How the security level indicator works
After 3-D Secure, the merchant's gateway holds the result of the authentication and, where one was produced, a cryptographic authentication value. The gateway places that value in the authorisation request and sets the indicator to match the result.
In Mastercard's Transaction Processing Rules of 9 June 2026, the field is DE 48, subelement 42, subfield 1, named Electronic Commerce Security Level Indicator and UCAF Collection Indicator, and its value has three positions. The UCAF, in subelement 43, is the field that carries the authentication value. The codes themselves are set out in Mastercard's message specifications.
Why the security level indicator matters
The issuer reads the indicator when deciding whether to approve, and the indicator is part of the record of who bears a fraud loss. A payment that claims full authentication with no valid authentication value behind it is likely to be declined, and a wrong indicator can cost the merchant the liability shift.
Gateways derive the indicator from the 3-D Secure result automatically. The same field appears on payments made with wallet tokens, where the wallet's cryptogram takes the place of a 3-D Secure value.
SLI, ECI or authentication value?
- Electronic commerce indicator (ECI)
- The result code that a 3-D Secure authentication returns, and the field Visa payments carry into authorisation and clearing. On Mastercard, the gateway translates the result into the SLI.
- Authentication value
- The cryptographic proof of the authentication, called the AAV by Mastercard and the CAVV by Visa. The indicator describes the outcome, and the value proves it.
Where the security level indicator shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Mastercard Transaction Processing Rules, 9 June 2026: 5.1.2 and Appendix C, Transaction Identification Requirements (Mastercard)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: 5.8.4.4 (Visa)
General information, not legal advice: what applies to you depends on your services and your market.