Visa Makes Fraud Chargebacks Harder Oct. 24. How to Still Win a Dispute

On October 24, 2026, Visa widens the rule that lets online merchants defeat a "fraud" chargeback with your own purchase history. Under the Visa Core Rules edition dated April 18, 2026, the earlier undisputed purchases a merchant cites can come from more than one merchant. For you, a fraud claim on something you or your household actually bought is more likely to fail, while a genuine billing error, such as a package that never came, keeps the federal protections it has had for decades.

The networks have given merchants better evidence tools and stiffer penalties for high dispute rates, but the law behind your dispute has not changed. A dispute has the best chance when it uses the right reason, meets the legal deadline and carries the right evidence.

Key takeaways

Since April 15, 2023, Visa has let an online merchant invalidate a fraud dispute by showing two earlier purchases on the same card, made 120 to 365 days before the dispute and never reported as fraud, with matching device or IP data.
For disputes processed from October 24, 2026, those two purchases can come from more than one merchant; at the pre-arbitration stage, the acquirer (the bank that processes the merchant's card payments) can submit only purchases it processed.
On April 1, 2026, Visa cut the fraud-and-dispute ratio that flags a large US merchant as "Excessive" from 2.2% to 1.5% of its online and phone transactions.
On credit cards, the issuer must receive your written notice within 60 days after sending the first statement with the error, and resolve it within two complete billing cycles, never more than 90 days.
On debit cards, federal error rules cover unauthorized and incorrect transfers, not quality disputes, which depend on network rules and your bank.

What it means for you

An online order never arrived. On a credit card this is a billing error, and the issuer may not deny it unless it finds the item was actually delivered or sent as agreed. File it as "not received," not fraud.
A canceled subscription kept billing. Visa asks for the date you withdrew permission and how you told the merchant, so your cancellation confirmation is the core evidence.
An item was "not as described." Expect to return it or show you tried. Quality complaints about goods you accepted fall under a narrower rule with location and amount limits.
A charge you don't recognize. Rule out a family member, an unfamiliar billing name or a forgotten trial first. If it truly is not yours, report it quickly; on debit, your liability grows the longer you wait.
Debit or credit. Credit gives you more legal options for merchant problems; with debit, the money has already left your account.
Denied before. You can request the documents behind the decision, answer with new evidence or switch legal routes, as the section on denials explains.

What changed for merchants

Visa's purchase-history rule

Visa's target is "first-party misuse," a cardholder reporting fraud on a purchase they authorized. Its March 2023 Compelling Evidence FAQ applies the rule, known as Compelling Evidence 3.0, to disputes submitted on or after April 15, 2023, and only to fraud claims on "card-absent" purchases: online, in-app and phone orders.

The merchant must show two earlier transactions on the card that were never reported as fraud, processed 120 to 365 days before the dispute. The device ID, device fingerprint or IP address must match the disputed order, plus one more item such as the account login or full delivery address, and the merchant must describe what was bought. If the evidence qualifies, the dispute is invalid.

For disputes processed on or after October 24, 2026, the April 2026 rules accept earlier purchases on the same card, or a token linked to it, at "one or more Merchants," and treat logins through an "Agentic Payment Provider" (an app that searches for and buys things on the cardholder's behalf) as account data. At the pre-arbitration stage, an acquirer may submit only transactions it processed.

Mastercard's First-Party Trust

Mastercard announced First-Party Trust on October 23, 2023, with a US rollout starting in 2024. Merchants can send extra data with a transaction or during a dispute, giving issuers more insight into the cardholder's purchase history, device, delivery details and identity. Mastercard said the program adds compelling-evidence rules and chargeback protection for disputes that meet the program's data-sharing requirements.

Lower penalty thresholds

Visa's Acquirer Monitoring Program divides fraud reports plus disputes by settled online and phone transactions. Unless the acquirer's whole portfolio is already flagged, a US merchant with at least 1,500 such cases in a month is flagged as Excessive at 1.5% since April 1, 2026, down from 2.2%, and its acquirer must apply risk controls. Disputes settled through Visa's pre-dispute tools, before a formal chargeback, are left out of the count, as are fraud claims defeated under Compelling Evidence 3.0. A large merchant near the line therefore gains from refunding real complaints early and contesting fraud claims it can disprove.

No public data set tracks how often card disputes succeed. In the CFPB's 2025 Consumer Response Annual Report, released March 31, 2026, consumers filing some of the roughly 114,100 credit card complaints said billing-error disputes were typically resolved for the merchant despite their documents. That is how complainants described their cases, not a measured win rate.

What the law still guarantees

The federal rules bind the card issuer, not the merchant. Which one applies depends on the card and the problem.

Situation	Rule	Main conditions	Your deadline
Credit: charge you didn't make, or goods not delivered or not accepted as agreed	Billing error, Regulation Z, 12 CFR 1026.13	Written notice to the billing-error address (electronic only if the issuer's billing rights statement allows it) with your name, account and reason	Issuer must receive it within 60 days after sending the first statement showing the error
Credit: item delivered but defective or not as described	Claims and defenses, 12 CFR 1026.12(c)	You tried to resolve it with the merchant; purchase over $50; in your home state or within 100 miles of your billing address, unless the issuer and seller are related or the issuer mailed the offer	No fixed day count; capped at what you still owed on that purchase when you first gave notice
Debit: unauthorized or incorrect transfer	Error resolution, Regulation E, 12 CFR 1005.11	A phone call counts; the bank may ask for written confirmation within 10 business days	Bank must receive notice within 60 days after sending the statement showing the error
Debit: not delivered, not as described	Not on Regulation E's error list; network rules and bank policy	Set by the network and your bank	Ask your bank; Visa's network limit is usually 120 days

For online and phone orders, the official commentary leaves where a purchase "occurs" to state or other applicable law, so the 100-mile test is not automatic. On credit, the issuer must acknowledge your notice within 30 days. On debit, the bank has 10 business days to investigate (20 for a transfer within 30 days of the account's first deposit), or up to 45 days if it gives provisional credit within those 10 days, and 90 days for point-of-sale debit purchases, transfers not started within a state and new accounts.

