A card-not-present fraud dispute says the cardholder did not authorize the transaction. Shipment alone may not answer that claim. Build a transaction-specific record from authentication, account continuity, fulfillment, and the facts that do not fit. Describe what each signal shows without treating a match as proof of identity.
Save the payment-authentication record
Capture the processor’s records for the disputed payment: authorization result, AVS and CVC results, 3-D Secure status, payment credential or fingerprint reference, billing address, account ID, and the IP/device/session identifiers available to you. Preserve the source timestamps and the processor’s exact status labels.
Do not describe an AVS or CVC match as proof of who used the card. A person with compromised card details can enter them correctly. Independent authentication and a consistent customer history can strengthen the explanation when they are tied to this payment.
Compare prior transactions and check program eligibility
If the same customer account or payment credential has earlier undisputed purchases, compare dates, amounts, addresses, device or IP identifiers, products, delivery, and any later dispute status. Label the disputed purchase separately and redact unrelated customer history.
For a Visa card-absent fraud dispute, ask the processor whether the transaction is eligible for Visa Compelling Evidence 3.0 before assembling a prior-purchase claim. Stripe describes eligibility for reason code 10.4 using two qualifying prior transactions in the 120-to-365-day period, the same payment credential, no fraud report on those transactions, and matching transaction data such as email, delivery address, device ID, or IP. Follow the processor’s required fields and current network criteria; prior history alone does not guarantee a favorable decision.
Connect fulfillment to the same transaction
For physical goods, tie the tracking or pickup record to the checkout address, order, and disputed payment. Delivery to a familiar address can support continuity, but it does not independently identify who placed the order.
For digital goods, connect account access, download or activation, device/IP records, and customer communications to the account and payment. A log showing availability is different from a log showing use. For higher-risk physical orders, signature or pickup verification may add context when captured normally and connected to the order.
Check for account takeover before relying on account history
A legitimate account can be compromised. Compare the disputed activity with recent password resets, email or phone changes, new devices, shipping-address changes, unusual order value or product mix, and expedited fulfillment. A sudden sequence of account changes followed by a high-value purchase may make an old customer history less persuasive.
If the evidence points to takeover, secure the account, preserve relevant access logs, and follow the business’s customer-notification process. Do not contest only because the transaction came through an established account.
Weigh mixed signals and build a concise evidence chain
Fraud records often conflict: a familiar device may accompany a new delivery address, or 3-D Secure may be present while the account shows a recent takeover. Make a short table with each signal, what it supports, what it does not prove, and how it compares with prior undisputed activity. Include unfavorable facts when they affect the explanation.
Order exhibits by evidentiary weight: payment-specific authentication, eligible prior-purchase links, account-change history, then transaction-specific fulfillment or usage. Put general fraud-score screenshots and policy descriptions later because they show how the merchant screens orders, not who authorized this one. Map each statement to an exhibit—for example, the two event records behind “same device as prior purchase”—and redact unrelated personal data.
An IP geolocation estimate is not proof the cardholder was physically present. A cookie can be shared or stolen, and a billing/shipping match can come from compromised data. Write “the same account and device identifier appeared on three earlier undisputed payments,” not “the IP proves the customer made the purchase.”
| Signal | Limit | |
|---|---|---|
| AVS/CVC match | Payment data matched | Does not prove who used the card |
| Prior device match | Supports account continuity | Can coexist with takeover |
| Delivery to billing address | Connects fulfillment | Does not establish authorization alone |
Prevent fraud at authorization time
Use the processor’s fraud controls, 3-D Secure where appropriate, AVS/CVC results, velocity checks, device/account risk, and manual review for unusual orders. Avoid declining every mismatch automatically: false positives can reject legitimate customers. Tune rules using combinations of signals and observed losses, then monitor disputes by product, acquisition channel, country, device pattern, and fulfillment method.
Understand Visa monitoring exposure
Visa’s Acquirer Monitoring Program (VAMP) applies defined counts and ratios to covered VisaNet fraud and dispute activity. Visa’s published fact sheet states that, effective April 1, 2026, the Excessive Merchant ratio threshold is 150 basis points in Asia Pacific, Canada, Europe, and the United States, with a monthly fraud-and-dispute count threshold of 1,500. Other regions and program definitions differ. Check the current Visa material and your acquirer’s reporting before using a threshold operationally; a processor may intervene earlier under its own risk policy.
The best response is a modest, evidence-led account of this payment. When independent authentication, continuity, and fulfillment facts support the transaction, connect them clearly. When the records instead point to stolen credentials or takeover, treat the case as a security incident and improve the authorization controls.
