Visa reason code 10.4: Other Fraud, Card-Absent Environment

Quick answer: Visa reason code 10.4 is Other Fraud: Card-Absent Environment. It means the cardholder, or their bank, says an online, phone or mail-order purchase was not made or approved by the real cardholder. On Shopify it appears as Fraudulent. You win by tying the order to the genuine cardholder: a completed 3-D Secure check, matching address and security-code checks, delivery to the billing address, earlier undisputed orders from the same customer, and activity after the sale. With none of those, fighting rarely pays.

Last reviewed 8 October 2026. Card network rules and Shopify's process change, so always check the due date and instructions on your own dispute.

Visa 10.4 at a glance

Network and code	Visa 10.4, Other Fraud: Card-Absent Environment
Shopify label	Fraudulent
What the customer claims	"I did not make or authorise this purchase."
Who it affects	Any store selling online, by phone or by mail order
Your response window on Shopify	Usually 7 to 21 days, shown on the dispute page
Bank decision time	Up to 75 days after you submit, per Shopify
How many times you can submit	Once
Strongest evidence	3-D Secure completed, delivery to the billing address, earlier undisputed orders, matching device or IP
Default call	Fight if the order is linked to the cardholder. Accept if it is a first-time buyer with failed checks and a new address.

What Visa 10.4 means

Visa sorts disputes into families. The 10.x family is fraud, and 10.4 is the code used when the card was not present at the sale. For an online store that means every order. The cardholder's bank has recorded one of two things: the cardholder says they did not make or authorise the purchase, or the bank believes the card details were used without permission.

It is easy to confuse with three neighbouring claims:

• "I never received it." That is Visa 13.1, a consumer dispute. The customer accepts they ordered.
• "I do not recognise this name on my statement." Shopify labels this Unrecognised. It often turns into a fraud claim if the customer cannot place the charge.
• "Something was wrong with it." That is 13.3.

In a 10.4 dispute the customer is not complaining about you. They are saying the purchase was not theirs. Sometimes that is true. A stolen card number was used, the fraudster took the goods, and the real cardholder found the charge. Sometimes it is not. The cardholder, or someone in their household, placed the order and later disputes it because they forgot, did not recognise the descriptor, or regretted the purchase. Banks call the second group first-party misuse. Merchants call it friendly fraud. Your evidence is what lets the bank tell the two apart.

Equivalent codes on other networks

Network	Code	Name
Visa	10.4	Other Fraud: Card-Absent Environment
Mastercard	4837	No Cardholder Authorization. See our 4837 guide
American Express	F29	Card Not Present. See our F29 guide
Discover	UA02	Fraud: Card-Not-Present

If you are looking at a different network's code, the evidence in this guide still applies. The rules around authentication and repeat-customer proof differ in the details.

How a 10.4 dispute unfolds on Shopify

Shopify's help pages describe the sequence. Here it is in the order you will experience it:

Stage	What happens
Day 0	The customer's bank raises the dispute. Shopify withdraws the disputed amount and the chargeback fee from your balance straight away.
Days 1 to 21	You gather evidence. Shopify says you usually have 7 to 21 days, and the exact deadline is on the dispute page.
Submission	You submit your response. It can be submitted once, so everything has to go in together.
Review	The bank reviews it. Shopify says this can take up to 75 days.
Outcome	If you win, the amount is returned, and the fee may be too, depending on your country. If you lose, the money stays with the customer.

Shopify adds some order information to your response for you. It does not judge whether your evidence is strong enough, and it cannot write the argument. Where to look for the dispute in your admin is covered in where to find chargebacks in Shopify, and what Shopify sends automatically is in what Shopify submits as evidence.

What the bank actually checks

The bank is trying to answer one question: is it likely that the real cardholder was behind this order? It looks for signals that connect the order to the person who owns the card.

1. Authentication. Did the customer complete 3-D Secure at checkout?
2. Payment checks. Did the address verification and the card security code checks return a match?
3. Delivery. Were the goods delivered to the billing address, or to an address the cardholder is known to use?
4. History. Has the same customer paid with the same card before and never disputed?
5. Technical match. Do the IP address, device and email fit the customer's earlier orders?
6. Behaviour after the sale. Did the customer log in, track the parcel, use the product or write to you?

Each signal alone is modest. Together they tell a story that is hard for a bank to ignore.

Signals that point to friendly fraud and to true fraud

Knowing which one you face decides whether to fight. Treat this table as a guide, not a rule.

