Two prior transactions and a matching footprint.

Fictional scenarios and synthetic data. Reviewed 6 November 2026.

A card-absent fraud dispute lands on a Hollow Oak subscription with eleven earlier renewals. Tomas thinks that history settles the matter. Ines asks a narrower question: which records meet the applicable evidence test, and which merely make the account look familiar?

What is actually being decided.

Visa’s Compelling Evidence 3.0 is a specific evidence framework, not a general judgement that a long-standing customer must be wrong. Establish the dispute pathway and any applicable liability protection with the acquirer before choosing a response. Authentication success alone should not be treated as an automatic answer to every dispute.

The conditions are counted, not felt.

Visa’s dated merchant-readiness reference describes eligible prior transactions and matching data elements. The operational lesson is to keep four questions separate: correct payment credential, eligible prior status, applicable date window and sufficient permitted matches.

Public descriptions use different date anchors across processing contexts. Do not build a production rule by mixing them. Obtain the current checklist for the exact pre-dispute or dispute pathway, identify the reference date it uses and retain that version with the response. This lesson intentionally does not declare a universal current eligibility window.

Eleven renewals, two candidates.

For an arithmetic exercise only, set a reference date of 20 October 2026 and assume a hypothetical window of 120–365 days. A 28 September transaction is 22 days earlier; 12 June is 130 days earlier; 5 March is 229 days earlier; 15 September 2025 is 400 days earlier. Only the middle two pass this illustrative time test.

Passing the time test is not a programme decision. The original and prior transactions still need the correct credential linkage, eligible status and required matching elements under the applicable current rules.

Now compare the records. The June candidate shares an account identifier and device reference. The March candidate shares those plus an IP address. Keep the original values, provenance and timestamps. Do not quietly substitute an email address for a defined user identifier or a recipient email for a physical shipping address unless the current specification permits that mapping.

What the footprint does not prove.

A repeated device can support a relationship between transactions. It does not independently identify the person operating that device or rule out compromise and household sharing. Record both the match and its limitations. The account-level investigation can therefore remain open even when a response package is technically eligible.

The case that feels strong.

Pondside has six earlier purchases but only two weakly related email fields in its export. A long relationship does not manufacture missing required evidence. Ask which additional records legitimately exist; do not invent a device match or claim that a customer admitted anything they did not say.

A way to work it.

1. Confirm the exact dispute pathway and current checklist with the acquirer.
2. Separate account history from the relevant credential history.
3. Apply the confirmed date anchor and eligibility conditions.
4. Map permitted elements without changing their meaning.
5. Estimate response effort and record the decision.
6. Review collection and retention against a defined purpose and applicable policy, rather than keeping everything indefinitely.

Take it to the desk.

Can your team explain where every field in a response came from, which checklist was used and what the evidence still does not establish?

Continue with first-party misuse and three layers of a takeover.

Fictional scenario. Synthetic data. No real customer records.