Visa 10.4 has three tiers of defense. If you used 3DS, you have liability shift — 90%+ win rate. If you didn't but you qualify for CE 3.0, you still win 80–90%. If neither, you're defending on AVS + device + delivery, which wins 40–55%. Knowing which tier applies before you build the packet is the whole game — it changes what evidence matters, what to include, and whether to fight at all.
What Visa 10.4 actually covers
Visa 10.4 is "Other Fraud — Card-Absent Environment." The cardholder is claiming they didn't authorize the transaction and the merchant wasn't in a card-present context (ecommerce, mail order, telephone order, or manually-keyed). It sits in Visa's Fraud category (Category 10), alongside 10.1 (card-present fraud, EMV), 10.2 (card-present fraud, non-EMV), 10.3 (fraud on chip card), and 10.5 (Visa fraud monitoring program).
The critical fact about 10.4: it's the most common code for friendly fraud — where a legitimate customer disputes a legitimate charge. Industry surveys (MRC 2024, Chargebacks911 Annual Report) estimate 60–75% of 10.4 disputes are friendly fraud, not true fraud. That's why the win rates are higher than you might expect for a "fraud" code.
Deadline
30 calendar days from the chargeback date. Some acquirers apply an internal 20-day cap. On Stripe check dispute.evidence_details.due_by; on PayPal Braintree, dispute.replyByDate. Miss it, lose automatically.
The three defense tiers
Every 10.4 dispute falls into one of three defense tiers based on the transaction's authentication and history:
| Tier | Condition | Win rate | Effort |
|---|---|---|---|
| 1 | 3DS authenticated (SafeKey / ProtectBuy / Visa Secure) | 85–95% | Minimal — near-automatic |
| 2 | CE 3.0 qualifying (2 prior undisputed txns, 120–365d, matching ID) | 80–90% | Low — pull history data |
| 3 | Neither — defending on AVS + device + delivery | 40–55% | High — build full evidence stack |
Before building the packet, figure out which tier applies. Tier 1 evidence is 3 lines; Tier 3 evidence is 20 pages. Getting the tier wrong is how merchants over-build packets that fail on legal technicalities the issuer's system checks.
Tier 1 — 3DS authenticated
If the transaction was authenticated via 3-D Secure (Visa Secure), you have liability shift. Under Visa Core Rules §5.4, the issuer bears fraud liability when a successful 3DS authentication is completed. The chargeback should have been rejected at the acquirer level; if it wasn't, this is your winning defense.
The evidence is short: submit the 3DS authentication result (usually a eci value of 05 or 06 for full authentication, plus a cavv hash) with a one-sentence cover: "This transaction was successfully authenticated via 3-D Secure; per Visa Core Rules §5.4, liability rests with the issuer. Attached: 3DS authentication result."
Win rate: 85–95%. The 5–15% that lose are almost always cases where the 3DS was attempted but not fully authenticated (ECI 07, which doesn't carry liability shift). Check the ECI value before invoking Tier 1.
Tier 2 — CE 3.0 qualifying
If the transaction wasn't 3DS-authenticated but the cardholder has two prior undisputed transactions with you in the 120–365 day window, matched by IP / device / address / account ID, you qualify for Compelling Evidence 3.0. Issuer acceptance is mandatory when conditions are met.
The evidence stack:
- Cover narrative referencing CE 3.0 explicitly ("This dispute qualifies for CE 3.0 under Visa Core Rules §11.4").
- Table showing the disputed transaction + two priors, with the matching identifier highlighted.
- Standard AVS + device evidence as backup (in case the CE 3.0 claim is disqualified in review).
Win rate: 80–90%. The full CE 3.0 mechanics are in the CE 3.0 playbook.
Tier 3 — AVS + device + delivery
If neither 3DS nor CE 3.0 applies, you're defending on the standard fraud-representment stack. This is the hardest tier — your winning defense is proving the cardholder authorized the transaction using indirect evidence.
AVS + CVV match records
Full-match at authorization. If AVS was partial (address matched, ZIP didn't) or CVV was missing, note it and move on.
IP + device fingerprint
Session IP at time of purchase, device fingerprint hash, browser user-agent. Ideally matched to prior successful sessions from the same customer.
Delivery to AVS-verified address
Carrier tracking showing delivery to the AVS-verified billing address. If shipping and billing differ, explain why (gift, work address).
Post-purchase engagement
Any customer login, product usage, or support ticket after purchase — proof the customer engaged with the product.
Win rate: 40–55%. It's a real fight — issuer analysts have discretion, and they're trained to be skeptical of Tier 3 defenses.
When to fold
Not every 10.4 is worth fighting. Fold when:
- You have no 3DS, no CE 3.0 qualification, and AVS was a mismatch. Win rate under 15%; the $15 chargeback fee costs more than a refund.
- The customer emailed asking for a refund, you said no, they disputed. You're defending against a decision the customer already made — they'll re-dispute if they lose, and pre-arbitration is expensive.
- The disputed amount is small enough that ops cost + chargeback fee > disputed amount. Under $30 in most cases.
Some 10.4 disputes are net-negative to fight. Skipping those improves your effective win rate and your net keep — it's not just about the win-rate percentage.
Frequently asked questions
What is Visa 10.4?
Visa 10.4 is "Other Fraud — Card-Absent Environment." The cardholder claims non-participation in a CNP transaction. It's the most common fraud reason code in ecommerce.
How long do I have to respond?
30 calendar days from the chargeback date. Some acquirers apply an internal 20-day cap.
What's the win rate?
85–95% with 3DS authentication, 80–90% with CE 3.0 qualification, 40–55% without either. Under 5% with no evidence.
Does 3DS always give liability shift?
Only when authentication is fully completed (ECI 05 or 06). Attempted-but-not-completed 3DS (ECI 07) doesn't carry liability shift.
Can Aurai handle 10.4 automatically?
Yes. Aurai detects the code, identifies which defense tier applies, and assembles the correct evidence stack. 25% only on wins.
Based on Visa Core Rules v2025.1. Figures are indicative ranges, not guarantees and not Aurai results. Visa is a trademark of Visa Inc. Aurai is independent and not endorsed by Visa.