How Visa Secure works
Visa Secure is 3-D Secure as applied to Visa cards: the protocol comes from EMVCo, and Visa's programme adds the rules that issuers, acquirers and merchants follow. At checkout, the merchant's 3-D Secure software sends details of the payment to the issuer through Visa's directory server. The issuer accepts the payment on a risk assessment or challenges the cardholder, and returns an authentication value, the CAVV, which goes into the authorisation request.
What the Visa rules say about Visa Secure
The Visa Core Rules of 18 April 2026 define Visa Secure as a Visa-approved authentication method based on the 3-D Secure specification. An acquirer notifies its e-commerce merchants that Visa Secure is available and provides it on request, and in the Europe Region processes secure e-commerce transactions using Visa Secure (5.8.4.3).
An acquirer uses electronic commerce indicator 5 or 6 in the clearing record only if the authorisation request included the CAVV (5.8.4.4). The effect on fraud disputes, the liability shift, is set out under 3-D Secure.
Why Visa Secure matters
PSD2 requires strong customer authentication when a payer initiates an electronic payment (Article 97), and Visa Secure is the usual way an online Visa card payment meets that in the EU. A gateway or PSP supports it through a 3-D Secure server connected to Visa's directory server. Merchants see the outcome as an ECI and a CAVV on each payment.
Visa Secure, 3-D Secure or Verified by Visa?
- 3-D Secure
- The protocol, specified by EMVCo and shared by the card schemes. Visa Secure is one scheme's programme that uses it.
- Mastercard Identity Check
- Mastercard's equivalent programme, with its own rules and its own authentication value.
- Verified by Visa
- The programme's earlier name. The name has been retired, and the service continues as Visa Secure.
Where Visa Secure shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: 5.8.4.3, 5.8.4.4 and the glossary, Visa Secure (Visa)
- Visa Developer, Visa Secure using EMV 3DS: UX guidelines
- Visa, Online shopping secured with Visa (UK)
- Directive (EU) 2015/2366, PSD2, Article 97 (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.