Signal	Points to the real cardholder (friendly fraud)	Points to a stolen card (true fraud)
Billing and shipping address	Same address, or an address seen on earlier orders	New address that matches nothing on the card
Customer history	Earlier orders, account created months ago	First order, account created minutes before
Delivery	Delivered to the billing address, signed for or photographed	Redirected, or sent to a freight forwarder or parcel locker far from the billing address
Contact after the sale	Tracking emails opened, customer wrote in, logged in	No contact at all
Email and device	Matches earlier orders	New email, new device, mismatched location
Order pattern	Normal basket for this customer	Several high-value items, express shipping, many attempts
Payment attempts	One successful payment	Several failed cards before one worked

Where most signals sit in the left column, fight. Where most sit in the right column, accept the loss and look at prevention. Where they are mixed, estimate your chances honestly, then decide using the break-even maths below.

3-D Secure and who is responsible

3-D Secure is the extra step in which a customer approves a payment with their bank, for example through a banking app or a one-time code. Visa's version is called Visa Secure. In many regions it is required by regulation, such as Strong Customer Authentication in the UK and EU.

The reason it matters for 10.4 is liability. When a customer completes authentication, responsibility for a later fraud dispute generally moves from the merchant to the card issuer. In practice this means:

• If the order was authenticated and you still received a 10.4, say so in the first line of your response and attach the proof from the order.
• Ask your payment provider whether the dispute should have been blocked or rejected. Shopify Payments support can check.
• If the order was not authenticated, because the customer was exempt or the bank did not ask, you are not protected by the shift, and the rest of your evidence has to carry the case.

Rules vary by region, card and exemption, so confirm how it applies to your store.

Compelling Evidence 3.0 in plain English

In 2023 Visa introduced a set of rules known as Compelling Evidence 3.0, or CE 3.0, for 10.4 disputes. The idea is simple: if you can show that the same customer made earlier purchases that were not disputed, and that those purchases share technical details with the disputed one, the dispute can be treated as probable friendly fraud rather than true fraud.

As Visa describes it, the case rests on these ideas:

• You need at least two earlier transactions by the same customer that were not disputed.
• Those transactions are expected to be between roughly four months and one year old, so they sit well past the normal dispute window and are still clean.
• The disputed order and the earlier ones must share identifying data: for example the IP address, a device identifier, an account login, the delivery address or the email address. At least two matches are needed, and one of them should be a technical identifier such as the IP address or device.

When the conditions are met, the dispute can be passed back to the issuer, which then has to prove otherwise. Think of it as a shortcut for repeat customers.

Three honest cautions:

1. CE 3.0 depends on how your payment provider supports it, and on whether the technical details were actually captured at the time of each order.
2. The thresholds are set by Visa and can change. Check your provider's current guidance rather than relying on a summary, including this one.
3. It only helps with repeat customers. A first-time buyer gives you nothing to compare.

Whatever your provider supports, one habit helps: keep order history searchable. When a dispute arrives, search for the customer's email, list their earlier orders with dates, amounts and delivery addresses, and put that table in your response. A reviewer reads it in seconds, and it works whether or not CE 3.0 applies.

Worked example 1: a winnable case

A running-shoe store sells a pair for £129.00. The customer, based in Leeds, orders on 14 August. The billing and delivery address are the same. Both the address check and the security code check matched. The parcel is delivered on 17 August with a carrier scan. On 2 October the customer's bank raises a 10.4 dispute.

The merchant searches Shopify and finds:

• The same email placed two earlier orders, £64.00 in March and £89.50 in May, both delivered to the same address and neither disputed.
• Delivery of the disputed order to the billing address, scanned on 17 August.
• A customer account login on 20 August, the day the customer tracked the parcel.

The response puts the three orders in a small table, shows the delivery scan, states the address and security checks matched and notes the account activity. A reviewer sees a long-standing customer, delivery to the cardholder's own address and activity after the sale. This is a strong case.

Worked example 2: a case to accept

The same shoe store receives an order for £289.00 from a new email. It is a first purchase, the account was created four minutes before checkout, the billing address is in Manchester, the delivery address is a parcel locker in Southampton, the address check failed, and two other cards were declined first. Shopify flagged the order as high risk. The merchant shipped it anyway. Two months later a 10.4 arrives.

There is nothing connecting the order to the cardholder. A letter cannot create evidence. Accepting the dispute costs the same money as losing it, and it saves the time. The useful work is afterwards: review orders with this pattern before shipping, and cancel the ones you cannot verify.

The break-even maths

Fighting is not free, because your time has a cost. The fee and the disputed amount are already withdrawn whether you fight or not, so the only extra cost of fighting is your time. That gives a simple rule.

Break-even win chance = value of your time ÷ money you would recover if you win.

