Visa CE3.0 vs Mastercard First-Party Trust: Evidence and Eligibility Compared

Visa Compelling Evidence 3.0 (CE3.0) and Mastercard First-Party Trust are card network rules that let merchants use identity, device and delivery data to stop fraud claims on genuine purchases. CE3.0 matches the disputed sale to earlier undisputed sales, while First-Party Trust asks for one data point from each of three categories.

Both target friendly fraud, but their data rules, history needs and dispute routes differ. The best plan is one shared evidence record with a separate eligibility check for each network.

{{cta}}

Visa CE3.0 vs Mastercard First-Party Trust at a glance

The table compares what each network publishes today. Where a network does not publish a detail, the table says so.

Sources: Visa CE3.0 client FAQ and Mastercard First-Party Trust FAQ.

How Visa CE3.0 works

Visa Compelling Evidence 3.0 applies to one dispute type: condition 10.4, Other Fraud in a card-absent setting. Visa's 2023 merchant readiness guide ties it to the 15 April 2023 update of that dispute code. The merchant shows that the same cardholder bought before, with matching identity data, and never disputed those earlier sales.

First-time buyers cannot qualify. If goods are not shipped, a billing address cannot replace the delivery address. For recurring payments, use the data from the initial setup. Source: Visa CE3.0 client FAQ.

Merchants can send this data before a dispute is filed through Verifi Order Insight. Visa's FAQ says the dispute is then rejected and the related TC40 fraud record is removed. That matters for VAMP, which counts fraud reports and disputes together. Stopping a claim this early is a form of chargeback deflection.

CE3.0 edge cases from Visa's client FAQ

Visa's CE3.0 client FAQ settles several points that decide whether a case goes through. Most guides leave them out.

• RDR still runs. Visa says CE3.0 has no impact on Rapid Dispute Resolution. A fraud dispute that passes the Visa Resolve Online (VROL) edits still enters RDR if you take part. An RDR rule that auto-accepts 10.4 claims can refund a sale you could have defended with CE3.0 data.
• 3DS rules still apply. Visa's 3DS edits run on all fraud disputes, whether or not CE3.0 applies.
• Issuers can push back. An issuer can ask for an exception review of a CE3.0 reject, as with any other dispute reject. It must show why the reject was wrong.
• Tokens count. Visa uses the underlying card number (PAN) to confirm the merchant and cardholder pairing, even when a sale used a token.
• Business lines stay apart. Under the original rules, a merchant with several business lines generally cannot use history from one line for another. The merchant descriptor must also match from left to right. The 24 October 2026 change below widens this.
• Item names reach the issuer. The issuer's data package shows the two undisputed sales, their item descriptions and the matching data elements. Clear item names make the pattern easy to see.

Mastercard has not published a matching FAQ for First-Party Trust on these points. Ask your acquirer how it treats tokens, several merchant IDs and issuer reviews before you assume the two work the same way.

What changes for CE3.0 on 24 October 2026

The Visa public rules, April 2026 edition, section 11.7.5.3, expand CE3.0 for disputes processed on or after 24 October 2026:

• The earlier sales may come from one or more merchants, not only yours.
• The match can use the same card or a credential linked to it.
• Login IDs from an agentic payment provider count as account IDs. This matters for agentic commerce chargebacks.
• In pre-arbitration, an acquirer may only send data for sales it took and processed itself.

The processing date picks the rule version. Ask your provider whether it supports the expanded route and how it gets history from other merchants. Do not build a cross-merchant data process just because the rule allows it.

How Mastercard First-Party Trust works

Mastercard announced First-Party Trust in October 2023 as a global program, built with the Merchant Advisory Group and the Merchant Risk Council. Its program FAQ says it came into effect in the United States in October 2024. In June 2025, Mastercard announced expansion to Canada, Latin America and the Caribbean, and Asia Pacific, without set dates.

Mastercard's developer documentation says the program handles disputes filed under reason code 4837 (no cardholder authorization), while CE3.0 covers Visa 10.4.

The program set new rules that define compelling evidence for genuine purchases. Merchants that meet the data-sharing rules get chargeback protection on qualifying disputes. Sharing the data is optional, and there are two ways to do it:

Sources: Mastercard press releases (2023, 2025) and Mastercard B2B program blog.

Sources: Mastercard program FAQ and Mastercard US First-Party Trust page.

The two Mastercard pages list some elements in different places. The US page says the third element can be an additional identity factor or an unused device or delivery element. Ask your acquirer which list your processor uses.

Mastercard's program blog adds two details most guides skip. Issuers take part automatically under their Mastercard agreements, and any merchant can join where the program is live. A cardholder can still appeal a declined chargeback, for example with a signed affidavit, and the issuer may send the chargeback back to the merchant.

Key differences that change your evidence plan

Three differences shape how you prepare:

• Purchase history. CE3.0 depends on earlier sales to the same card. First-Party Trust publishes no fixed minimum, but its engine finds the cardholder's past transactions. You then send data for the disputed sale and for those past sales.
• Match versus send. CE3.0 needs two elements to match across three sales. First-Party Trust needs one element from each of three categories.
• Timing. CE3.0 data can stop a claim before a dispute through Order Insight. First-Party Trust data can travel with the authorization itself.

