Visa 10.4 has three tiers of defense.If you used 3DS, you have liability shift — 90%+ win rate. If you didn't but you qualify for CE 3.0, you still win 80–90%. If neither, you're defending on AVS + device + delivery, which wins 40–55%. Knowing which tier applies before you build the packet is the whole game — it changes what evidence matters, what to include, and whether to fight at all.
What Visa 10.4 actually covers
Visa 10.4 is "Other Fraud — Card-Absent Environment."The cardholder is claiming they didn't authorize the transaction and the merchant wasn't in a card-present context (ecommerce, mail order, telephone order, or manually-keyed). It sits in Visa's Fraud category (Category 10), alongside 10.1 (card-present fraud, EMV), 10.2 (card-present fraud, non-EMV), 10.3 (fraud on chip card), and 10.5 (Visa fraud monitoring program).
The critical fact about 10.4: it's the most common code for friendly fraud— where a legitimate customer disputes a legitimate charge. Industry surveys (MRC 2024, Chargebacks911 Annual Report) estimate 60–75% of 10.4 disputes are friendly fraud, not true fraud. That's why the win rates are higher than you might expect for a "fraud" code.
Deadline
30 calendar days from the chargeback date. Some acquirers apply an internal 20-day cap. On Stripe check dispute.evidence_details.due_by; on PayPal Braintree, dispute.replyByDate. Miss it, lose automatically.
The three defense tiers
Every 10.4 dispute falls into one of three defense tiers based on the transaction's authentication and history:
| Tier | Condition | Win rate | Effort |
|---|---|---|---|
| 1 | 3DS authenticated (SafeKey / ProtectBuy / Visa Secure) | 85–95% | Minimal — near-automatic |
| 2 | CE 3.0 qualifying (2 prior undisputed txns, 120–365d, matching ID) | 80–90% | Low — pull history data |
| 3 | Neither — defending on AVS + device + delivery | 40–55% | High — build full evidence stack |
Before building the packet, figure out which tier applies. Tier 1 evidence is 3 lines; Tier 3 evidence is 20 pages. Getting the tier wrong is how merchants over-build packets that fail on legal technicalities the issuer's system checks.
Tier 1 — 3DS authenticated
If the transaction was authenticated via 3-D Secure (Visa Secure), you have liability shift. Under Visa Core Rules §5.4, the issuer bears fraud liability when a successful 3DS authentication is completed. The chargeback should have been rejected at the acquirer level; if it wasn't, this is your winning defense.
The evidence is short: submit the 3DS authentication result (usually a eci value of 05 or 06 for full authentication, plus a cavvhash) with a one-sentence cover: "This transaction was successfully authenticated via 3-D Secure; per Visa Core Rules §5.4, liability rests with the issuer. Attached: 3DS authentication result."
Win rate: 85–95%. The 5–15% that lose are almost always cases where the 3DS was attemptedbut not fully authenticated (ECI 07, which doesn't carry liability shift). Check the ECI value before invoking Tier 1.
Tier 2 — CE 3.0 qualifying
If the transaction wasn't 3DS-authenticated but the cardholder has two prior undisputed transactions with you in the 120–365 day window, matched by IP / device / address / account ID, you qualify for Compelling Evidence 3.0. Issuer acceptance is mandatory when conditions are met.
The evidence stack:
- Cover narrative referencing CE 3.0 explicitly ("This dispute qualifies for CE 3.0 under Visa Core Rules §11.4").
- Table showing the disputed transaction + two priors, with the matching identifier highlighted.
- Standard AVS + device evidence as backup (in case the CE 3.0 claim is disqualified in review).
Win rate: 80–90%. The full CE 3.0 mechanics are in the CE 3.0 playbook.
Tier 3 — AVS + device + delivery
If neither 3DS nor CE 3.0 applies, you're defending on the standard fraud-representment stack. This is the hardest tier — your winning defense is proving the cardholder authorized the transaction using indirect evidence.
AVS + CVV match records
Full-match at authorization. If AVS was partial (address matched, ZIP didn't) or CVV was missing, note it and move on.
IP + device fingerprint
Session IP at time of purchase, device fingerprint hash, browser user-agent. Ideally matched to prior successful sessions from the same customer.
Delivery to AVS-verified address
Carrier tracking showing delivery to the AVS-verified billing address. If shipping and billing differ, explain why (gift, work address).
Post-purchase engagement
Any customer login, product usage, or support ticket after purchase — proof the customer engaged with the product.
Win rate: 40–55%. It's a real fight — issuer analysts have discretion, and they're trained to be skeptical of Tier 3 defenses.
When to fold
Not every 10.4 is worth fighting. Fold when:
- You have no 3DS, no CE 3.0 qualification, and AVS was a mismatch. Win rate under 15%; the $15 chargeback fee costs more than a refund.
- The customer emailed asking for a refund, you said no, they disputed. You're defending against a decision the customer already made — they'll re-dispute if they lose, and pre-arbitration is expensive.
- The disputed amount is small enough that ops cost + chargeback fee > disputed amount. Under $30 in most cases.
Aurai's book shows that 15–20% of 10.4 disputes are net-negative to fight. Skipping those improves your effective win rate andyour net keep — it's not just about the win-rate percentage.
Frequently asked questions
What is Visa 10.4?
Visa 10.4 is "Other Fraud — Card-Absent Environment." The cardholder claims non-participation in a CNP transaction. It's the most common fraud reason code in ecommerce.
How long do I have to respond?
30 calendar days from the chargeback date. Some acquirers apply an internal 20-day cap.
What's the win rate?
85–95% with 3DS authentication, 80–90% with CE 3.0 qualification, 40–55% without either. Under 5% with no evidence.
Does 3DS always give liability shift?
Only when authentication is fully completed (ECI 05 or 06). Attempted-but-not-completed 3DS (ECI 07) doesn't carry liability shift.
Can Aurai handle 10.4 automatically?
Yes. Aurai detects the code, identifies which defense tier applies, and assembles the correct evidence stack. 25% only on wins.
Based on Visa Core Rules v2025.1 and Aurai's book of disputes as of July 2026. Visa is a trademark of Visa Inc. Aurai is independent and not endorsed by Visa.