Reason code · Visa

Visa reason code 10.3: keyed-in card fraud at the counter

Visa 10.3 is a fraud dispute over an in-person sale where the card number was typed in rather than read by the terminal. The cardholder says they didn’t make it. The bank has 120 days to file.

Key takeaways

  • Keyed in, in person. 10.3 covers sales where the card was supposedly there but the number was typed.
  • 120 days. That’s how long the cardholder’s bank has to file.
  • An imprint is the classic answer. Visa’s rules give a card imprint real weight here.

What Visa 10.3 means

Visa calls this “Other Fraud – Card-Present Environment.” The rule is short: the cardholder denies authorizing or taking part in a key-entered transaction made in a card-present setting. The sale was recorded as in person, but nobody dipped, tapped or swiped the card.

This is common at front desks that type card numbers into a virtual terminal while the customer stands there. It’s fast. It also leaves you with the fraud risk of a phone order and none of the protection of a chip read.

What the customer told their bank

“I didn’t make this purchase” or “I don’t recognize this charge.” The bank must report the fraud to Visa before it files. Sometimes it’s real fraud. Sometimes the customer forgot the visit, or a family member used the card.

The time limit

The cardholder’s bank has 120 calendar days from the date the transaction was processed.

Your own deadline is shorter. Fraud and authorization codes have no separate “dispute response” step in Visa’s rules. Your bank (the acquirer) answers with a pre-arbitration attempt, and it has 30 calendar days from the dispute to do it. Your processor keeps part of that time, so the due date on your notice is the one that counts.

What kind of proof matters

Proof the physical card was there. Visa’s rules make a 10.3 invalid when the transaction carries an electronic imprint, and they accept evidence of an imprint at the next stage. Careful: a pencil rubbing or photocopy of the card doesn’t count as an imprint. For US sales keyed in where there was no chip reader, Visa also accepts proof that the same card was used in another undisputed purchase, or a copy of the cardholder’s ID tied to the receipt.

One common mistake

Keying in a card that’s sitting right there on the counter because the reader is in another room or the line is long. Every one of those sales is a 10.3 waiting to happen. Put a chip reader where the card is.

Dispute Daddy reads your notice, lines up the reason the customer gave against your own records, and builds the response. You review it, approve it and submit it. See how the Dispute Daddy Method works.

Questions

What’s the difference between Visa 10.3 and 10.4?

10.3 is fraud on an in-person sale where the card number was typed in. 10.4 is fraud on a card-absent sale, such as an online, phone or mail order.

How long does the bank have to file a 10.3?

120 calendar days from the date the transaction was processed.

Does a signed receipt win a 10.3?

Not on its own. Visa’s rules focus on whether the card was physically present, such as an imprint, and for some US sales on other undisputed use of the same card or ID tied to the receipt.

What does Stripe call a Visa 10.3?

Stripe groups Visa 10.3 under its “fraudulent” dispute reason.

Sources

  1. Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition, section 11.7.4 (Dispute Condition 10.3): dispute reasons, invalid disputes and time limit; Table 11-6 for compelling-evidence scope; read October 25, 2026.
  2. Stripe: Dispute reason code categories, Stripe places Visa 10.3 in its “Fraudulent” category (dispute reason value fraudulent); read October 25, 2026.

General information, not legal advice. Network and processor rules change; the due date on your own dispute notice always governs.

You earned it.
Defend it.

Dispute Daddy builds the case and keeps the deadline in view. A flat $99 a month.

About this site

This site uses examples made for illustration. They are not real customer records.

Early-access signup stores your email and, if provided, company name for your request. We count page visits with Cloudflare Web Analytics, which uses no cookies and doesn’t identify you. No advertising trackers are used. Read the Privacy Policy.