Visa Secure for Merchants: What the Check Does

An order comes in to your web shop at midnight. You never see a face. You never see a card. All you have is a name and sixteen digits someone typed. Visa Secure is the answer Visa gives to that blind spot. This page reads Visa's own words about it, the way a shop owner would before switching it on.

What Visa says it is

Visa Secure is Visa's global EMV 3-D Secure program, and it helps prevent card-not-present fraud.

So it is a program run by the card brand. It is not a box you buy from a store. Visa worked with other payment brands to build EMV 3-D Secure, the next generation of the protocol.

Here is the plain version. 3-D Secure adds a check of the buyer's identity before an online purchase is authorized.

Picture two knocks on the same door. The first knock asks if the card can pay. The second asks if the hand on the card is the right hand. Visa draws that line in one sentence. Authentication confirms who the cardholder is, while authorization decides if the payment can go ahead.

How the second knock works

Your shop does not do the checking. It only asks for it. The merchant starts the authentication request, and the issuer uses an access control server to check the cardholder.

To get that far, a shop has to be hooked up. To add this kind of authentication, a merchant connects to a program such as Visa Secure, which sends transaction data to the issuer.

3-D Secure shares data between the merchant, the card issuer and sometimes the buyer to confirm the real account owner is paying.

Look at the word "sometimes" in that line. Visa says low risk purchases are authenticated in the background, with no extra steps for the customer. Most of your midnight buyers may never know a knock took place. A few will be asked to show who they are before the sale clears.

What it does when a fraud claim lands

This is the part a shop owner reading about chargebacks came for.

Visa puts it this way. Successful authentication lowers fraud risk and can shift liability away from the merchant. Visa Secure helps shift liability for transactions that were authenticated or where authentication was attempted.

Visa's dispute guidelines say it as a promise with a string on it. Merchants that use Visa Secure are protected from certain fraud disputes, as long as the sale is processed correctly.

Two small words carry that sentence. "Certain" means not every one. "Correctly" means your side of the sale still has to be done right.

When a fraud claim does arrive, Visa says what to do first. For a card absent fraud dispute, tell your card processor if the sale was authenticated with Visa Secure. So keep the record of each check with the order it belongs to. A record you cannot find the week a claim arrives does you no good.

Where you sell matters too. Visa's guidelines say liability shift rules for Visa Secure transactions may vary by region and merchants should check with their acquirer.

What it does not promise

Visa never says the check stops every bad sale. Its words are "helps" and "can" instead. Authenticating buyers at checkout can help merchants reduce chargebacks caused by fraud.

Read the last two words of that line again. A buyer who says the box never came is not making a fraud claim. Neither is one who wants money back for a lamp that showed up cracked. The second knock only asks who is at the door. On the cardholder side, the same who question comes up when a strange charge lands on a shared card. It has nothing to say about what was in the box.

Visa also does not ask you to lean on it alone. For online and phone sales, use tools like Visa Secure, CVV2 and the Address Verification Service to help reduce fraud.

Checking who hooks it up for you

Plenty of shops never touch Visa Secure by hand. A payment company or a fraud tool sets it up for them. Visa keeps its own list of who may do that. The Visa Secure Services site lists approved 3-D Secure vendors and the documents for becoming compliant.

So if a company tells you it will "handle 3DS" for your shop, you have one easy test. Look for its name on Visa's list. That list belongs to Visa, so it is the one to trust over any sales page.

The shop it was built for

Visa Secure is made for the shop that cannot see the card. Visa's guidelines say Visa Secure helps reduce eCommerce fraud by helping ensure the transaction is started by the rightful Visa account owner.

A stall at a farmers market has the buyer standing right there, card in hand. A web shop selling to strangers at midnight has none of that. That second shop is the one Visa had in mind.

Go back to that midnight order one last time. With Visa Secure on, the buyer either passed a quiet check or was asked to prove who they were. Either way, your shop now holds a record of the knock. If a fraud claim on that order shows up later, that record is the first thing Visa tells you to raise with your card processor.