How the XID worked
In the first version of 3-D Secure, the merchant's plug-in software generated the XID when it asked the issuer to authenticate a cardholder. The issuer's access control server returned the same value with its answer. The merchant then passed it to the acquirer with the authentication value, so that the authorisation could be matched to the authentication.
What replaced the XID
EMV 3-D Secure, specified by EMVCo, does not use the name. Each party to an authentication, the merchant's 3DS server, the scheme's directory server and the issuer's access control server, assigns a transaction ID of its own, and the directory server's ID is the one usually passed into authorisation.
The Visa Core Rules of 18 April 2026 list only EMV 3-D Secure documents in their definition of the 3-D Secure specification.
Where XID still appears
The field survives in the APIs of many gateways and acquirers, as an optional parameter next to the ECI and the authentication value. Integrations built for the first version often still send or expect it, and some providers reuse the field to carry the directory server's transaction ID. The mapping between a 3-D Secure server and an acquirer's API states which identifier each field holds.
XID, DS transaction ID or CAVV?
- DS transaction ID
- The identifier a scheme's directory server gives an EMV 3-D Secure authentication. It took over the XID's job.
- CAVV or AAV
- The cryptographic value that proves an authentication took place. The XID only labelled the attempt.
- ECI
- The code for the outcome of the authentication, not an identifier of it.
Where the XID shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- EMVCo, EMV 3-D Secure, with the specification bulletins
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, 3-D Secure Specification (Visa)
General information, not legal advice: what applies to you depends on your services and your market.