If you ever spot an online charge you don’t recognize and tell your bank “that wasn’t me,” the store gets a new way to shut that claim down on October 24. It can point to what your card bought at other stores.
That’s fine if the “not me” was a lie. It’s a problem if your kid has your card saved on the family laptop.
The rule nobody mailed you
Visa runs a rule it calls Compelling Evidence 3.0. It covers one kind of dispute: fraud on a purchase where the card wasn’t physically there, like an online order.
Here’s how it works. A merchant can make your fraud dispute invalid, meaning your bank can’t push the charge back to the store, if it shows two earlier purchases on the same card that nobody reported as fraud. Those purchases have to be more than 120 days old and less than a year old. They also have to match the disputed one on your device or your IP address, plus at least one more thing, like your login or your delivery address.
Until now, that history had to come from the store you’re disputing. Visa’s April rulebook changes that for disputes processed on or after October 24. The two earlier purchases can come from “one or more Merchants.”
Visa’s stated reason: “to further reduce friendly fraud.” Translation: Visa thinks a lot of people who say “not me” bought the thing.
Here’s the catch. The match is on your device, your internet connection and your address, not on you. Anyone who uses your saved card on your laptop, on your Wi-Fi, shipping to your house, looks exactly like you.
There’s one limit. The merchant’s payment processor can only submit purchases it handled itself. So the history comes from other stores that use the same processor, not your whole life.
What it costs you
The law didn’t change. Federal law still caps your liability for unauthorized use of a credit card at $50, and if the issuer tries to collect, the burden is on it to prove the charge was authorized.
What changed is the file. When your bank investigates, it now has a merchant packet showing your device, your IP address and your shipping address on purchases you never disputed. Good luck arguing with that.
Verdict: if you’re the only person who uses your card, this barely touches you. If you share devices or let family use a saved card, it’s questionable, and you should clean that up before the 24th.
Do this now
Pick the right dispute. If you made the purchase and it never showed up or wasn’t what was promised, say that. Don’t call it fraud. This rule only blocks the fraud claim.
Read your statement every month. The rule counts earlier purchases your bank never reported as fraud. A charge you let slide in June becomes evidence against you in December.
Pull your card out of shared logins, family shopping accounts and any device you don’t control. If someone in the house shops on your card, their purchases count as yours, now at more stores than before.
If a fraud claim gets denied, ask for the documentation the merchant submitted. We walked through how to demand the proof. Our credit cards hub covers the rest of your protections.
The detail
A device ID has to be a serial number of at least 15 characters, like a phone’s IMEI. A device fingerprint has to come from at least two software or hardware properties, like browser and operating system versions. Device ID and fingerprint count as one item, not two. Login IDs now include accounts with an “Agentic Payment Provider,” Visa’s phrase for services that shop on your behalf. The rule lives in Section 11.7.5.3 of Visa’s rules.
How Candid Yak makes money. Some of the products we write about pay us if you apply or sign up through our links. That never changes our verdict, our rankings, or the numbers in this article. We call a bad deal a bad deal whether it pays us or not. Some brands shown in our comparison tools are placeholder examples while we finalize partner agreements, and we label them as such.