for CE3.0 validation if the data is present in the dispute flows. If CE3.0 data elements are not provided, no liability shift will be applied.

Is there a limit to the transaction dates that will meet the CE3.0 criteria?

Yes, transactions that fall 120 - 365 days after the dispute date meet the CE3.0 criteria.