Friendly fraud: Compelling Evidence 3.0 and First-Party Trust

The goods arrived. The customer used them. Weeks later, a fraud dispute lands, and the cardholder tells the bank the purchase was never theirs. This is friendly fraud, and the name is misleading, because it costs the merchant the sale, the goods and a fee, and it counts against the same ratios as real fraud.

This article explains what first-party misuse is, how Visa Compelling Evidence 3.0 and Mastercard First-Party Trust work, what data to keep on every order and how to stop these disputes starting. For dispute lifecycles, monitoring thresholds and when to fight, read our guide to chargeback management.

What is friendly fraud?

Friendly fraud, also called first-party misuse or first-party fraud, happens when a legitimate cardholder makes a purchase and later disputes it. Stripe says it can be accidental, because the cardholder didn’t recognise the transaction on a statement, or deliberate, for example buyer’s remorse or an attempt to get goods without paying. Mastercard’s definition covers genuine transactions mistakenly or intentionally challenged by cardholders.

The issuer sees a fraud claim, and the card was not stolen, but nobody can prove what was in the cardholder’s mind. Visa’s merchant guide makes the useful point that CE 3.0 focuses on historical transaction patterns and consistent identifying information, rather than on proving intent. Your job is to show that this purchase looks like this cardholder’s normal activity.

The scale is hard to measure, because no report separates mistakes from deliberate claims with any precision. Mastercard’s 2025 State of Chargebacks report forecasts that global chargeback costs to merchants will reach USD 42 billion by 2028, with nearly half reported as fraudulent. That figure covers all reported fraud, not only friendly fraud. Chargebacks911 reports that Mastercard has recognised these claims as about three-quarters of chargebacks under its fraud reason code. Treat that as a secondary figure.

It also touches your scheme standing. Stripe says monitoring programmes don’t consider dispute outcomes, so a dispute you win still counts. Stripe adds that Visa excludes disputes resolved through pre-dispute products, and fraud reports that qualified for CE 3.0, from the VAMP count. Evidence used early therefore does more than evidence used late.

How does Visa Compelling Evidence 3.0 work?

CE 3.0 is a remedy under Visa Dispute Condition 10.4, Other Fraud, Card-Absent Environment. If the data qualifies, Visa’s rules treat the dispute as invalid. Visa’s October 2026 merchant guide says it does not guarantee an outcome and applies only to eligible 10.4 disputes.

The rule changed on 24 October 2026. Under the edition of the Visa Rules dated that day, for disputes processed on or after it:

• Earlier transactions. The same card, or a credential associated with it such as a token, must have been used at one or more merchants in two previous transactions that the issuer did not report as fraud. The earlier wording, for disputes processed through 23 October 2026, referred only to the same credential and did not mention other merchants.
• Timing. Both must be processed more than 120 calendar days before the dispute was submitted, and no more than 365 days before the dispute’s processing date. The 120-day floor does not apply to Original Credit Transactions.
• Description. You need a detailed description of the goods or services for all three transactions. A purchase order number can replace it for certain transactions, such as Visa data-only ones processed with ECI 7.
• Matching data. The device ID or fingerprint, or the IP address, must match, plus one or more further elements from the list in the table below.

Device ID and device fingerprint count as similar elements, so you can’t submit both. The new reach across merchants comes with a limit: at pre-arbitration, an acquirer must only submit transaction data it accepted and processed itself. Pulse, a CRM vendor reviewing the April 2026 rules, notes that the public rules don’t explain how multi-merchant evidence would be assembled at the pre-dispute stage, and Visa’s October 2026 merchant guide still describes prior activity with your business. Expect this to develop, and ask your acquirer what it supports today.

Two stages matter. Before a dispute, merchants in Visa’s Order Insight may be able to provide qualifying information when a cardholder questions a transaction, which Visa says may resolve the inquiry without a dispute. After a dispute starts, qualifying information goes into your response through your acquirer.

Visa says CE 3.0 is generally less likely to apply to first-time purchases, limited history, inconsistent identifying data and guest checkout. It is strongest for repeat customers with accounts. Do not stretch the data: the Visa Rules say a merchant found falsifying data loses access to this remedy until the underlying activity is corrected and confirmed in writing.

How does Mastercard First-Party Trust work?

First-Party Trust helps issuers tell genuine purchases from flawed claims. Mastercard’s 2025 release says merchants can share enhanced data in two ways, during authorisation or later during the dispute process. It adds that there are rules for compelling evidence, including merchant chargeback protection for disputes that meet the data-sharing requirements. The signals include purchase history, device details, delivery information, identity elements and location.

The Paypers reported in October 2026 that the programme launched in 2024 in the US, Canada, Latin America, the Caribbean and Asia-Pacific, reaches Eastern Europe, the Middle East and Africa in October 2026, and goes across Europe in July 2027. Chargeflow says Mastercard’s FAQ dates the US start to October 2024, while Mastercard’s own 2025 release announced the extension beyond the US, so check the date for your region with your acquirer.

