Digital goods have no carrier to confirm receipt and no signed manifest. A download, a subscription login, or a license key leaves the customer's bank with one question: did the customer use the goods after paying?
Many merchants answer with the purchase confirmation email, the order timestamp, and the receipt. The bank already holds the record of approving the payment, so these prove only that the sale happened.
The records that win are created after purchase: the time-stamped first login, the buyer's internet location (IP address) and a record of the buyer's device at first use, the file download log with timestamp and originating IP address, and the license key activation event with the machine ID it ran on. Visa's compelling-evidence rules for digital goods require two of these alongside the purchase record. A setup that writes a usage record to the order at first access takes about a day of engineering work and puts this evidence on file for every order.
Sources
- Visa's compelling-evidence framework for digital goods requires the merchant to supply, alongside the purchase record, at least two of: cardholder IP address and geolocation at purchase, device identification number, cardholder name and email linked to the goods, evidence of post-transaction account or profile access.representments.com evidence guide, Visa 13.1, Section 4.2