Order value	Time to respond (45 min at £20/hour)	Break-even win chance
£40	£15	37%
£129	£15	12%
£289	£15	5%
£650	£15	2%

On a £129 order you only need to be right about one time in eight for the effort to pay for itself, so it is worth fighting any case with real links to the cardholder. On a £40 order you need better odds, so spend the time only when you have strong proof. Plug in your own numbers with our Should I Fight This Chargeback? calculator, and read is it worth fighting a chargeback for the longer argument.

Should you fight it or accept it?

What your records show	What to do
Repeat customer with earlier undisputed orders to the same address	Fight. This is the strongest 10.4 pattern.
3-D Secure completed by the customer	Fight. Lead with it, and ask your provider why the dispute was not blocked.
Delivered to the billing address, address and security checks matched	Fight. Add the delivery scan.
Customer logged in, contacted you or used the product after the sale	Fight. Show the activity with dates.
Digital product with account login and download logs after purchase	Fight with the access log.
First-time buyer, delivered to a new address that does not match the card	Usually accept. Chances are low.
Address check failed, Shopify flagged high risk, and you shipped anyway	Usually accept, then tighten your rules.
Order not yet shipped	Cancel and refund. You cannot show delivery that did not happen.

Accepting is not a failure. The money and fee are gone either way, and the time you save can go into fixing the cause. Fight when the records support you.

How to respond to a Visa 10.4 dispute, step by step

1. Read the dispute and note the deadline. Open the dispute in Shopify, check the reason, the amount and the due date, and put the date in your calendar a few days earlier.
2. Open the order and review the risk analysis. Look at the fraud analysis, the address and security-code results and whether 3-D Secure was completed.
3. Compare billing and shipping addresses. Put them side by side. A match is a strong signal.
4. Search for the customer's earlier orders. Search by email and by address. Note dates, amounts, delivery status and whether any were disputed.
5. Collect delivery proof. Get the tracking number, carrier, status, date and time, and any signature or photo. Check the delivery date is before the dispute.
6. Gather activity after the sale. Look for account logins, tracking emails opened, messages from the customer, downloads or reviews.
7. Write a short, factual letter. One page. Start with the strongest fact. Use the template below.
8. Attach the proof and submit once. Check every attachment opens, and remember you cannot add to it afterwards.

The evidence checklist

Send what you have and leave out what you do not. Reviewers do not reward long files.

Evidence	Where to find it
Order number, date, items, amount and currency	The order page
Whether 3-D Secure was completed	The order's payment details and fraud analysis
Address check and security code result	The order's payment details
Billing and shipping address side by side	The order page, customer section
Tracking number, carrier, delivery status, date and time	The fulfilment section and the carrier's tracking page
Delivery photo or signature	The carrier's tracking page, if provided
Earlier orders from the same customer	Search the orders list by email
Logins, downloads or product use	Your account system, app or download logs
Customer messages	Your support inbox or chat
Refund and shipping policy as shown at checkout	Your store policies

A letter you can adapt

Keep the letter under a page. State facts, point to attachments and stop.

To the issuing bank,

We ask that this dispute for order [ORDER NUMBER], [AMOUNT] placed on [DATE], is reversed. The evidence shows the order was placed by the cardholder.

Authentication and checks. [3-D Secure was completed on this order.] The address verification check and the card security code check both returned a match.

Delivery. The order was shipped with [CARRIER] under tracking number [NUMBER] and delivered on [DATE] at [TIME] to [ADDRESS], which matches the billing address on the card.

History. The same customer placed [N] earlier orders, none of which were disputed: [DATE, AMOUNT, DELIVERY ADDRESS], [DATE, AMOUNT, DELIVERY ADDRESS].

Activity after the sale. [The customer logged in on DATE to track the parcel / wrote to us on DATE regarding the order.]

The attachments show the order, delivery confirmation and order history. We ask the bank to reverse the dispute.

Never accuse the customer of lying, never write about how long you have been in business, and never repeat what the attachments already show.

Common mistakes

• Fighting a case with nothing connecting the order to the cardholder. A letter cannot create evidence that does not exist.
• Forgetting earlier orders. They are the strongest proof and the easiest to find.
• Showing the shipping address but not the billing address. The comparison is the point.
• Leaving out the security-check results. A matching security code and address check count in your favour.
• Not mentioning 3-D Secure. It can change who is responsible, so put it first.
• Adding documents after submitting. You cannot. Evidence is submitted once.
• Writing an essay. Reviewers read many of these. Short and specific wins.
• Missing the deadline. If you do not respond, the bank decides without you and you lose.
• Treating every fraud dispute the same. A repeat customer in the same city and a first-time buyer abroad are different cases.

How to reduce Visa 10.4 disputes

Prevention costs less than any dispute. These are the steps with the biggest effect, in order.