Mastercard’s detailed rules are not all public, so what follows comes from vendor summaries. Chargeflow describes three categories, with at least one element from each and a third element that differs from the first two: a device factor (IP address, device ID or fingerprint), a delivery factor (shipping address or email) and an additional identity factor (login ID, phone number, device location, device name or billing address). It says the programme applies to Mastercard reason code 4837, no cardholder authorisation. Chargebacks911 agrees on the shape, and says participation is opt-in.

Vendors disagree on one point. Chargebacks911 describes matching against two earlier transactions, 121 to 365 days old. Chargeflow says no history window or minimum is published. Ask your acquirer which applies to you.

	Visa CE 3.0	Mastercard First-Party Trust
Dispute type	10.4 card-absent fraud	Vendor sources say reason code 4837
Core test	Two earlier transactions, not reported as fraud	One element from each of three categories
Timing of data	Pre-dispute via Order Insight, or in the response	At authorisation, or during the dispute
Regions	Visa’s rules list region exceptions; ask your acquirer	Staged rollout; Europe due July 2027
Status of detail	Public in the Visa Rules	Partly from vendor summaries

What evidence should you keep?

You can’t reconstruct this data after a dispute arrives. Capture it on every order, in a form your team can pull by payment reference. Visa’s rules are specific about format, which is where many submissions fail.

Data element	Visa’s format requirement	Also useful for
IP address	Cardholder’s public IP, clear text, not hashed, valid IPv4 or IPv6	First-Party Trust device factor
Device fingerprint	Unique, from at least two software or hardware properties, at least 20 characters; may be hashed	First-Party Trust device factor
Device ID	Unique, verifiable by the cardholder, such as a serial number, at least 15 characters, clear text	First-Party Trust device factor
Customer account or login ID	Used to authenticate at the time of the transaction, clear text, recognised by the cardholder	First-Party Trust identity factor
Full delivery address	Street, city, state or province, postal code and country, clear text	First-Party Trust delivery factor
Product description	Detailed enough to show what was bought	All dispute responses

Visa’s guide adds some details worth building into your process:

• Email or phone counts as an account identifier only if you use it to authenticate the cardholder.
• Store pickup doesn’t create a delivery address, because a merchant location is not treated as one.
• Refunded transactions may still count, if they were not disputed.
• Generic labels are weaker than descriptions that explain what was bought.

Beyond those data points, keep the records that support any fraud or authorisation response:

1. Order and payment link. Visa suggests tying receipts, invoices and correspondence together with one reference, and including the date, amount and last four card digits.
2. Delivery proof. Carrier tracking and delivery confirmation. Stripe notes that issuers don’t follow links, so provide screenshots.
3. Usage records. For digital goods, logins, downloads and usage linked to the account.
4. 3-D Secure results. The authentication outcome and ECI value for each payment.
5. Customer contact. Emails, chats and call notes, with dates.
6. Policies at the time of sale. Visa says to retain earlier versions and their effective dates. Stripe warns that a checkbox containing only a link may be rejected, so show the full policy.

Retention needs a decision, not a default. Visa’s time limit for a 10.4 dispute is 120 calendar days from processing, and qualifying history can reach back 365 days before the dispute, so a record can matter well over a year after the sale. Visa says to retain records for the period required by its rules, local laws and your acquirer. The European Commission lists IP addresses and cookie IDs as personal data, and storage limitation is a GDPR principle, so agree the period with your data protection lead.

How do you prevent friendly fraud disputes?

Most of the work happens before a dispute exists. Visa says one of the most common reasons customers contact their bank is that they don’t recognise a transaction, even though it was valid.

• Use a name customers know. Visa says to review your billing descriptor regularly and align it with the brand shown during purchase. Our guide to soft descriptors has the detail, and multi-brand groups need extra care.
• Stay consistent. Visa recommends the same business name, logo, website and support details across site, receipts, emails and descriptors.
• Send clear receipts. Show your name, date, amount, currency, order reference and support contact.
• Make contact easy. Visa says clear contact details let customers resolve questions directly. Stripe says fast responses, refunds and replacements make customers less likely to dispute.
• Require agreement to your terms. Show the full refund and cancellation policy before payment.
• Encourage accounts. Guest checkout gives CE 3.0 little to work with, so make logging in worthwhile.
• Authenticate higher-risk payments. Stripe says 3-D Secure may protect against most fraud disputes through liability shift, but early fraud warnings can still count in monitoring programmes.
• Review repeat disputers. If one customer disputes several orders, restrict them from further purchases, and tell your acquirer if you see a pattern.
• Refund before it becomes a dispute. Stripe says customers can’t dispute fully refunded payments, though they can dispute partially refunded ones.

Pre-dispute services matter here. The chargeback guide covers which disputes to fight and how alerts work, so we won’t repeat that. The principle is simple: a dispute prevented or resolved early costs less than one won.

How does Omno help with friendly fraud evidence?

Omno doesn’t manage disputes, which stay with your acquirer or provider. It helps with the records behind them. The reporting and analytics page shows the full transaction trail for each payment, with every attempt, provider response and webhook, plus customer profiles that show each customer’s payment history, across all your brands and providers. Customer rules and blocking let you restrict customers you no longer want to serve.