Skip to main content

Visa 10.4 - Card Absent Environment (Fraud)

Last updated . Copy page as text

This is the Visa code for a customer denying an online or phone order: 10.4. Looking for Mastercard 4837, Amex F29 or Discover UA02?

Read the code off your notice: four digits and no dot is Mastercard, one letter and two digits is Amex, two letters at the front is Discover. Get that right first, because the response deadline runs from 20 days on Amex to 45 on Mastercard.

TL;DR
  • A cardholder told their bank they didn't make an online order. It's the fraud code you'll see most
  • Ran 3DS and got ECI 05? The issuer eats it. That's the whole ballgame
  • No 3DS? Compelling Evidence 3.0 is next best: two earlier orders on the card, more than 120 and no more than 365 days before the dispute, matching on at least two data points, including IP or device. Checklist
  • They get 120 days. You get 30 days (see your notice) to answer

Got this code?​

Your deadline: The date on your notice wins. Visa's standard response window is 30 days, and your processor can set an earlier one.

The claim: Someone says they didn't make the online purchase you shipped. That's 10.4, Visa's main fraud code for card-not-present.

Records that answer it:

  1. 3D Secure records: an ECI 05 result is your strongest defense
  2. Two earlier purchases on the card the issuer never reported as fraud, for Compelling Evidence 3.0
  3. Delivery records for the order

Next: Decide whether it's worth fighting, then fill in the response outline for this claim and follow the Representment Workflow.

Records by what you sell​

The same claim needs different records depending on what you sold. Find your column.

What you sellShipped goodsDigital or onlineIn person or a service
Records that answer it
  • The 3D Secure result, if it ran
  • The shipping address matching an AVS-verified billing address
  • Earlier undisputed orders on the same card, and delivery records
  • The customer's IP address, device and email at purchase
  • Login or access logs after the payment
  • Earlier undisputed payments on the same card
  • The receipt and the card entry method: read from the chip, or typed in
  • Chip and PIN results, and the authorization response
  • For a collected order or service: the signature and ID details the cardholder gave
Where to find them
  • Shopify: the order's Order risk section shows AVS and CVV indicators and the IP address when available. Submit through Add evidence
  • Stripe: Counter dispute on the dispute details page. Stripe fills in the 3D Secure ECI for a liability-shift case. For an eligible Visa 10.4, leave pre-filled CE 3.0 fields unchanged and complete any empty required fields. Shipping goes in shipping_address and shipping_tracking_number
  • Square: Orders & payments > Disputes, in the dispute's information request form
  • Stripe: Counter dispute on the dispute details page: customer_purchase_ip, customer_email_address, access_activity_log. For an eligible Visa 10.4, leave pre-filled CE 3.0 fields unchanged and complete any empty required fields
  • Shopify: the IP address in the order's Order risk section, when available
  • Your own server or app logs for device and access records
  • Square: the payment in Orders & payments > Transactions. Square says a fraud claim on a chip card that was swiped generally goes the customer's way
  • Stripe: Counter dispute on the dispute details page: customer_signature, service_documentation
  • Your processor, for the entry mode and chip results it holds

Sources: Stripe's evidence by product type VENDOR; Stripe's dispute response form VENDOR; Shopify's evidence by reason VENDOR; Shopify's order risk analysis VENDOR; Square's dispute walkthrough VENDOR; Square's transaction search VENDOR. Checked 24 October 2026. Menus move, so follow what your own dashboard shows.

When This Code Applies​

  • Cardholder denies making an online purchase
  • Card credentials used without authorization
  • Account takeover leading to CNP fraud
  • Stolen card used for an online purchase
  • Friendly fraud, where the cardholder says it wasn't them

Conditions for Valid Dispute​

The issuer has to confirm two things. The cardholder didn't authorize the charge, and got no benefit from it. It also has to be card-absent, and filed inside the window.

Card-absent means e-commerce, MOTO, or recurring billing without proper authentication.

When the Dispute Isn't Valid At All​

Visa lists conditions that make a 10.4 invalid before anyone argues about evidence. One of them is worth knowing by heart, because it's the serial-disputer rule and almost nobody cites it:

A Transaction on an Account Number for which the Issuer has initiated more than 35 Disputes within the previous 120 calendar days.

Visa Core Rules section 11.7.5.3, Table 11-28, uses more than 35 issuer-initiated disputes on the account in the previous 120 calendar days. That's an account-wide condition, not a count at your shop. Ask your processor to check it.

