How the electronic commerce indicator works
When 3-D Secure finishes, the merchant receives the indicator with an authentication value, a cryptographic proof of the result. The gateway passes both to the acquirer, which places them in the authorisation request.
The Visa Core Rules of 18 April 2026 define the indicator as a value used in an electronic commerce transaction to indicate the transaction's level of authentication and security. The values are specific to each scheme.
Visa's ECI values
As the Visa Core Rules of 18 April 2026 use them:
- ECI 5: a secure electronic commerce transaction, authenticated by the issuer through Visa Secure
- ECI 6: an attempt, where the issuer, or Visa on its behalf, answered the authentication request with an attempt response
- ECI 7: an online payment with no 3-D Secure authentication behind it
Why the ECI matters
Under the same rules, an acquirer uses ECI 5 or 6 in the clearing record only if the authorisation request included the authentication value, the CAVV. An issuer's fraud dispute is invalid on an ECI 5 payment that was authenticated with EMV 3-D Secure and carried that value.
A gateway therefore passes the indicator and the value through unchanged, and stores them as dispute evidence. Mastercard uses its own values, and carries the result in authorisation as the security level indicator.
ECI, authentication value or security level indicator?
- Authentication value
- The cryptographic proof that 3-D Secure took place: CAVV at Visa, AAV at Mastercard. The ECI states the outcome, and the value proves it.
- Security level indicator
- Mastercard's field in the authorisation message for the level of security of an e-commerce payment.
Where the electronic commerce indicator shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.