Mastercard also has a tool that shares order data before a dispute: Ethoca Consumer Clarity. Our guide to Order Insight vs Consumer Clarity compares the two.

Worked example: one repeat customer checked against both programs

This sample case uses made-up dates to show where the two rule sets split. A customer files a fraud claim on 20 August 2026 for an online order. They placed two earlier orders on the same card, and neither was disputed.

Meeting the Mastercard data rule is not a verdict. Mastercard still checks the data against the cardholder's past transactions before the issuer decides.

Now change one fact. If Order B had been placed on 15 May 2026, it would be only 97 days old. Visa CE3.0 would fail, because just one earlier sale sits in the window. The Mastercard data rule would still be met, since Mastercard publishes no history window.

Change a second fact. Say the buyer checked out as a guest on a new phone. Login ID and device ID no longer match, so Visa CE3.0 fails: a shared shipping address alone is not enough.

For Mastercard, the new phone still fills the device factor. A guest checkout means you need another identity element, such as a phone number or billing address.

Build one evidence foundation with two qualification tracks

The shared foundation links the payment, the customer account, the order, the identity records and proof of delivery. Keep the values captured at the time of the sale. Do not replace them with today's profile data.

On top of that, keep a versioned eligibility record per case. Note the network, the route, the rule version, the fields sent, the provider decision and the reason for any failure. This stops a generic "evidence complete" flag from being read as network eligibility.

This is an in-house planning tool. It does not replace either network's rules. Its job is to stop one record from getting two protection labels it has not earned.

Walk through a case before comparing providers

Take a test subscription customer with a stable account history and a newly disputed renewal. Ask the provider which network route applies, which records it uses and what its result means. Keep the test data synthetic or redacted.

Then change one fact at a time. Remove a historical value. Change the merchant account. Mark an earlier payment as disputed. Add signs of account takeover. Move the processing date across 24 October 2026. Each change should give a clear result or a documented unknown.

A repeat customer is not always a friendly fraud case. A stolen account can look like a loyal buyer. A fair cancellation or service complaint also needs a different reply than a claim that the buyer never paid.

How to compare reported results fairly

Keep sent, qualified, deflected and won cases apart. A rate of claims stopped early and a rate of cases won measure different groups. They do not share a base.

Compare the same time period, region, payment types and dispute reasons. Show which cases were left out or are still open. If two providers define results in different ways, do not rank them.

Also split money kept, money won back, refunds and fees. Stopping a chargeback by refunding the buyer is not the same as keeping the funds. The chargeback management guide explains these metric families.

What happens when a transaction does not qualify?

An ineligible result is a routing decision. It does not prove the customer is right or that you have no evidence. Check the reason code first, using the Visa reason codes or Mastercard reason codes guide. Then keep the formal due date and decide whether to accept or fight.

Use the evidence source map to find supporting records. Record why each item is relevant and what it cannot prove. Never fill missing history with invented values to pass a qualification test. Track the chargeback time limits for each network so a failed check never costs you a response.

Visa CE3.0 and Mastercard First-Party Trust FAQs

What is compelling evidence?

Compelling evidence is information that shows a cardholder took part in a disputed purchase, such as matching device, login or delivery data. Under Visa CE3.0 and Mastercard First-Party Trust, compelling evidence that meets each network's data rules can stop a fraud claim on a genuine purchase.

What is the difference between Visa CE3.0 and Mastercard First-Party Trust?

Visa CE3.0 needs two or more earlier undisputed sales to the same card, 120 to 365 days old, with two of four data elements matching. Mastercard First-Party Trust needs one data element from each of three categories (device, delivery and additional identity) and publishes no history minimum.

When did Mastercard First-Party Trust launch?

Mastercard announced First-Party Trust in October 2023, and the program came into effect in the United States in October 2024. In June 2025, Mastercard announced expansion to Canada, Latin America and the Caribbean, and Asia Pacific.

Can first-time customers qualify for CE3.0 or First-Party Trust?

First-time customers cannot qualify for Visa CE3.0, because it needs at least two earlier undisputed sales. Mastercard First-Party Trust publishes no minimum purchase history, so ask your acquirer how first-time buyers are treated on your account.

Does Mastercard charge a fee for First-Party Trust?

Mastercard's First-Party Trust pages and press releases do not publish a fee. Any cost depends on your acquirer, processor or dispute provider, so ask what triggers each charge before you enroll.

Do CE3.0 deflections count toward VAMP?

According to Visa's CE3.0 client FAQ, a dispute is rejected when the merchant supplies the data through the Order Insight pre-dispute option, and the related TC40 fraud record is removed. So a CE3.0 deflection should not add to VAMP fraud or dispute counts. Confirm the current treatment with your acquirer.

Keep CE3.0 and First-Party Trust connected to chargeback recovery

Network rules stop some fraud claims early. They do not answer chargebacks that fall outside their scope, such as non-fraud claims or Visa first-time buyers. Those cases still need evidence and a response before the deadline.

Build evidence and recovery steps for each network with Chargeflow Automation. Confirm support for your payment stack and any named network program before you rely on it.