1. Use and read fraud analysis. Review orders Shopify flags as higher risk before shipping, and cancel those you cannot verify.
2. Use 3-D Secure where it is offered. It shifts responsibility for most fraud disputes to the issuer.
3. Be careful with mismatched billing and shipping addresses, especially on first orders and higher-value items.
4. Use a clear billing descriptor. Many disputes start because the customer does not recognise the name on their statement.
5. Send order and shipping emails. A customer with a confirmation is less likely to say they never ordered.
6. Hold or verify high-risk shipments. A short email asking the customer to confirm costs little.
7. Watch your dispute rate. Too many disputes can trigger warnings from the card networks. Our Visa dispute-rate calculator and the guide to chargeback rate and thresholds show where you stand.
8. Keep order history searchable and clean, so repeat-customer evidence is easy to find.

Glossary

• Issuer. The bank that issued the customer's card.
• Acquirer. The bank or provider that processes your payments. On Shopify Payments, that is Shopify's payment partner.
• Chargeback. A reversal of a card payment started by the issuer after the customer disputes it.
• Representment. Your response with evidence, sent back to the bank.
• Chargeback fee. A fee charged to you when a chargeback is raised, whatever the outcome. The amount depends on your country.
• Friendly fraud. A dispute in which the genuine cardholder made the purchase.
• AVS. Address verification, a check that the billing address matches the one the bank holds.
• CVV. The card security code check.
• 3-D Secure. The extra authentication step in which the customer approves a payment with their bank.
• CE 3.0. Visa's Compelling Evidence 3.0 rules for using earlier undisputed orders as evidence in 10.4 disputes.

How ChargeFix handles it

ChargeFix reads the order, payment and shipping records from Shopify. It lays the billing and shipping addresses side by side, shows the address and security-check results the payment returned, and pulls the delivery status and tracking events. When something is missing it says so instead of writing around it. It scores the evidence, tells you whether the case looks worth fighting, and drafts the letter using only facts found in your records. You review and edit everything before anything is saved or filed. Install it free.

Frequently asked questions

What does Visa reason code 10.4 mean? It means the cardholder says they did not make or authorise an online, phone or mail-order purchase. Visa calls it Other Fraud: Card-Absent Environment. On Shopify it shows as Fraudulent.

Is a 10.4 dispute always real fraud? No. Some are true fraud, where a stolen card was used. Others are friendly fraud, where the real cardholder placed the order and later disputes it, sometimes because they forgot or did not recognise the name on the statement.

What evidence wins a 10.4 dispute? Delivery to the billing address, matching address and security checks, a completed 3-D Secure check, earlier undisputed orders from the same customer, and activity after the purchase such as logins or messages.

What is Compelling Evidence 3.0? It is a set of Visa rules that let a merchant show earlier undisputed orders from the same customer with matching technical details, such as IP address or device, so the dispute is treated as likely friendly fraud. Support depends on your payment provider.

Does 3-D Secure protect me from 10.4 disputes? In most cases it moves responsibility for a fraud dispute to the card issuer when the customer completed authentication. If you still receive a 10.4 on an authenticated order, say so in your response and ask your payment provider.

How long do I have to respond on Shopify? Shopify says you usually have 7 to 21 days, and the exact date is on the dispute page. Evidence can be submitted only once.

How long does the bank take to decide? Shopify says the review can take up to 75 days after you submit your response.

Should I fight a 10.4 on a first-time order shipped to a new address? Usually not. Without a link to the real cardholder the chances are low. The time is better spent on prevention.

Do I get the chargeback fee back if I win? It depends on your country and your payment provider. Check Shopify's help page for your region.

What if the cardholder's family member placed the order? The bank still sees it as unauthorised if the cardholder says so. Delivery to the cardholder's address and use of the product can still help.

Can I refund instead of fighting? You can, but check with Shopify Support first when a dispute is open. A refund on an order with an open chargeback can mean the customer is paid twice.

How many 10.4 disputes are too many? Card networks watch dispute counts and ratios. The thresholds change, so use our calculators and your provider's guidance.

Sources and review

• Shopify Help Centre, Overview of the chargeback and inquiry process: response window, decision time, fees and accepted evidence.
• Shopify Help Centre, Chargeback reasons: how Shopify groups dispute reasons
• Stripe, Dispute categories and reason codes: the card network code and the category it falls under
• Visa's published reason code lists and Compelling Evidence 3.0 materials, as summarised by major payment providers. Card network rules change, so confirm current thresholds with your payment provider.
• Stripe, Dispute evidence best practices: further reading on how to format convincing evidence
• Adyen, Manage disputes: further reading on how another payment provider handles disputes

Written by the ChargeFix team. We update this page when Shopify or the card networks change their rules.