Visa Reason Code 10.4: How to Win an Unauthorized Transaction Dispute

Visa reason code 10.4 means the cardholder is claiming they did not authorize the transaction. This is a fraud-category dispute, and it covers one of the most common chargeback scenarios service businesses face. The customer is telling their bank: "I did not make this payment, and I did not authorize anyone else to make it on my behalf."

For service businesses, 10.4 disputes are often friendly fraud, meaning the customer did authorize the payment but later claims otherwise. Your job is to prove authorization occurred. This guide covers what 10.4 means, what evidence Visa expects, the mistakes that lose winnable cases, and how to build a response that demonstrates legitimate authorization.

What Visa Reason Code 10.4 Means

Reason code 10.4 falls under Visa's "Fraud" category (the 10.x family). The formal name is "Other Fraud: Card-Absent Environment." For service businesses that process payments online, over the phone, or through invoicing software, this is the fraud code you will see most often.

The cardholder's claim is straightforward: they say the payment was not authorized. There are two possibilities behind every 10.4 dispute:

• Actual fraud: Someone other than the cardholder used the card without permission. If this is genuinely the case, accept the chargeback. Contesting a legitimate fraud claim wastes time and can damage your reputation with your processor.
• Friendly fraud: The cardholder (or someone in their household) did authorize the payment, but they either forgot about it, did not recognize the charge on their statement, or decided to dispute instead of requesting a refund. This is the scenario where a strong response wins.

Key parameters for 10.4 disputes:

• Response deadline: Typically 30 calendar days. Confirm the exact date in your processor portal.
• Burden of proof: On the merchant. You must provide compelling evidence that the cardholder or an authorized person participated in the transaction.
• Liability shift: For card-not-present transactions (most service business payments), liability typically sits with the merchant unless 3D Secure authentication was used.

What Evidence Visa Requires for 10.4

The core question is: can you prove the cardholder authorized this specific payment? Visa looks for evidence that links the cardholder to the transaction, not just evidence that a payment was processed.

Authorization evidence (the strongest category):

• A signed service agreement or contract bearing the cardholder's name.
• An electronic signature, digital consent record, or checkbox acknowledgment tied to the specific transaction.
• Email correspondence from the cardholder's email address discussing the service and agreeing to the charge.
• 3D Secure (Verified by Visa) authentication, if used. This is the single strongest piece of evidence for 10.4 and may shift liability entirely.

Identity-linking evidence (connects the cardholder to the service):

• Proof that the service was delivered to the cardholder's verified address, email, or phone number.
• Login records, account activity, or IP address data showing the cardholder accessed or used the service.
• Previous undisputed transactions from the same card for the same type of service.
• Communication from the cardholder after the transaction (scheduling a follow-up, leaving a review, requesting a modification).

Transaction verification evidence:

• AVS (Address Verification Service) match results showing the billing address matched.
• CVV match confirmation.
• Device fingerprint or IP geolocation data consistent with the cardholder's known location.

For a complete evidence breakdown, see What Evidence to Submit for a Chargeback Dispute.

Why Service Businesses Lose 10.4 Disputes

Fraud-category disputes have lower win rates than consumer disputes (the 13.x family) because the standard of proof is higher. These are the most common reasons service businesses lose 10.4 disputes they could have won.

1. Proving the service was delivered instead of proving authorization. Showing that you performed the service answers a 13.1 dispute ("service not received"), not a 10.4 dispute ("I didn't authorize this"). A customer who claims fraud is not disputing whether the service happened. They are disputing whether they authorized the payment. Your fulfillment documentation is secondary here. Lead with authorization evidence.

2. No signed agreement or electronic consent. If the customer booked by phone and paid over the phone, and you have no signed document, email confirmation, or digital consent record, your authorization evidence is weak. The transaction record alone (a processed payment) does not prove the cardholder authorized it, because the cardholder's claim is precisely that someone else used their card.

3. Ignoring the friendly fraud indicators. If the cardholder scheduled the appointment themselves, communicated with you by email, showed up in person, and left a review, those facts collectively make a fraud claim implausible. Many merchants fail to collect and present these indicators because they do not think of them as "evidence." They are. Present them as a pattern that is inconsistent with unauthorized use.

4. No AVS or CVV match data. Address and CVV verification results are recorded at the time of the transaction. If you did not capture them (or your processor does not display them), you are missing a standard piece of evidence that Visa reviewers expect to see. Check your processor's transaction detail page for these fields.

5. Responding with emotion instead of evidence. Fraud disputes can feel personal, especially when you know the customer used the service. A response that says "the customer is lying" without documented proof is not compelling. Stay factual. Present the authorization evidence, identity-linking evidence, and transaction verification data. Let the pattern speak.

Step-by-Step Response Walkthrough for 10.4

This walkthrough assumes you have read the general response guide. These steps are specific to reason code 10.4.

Step 1: Assess Whether This Is Actual Fraud

Before building a response, honestly assess the transaction. Do you recognize the customer? Did they interact with you directly? If you have no record of any contact with a person matching the cardholder's name, and the payment appeared without a booking or agreement, it may be genuine fraud. Accept the chargeback and review your payment security.

Step 2: Collect Authorization Records

Gather everything that proves the cardholder authorized this specific payment: signed agreements, booking confirmations sent to their email, electronic consent records, and any 3D Secure authentication data. This is your primary evidence category.

Step 3: Build the Identity Link

Document every connection between the cardholder and the service. The email address they used, the phone number they called from, their physical presence at the service location, post-service communication, reviews, and any prior undisputed transactions. The more touchpoints you can show, the less credible the fraud claim becomes.

Step 4: Pull Transaction Verification Data

Log into your processor portal and capture the AVS result, CVV match status, and any device or IP data associated with the transaction. Include these as exhibits even if the match was partial. A partial AVS match is still more evidence than no data at all.

Step 5: Write the Narrative

Structure your summary around the authorization, not the fulfillment. Your opening sentence should state that the cardholder authorized the transaction, supported by Exhibit A (the agreement or consent record). Then present the identity-linking evidence that corroborates authorization. Fulfillment evidence belongs at the end as supporting context, not the lead argument. Use a response letter template to keep the structure clean.

Step 6: Submit and Track

Submit through your processor portal before the deadline. If you use Stripe, see the Stripe-specific guide for submission details.

Preventing 10.4 Disputes

The best defense against unauthorized transaction claims is proof of authorization captured at the time of sale. Use 3D Secure when available, collect electronic signatures or consent acknowledgments, and send booking confirmations to the cardholder's email. A clear billing descriptor that matches your business name also prevents disputes from customers who simply did not recognize the charge. For a full prevention framework, see How to Prevent Chargebacks Before They Happen.