Gift card chargeback: what evidence does the bank want?

A gift card chargeback comes down to your own records, because 3D Secure may not move the liability for stored value. Keep three records for every digital gift card: the code, the timestamped email that delivered it, and the redemption entry showing when the balance was first spent.

Why doesn't 3D Secure protect gift card sales?

Stripe lists stored value among the industries Visa excludes from the liability shift. 3D Secure is the extra checkout step where the cardholder confirms the purchase with their bank. Stripe notes that the shift after a successful authentication is never assured, and says the exclusions also include wire transfers and money orders, and foreign currency.

A gift card is stored value, so check before counting on 3D Secure to move a fraud dispute off your books. Such a dispute has to be answered with evidence, and that evidence comes from your own systems.

What evidence counts in a gift card fraud dispute?

Visa's Core Rules of 18 April 2026 allow two main forms of compelling evidence for reason code 10.4. That code covers a cardholder who says they did not make a card-not-present purchase. Visa calls the first form Compelling Evidence 3.0, or CE 3.0:

• a pair of earlier transactions on the same card, processed more than 120 days and no more than 365 days before the dispute and never reported as fraud, matching on at least 2 data elements, one of them the IP address or device ID;
• 3 or more matching data elements from an undisputed transaction.

A gift card order from an account with a purchase history, placed from a familiar device, can meet this standard. A first order from a new account for a large denomination, sent to an email address typed once, meets neither test. The delivery and redemption record then becomes the most important item in the file.

What should the redemption log show?

It should show the code, the time it was emailed, the address it went to, and the first use. A physical sweater leaves a carrier scan that says little about who took it. A digital gift card can leave a far better record, as long as you build it into the order.

If the code was redeemed from the buyer's own account and IP address, the log is strong evidence and should lead the response. If it was spent within minutes of delivery on a different device from the buyer's, that is no proof of the cardholder's involvement. Say so to the issuer instead of overstating it.

What if the customer says the gift card never arrived?

The log answers that directly, since a record of first redemption is a record of receipt. A cardholder can file under Visa's merchandise-not-received code within 120 days of the processing date or of the last date delivery was expected, up to 540 days after processing.

Where the code was never redeemed, show that it went to the address the buyer supplied. The guide to digital goods access logs describes how to keep that trail.

Separately from disputes, Regulation E sets limits on the card itself. Federal gift card rules in Regulation E generally require funds to last at least 5 years from issue or last load, and allow inactivity fees only after 1 year without activity. A card can be sold with an expiry date only if the buyer can get one with 5 or more years left. A customer who finds a balance cut by an early or undisclosed fee has a complaint worth taking seriously, so read your card program terms against those limits.

Takeaway: what to do this week

1. Log three records per gift card order. Keep the code, the delivery email with its timestamp, and the first-redemption entry.
2. Keep them for 540 days. That is how far a Visa non-delivery claim can reach from the processing date.
3. Capture device ID and IP address at checkout. These data elements let a repeat buyer's order meet the CE 3.0 test.
4. Check your terms against Regulation E. Confirm no inactivity fee applies before 1 year and that funds last at least 5 years.

Sources: CFPB, Regulation E, 12 CFR 1005.20; Stripe Docs, "3D Secure authentication flow"; Visa, Visa Core Rules (edition 18 April 2026), Table 11-28, Table 11-6 and Table 11-92. All checked 24 October 2026.