How Mastercard Identity Check works
The merchant's 3-D Secure server sends data about the payment and the buyer's device, through Mastercard's directory server, to the issuer's access control server. Mastercard describes two outcomes: a frictionless experience, or a challenge in which the cardholder confirms, for example with a one-time passcode sent by SMS.
The issuer's answer includes an authentication value, which the merchant places in the authorisation request as proof that authentication took place.
What Mastercard's rules require in Europe
In the Europe Region, the Mastercard Rules of 2 June 2026 have issuers support the EMV 3DS specifications and Mastercard Identity Check. The Transaction Processing Rules of 9 June 2026 have acquirers ensure that their online merchants support authentication with EMV 3DS and comply with the Identity Check programme, including display of the Identity Check brand (5.6.1).
The same rule has acquirers and their service providers implement EMV 3DS 2.2 in full. A merchant that supports version 2.1 keeps supporting it, for issuers that have not moved to 2.2.
Identity Check and SecureCode
SecureCode is the older name under which Mastercard offered 3-D Secure authentication. Mastercard's current rules use Identity Check: the summary of changes in the Transaction Processing Rules of 9 June 2026 records the removal of a reference to SecureCode.
Mastercard Identity Check, Visa Secure or 3-D Secure?
- Visa Secure
- Visa's programme on the same EMV 3-D Secure protocol. A merchant's 3-D Secure server handles both, and the card's network decides which programme applies.
- 3-D Secure
- The protocol, specified by EMVCo. Identity Check is Mastercard's programme and brand for using the protocol on its cards.
- Strong customer authentication
- The legal requirement in the EU and the UK. Identity Check is a means by which an issuer carries it out for an online card payment.
Where Mastercard Identity Check shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Mastercard Transaction Processing Rules, 9 June 2026: Europe Region, 5.6.1 (Mastercard)
- Mastercard Rules, 2 June 2026: Europe Region, authentication requirements, and Rule 7.1 (Mastercard)
- Mastercard Developers, Identity Check
General information, not legal advice: what applies to you depends on your services and your market.