For unauthorized credit card use, your liability is capped at $50. For unauthorized debit transfers, Regulation E, 12 CFR 1005.6 caps your loss at $50 if you report a lost or stolen card within two business days of learning of it, and $500 after that; unauthorized transfers you fail to report within 60 days after the statement showing them can leave you liable for later transfers the bank shows timely notice would have stopped.

The network clock is separate. Visa gives the issuer 120 calendar days from processing for most disputes, or from the last expected delivery date for goods not received, up to 540 days. A bank may still pursue a dispute after your 60-day legal window, but the federal deadlines and protections attach only to notices received within it.

How to build a stronger dispute

Contact the merchant first and log it. The billing-error rule does not require it for non-delivery, but Visa's not-received and not-as-described dispute forms include a certification that you tried, and the claims-and-defenses rule requires a good-faith attempt. Note the date, channel, ticket number and answer.
Describe what happened; the bank picks the code. Visa's categories in plain words: did not arrive (13.1), canceled recurring charge (13.2), not as described or defective (13.3), returned or canceled with no refund (13.7), and online fraud you had no part in (10.4). Mastercard has its own codes.
Match evidence to the category. Non-delivery: the order page with the promised date, and tracking. Subscriptions: the cancellation confirmation and later charges. Not as described: the listing, photos and the return label or refusal.
Return or try to return first. For not-as-described and canceled-order disputes, Visa makes the bank wait 15 calendar days after a return or cancellation before filing, unless that would pass the time limit or the merchant refuses the return.
Put it in writing. Use the "billing inquiries" address, not the payment address. The FTC suggests certified mail with a return receipt and copies, not originals.
Don't call it fraud if you made the purchase. A Visa fraud dispute requires the issuer to certify that you deny taking part. Purchases from your own phone, network or address are what the merchant's data is built to show.

Illustrative example: a package that never came

Hypothetical dates and amount, on a Visa credit card whose cycle closes on the 25th.

August 3, 2026: a $240 online order, processed August 4, promised by August 14.
August 17: the buyer emails the merchant; no reply.
August 25: the statement showing the charge is sent.
September 8: the issuer receives the written notice.
October 8: latest date for the issuer's acknowledgment (30 days).
October 24: last day a notice could arrive and still count (60 days after August 25).
November 25: resolution deadline. A mid-cycle notice gives the issuer the rest of that cycle plus the cycles ending October 25 and November 25, which beats the 90-day cap of December 7.
December 12: Visa's limit for the issuer, 120 days after the expected delivery date.

The deadline that binds the buyer is October 24, 49 days before Visa's limit. A notice that arrives after October 24 loses the Regulation Z billing-error protections, even though the bank could still file with Visa.

If your dispute is denied

A credit card issuer that finds no error must explain why in writing and send copies of its evidence if you ask. A debit card bank must explain its findings and tell you that you can request the documents it relied on. A delivery scan to the wrong address, or a "never canceled" claim your confirmation email contradicts, gives you something new to send back.

New evidence matters because an issuer that followed the rules owes you nothing more if you only repeat the same billing-error claim, with one exception: if you dispute again in writing before the payment is due, it may report the amount as late only if it also reports it as disputed and tells you whom it reported to. A quality problem that failed as a billing error may still qualify under claims and defenses.

A complaint to the CFPB goes to the company, which usually replies within 15 days. In 2025, companies closed 12% of credit card complaints with money back and 19% with other relief; 63% got an explanation only. A denial also leaves your claim against the seller intact: small claims court is separate, with limits and fees set by each state.

This article is general education, not legal advice. For a large purchase or a contract dispute, a consumer attorney or legal aid office can assess the details.

Frequently asked questions

Can a card issuer close an account because of a dispute?

Under Regulation Z, a credit card issuer may not close or restrict your account, or demand faster repayment, solely because you used your billing-error rights in good faith. It can still close accounts for other reasons in the card agreement. A fraud claim on a purchase you made is not a good-faith dispute.

Is the disputed amount due while the issuer investigates?

No. During a credit card billing-error investigation you can withhold the disputed amount and related finance charges, and the issuer may not try to collect them; the rest of the bill is still due. With autopay, the issuer may not deduct the disputed amount if your notice arrives at least three business days before the payment date.

Will a credit card dispute hurt a credit report?

While the dispute is open, the issuer may not report the unpaid disputed amount as delinquent, though it may report it as disputed. If it finds no error, it cannot report the amount late until the later of your grace period or 10 days after you could reasonably have received its notice.

Is a purchase by a family member unauthorized?

Usually not if you gave them the card. The official Regulation Z commentary says that if you hand your card to someone, such as a family member, and they exceed what you allowed, you are liable until you tell the issuer their use is no longer authorized. Household orders also share the device, network and address data Visa's evidence rule uses.

What happens if a bank reverses debit provisional credit?

Under Regulation E, the bank must tell you the date and amount it is taking back. For five business days after that notice, it must honor checks and preauthorized payments it would otherwise have paid, without overdraft fees for them.

Before you file: a checklist

Mark the day 60 days after the first statement showing the charge.
Rule out a household purchase or an unfamiliar billing name.
Write one page: what you bought, what went wrong, what the merchant said, amount and date.
Send it through a channel the billing rights statement allows, keep a copy, and follow up if no acknowledgment arrives within 30 days.