You can't see the issuer's count. Only the issuer can. So this isn't something you check before responding. Raise it when a customer's behaviour looks like a pattern, such as several disputes from the same person or a story that keeps changing. Put it in your response and make the issuer look:

"We believe this dispute may be invalid under Visa Core Rules 11.7.5.3. Please confirm whether more than 35 disputes have been initiated on this account number in the previous 120 calendar days."

This is a Visa 10.4 condition. It doesn't apply to domestic installment transactions in Brazil. Multiple clearing records from one authorization count as one transaction for this limit. Have your processor check the formal count before you rely on it.

Time Frames​

ScenarioDispute Window
Standard120 days from transaction date
With delivery120 days from delivery date (or expected delivery)
Digital goods120 days from transaction date

Liability Shift with 3D Secure​

Full Liability Shift (Issuer Liable)​

When transaction is fully authenticated:

  • Visa Secure (3DS 2.0) - Challenge flow completed
  • ECI = 05 (fully authenticated)
  • Cryptogram present and valid

Partial/No Liability Shift (Merchant Liable)​

ScenarioECIMerchant Liability
Authentication attempted, issuer unavailable06Reduced
Authentication failed07Full
No authentication attempted07Full
3DS not supportedN/AFull

Compelling Evidence 3.0 (CE 3.0)​

Visa's enhanced compelling evidence program for repeat customers.

CE 3.0 Requirements​

To qualify for CE 3.0 representment:

  1. Two qualifying prior transactions, with the required card or payment-credential link
  2. Each more than 120 and no more than 365 days before the dispute, not the disputed purchase
  3. Match at least two elements, including IP or device. Device ID and fingerprint count as one element

Use the full checklist and dated stage rules. From disputes processed on 24 October 2026, qualifying history can span merchants. Ask your processor which route it supports.

CE 3.0 Process​

CE 3.0 Benefits​

  • Qualifying history can support an invalid-dispute condition or a pre-arbitration response
  • Your processor must confirm the route, data and result

Standard Representment Options​

1. Transaction Was Authorized​

Evidence required:

  • Cardholder correspondence acknowledging purchase
  • Order confirmation sent to cardholder email
  • IP/device match to prior purchases
  • Signed delivery confirmation

2. 3D Secure Authentication​

Evidence required:

  • ECI value showing authentication
  • Cryptogram/CAVV
  • Authentication timestamp
  • 3DS transaction ID

3. AVS/CVV Verification​

Evidence required:

  • AVS match (full or partial)
  • CVV2 match
  • Delivery to verified address

4. Delivery Confirmation​

Evidence required:

  • Carrier tracking showing delivered
  • Signature confirmation
  • Delivery address matches billing
  • Photo proof of delivery (if available)

5. Digital Goods Access​

Evidence required:

  • IP address at time of download/access
  • Access logs showing usage
  • Account login after purchase
  • Download confirmation

6. Prior Transaction History​

Evidence required:

  • Previous undisputed purchases
  • Same email/phone/device
  • Established customer relationship

Representment Time Frames​

StageWindow
Initial response30 days (see your notice)
Pre-arbitration30 days from representment
Arbitration45 days from pre-arb

Which defenses hold up​

Defense TypeRelative strength
3DS authenticated (ECI 05)Strongest
AVS match + delivery proofWeaker
Standard evidenceWeaker still
No evidenceWeakest

Track your own win rate by reason code.

Where This Breaks​

Most merchants who lose 10.4 never ran 3DS. Without it you get no liability shift. So you argue evidence instead of pointing at a rule.

Records are next. Log IP, device fingerprint and timestamps on every order. You can't build a CE 3.0 case without them, and you can't backfill them later.

Delivery proof is the other hole. "Delivered" beats "shipped." A signature beats both.

Then there's the clock. You get 30 days (see your notice). Teams miss it because the notice lands in an inbox nobody reads. Route dispute alerts somewhere a human looks daily.

Thin evidence loses. One order confirmation email isn't a case, and you rarely get a second submission.

  • 10.3 - Other Fraud Card Present
  • 10.5 - VFMP

Next Steps​

Prevent future 10.4 chargebacks:

  1. Implement 3D Secure for liability shift
  2. Set up dispute alerts to refund before chargeback

See Also​

Something wrong on this page? Email matt at paymentsandrisk.com and say what needs fixing.