Understanding Verified by Visa (VBV) and the 3D Secure Initiative

Consumers enjoy online shopping. Without a doubt, we all want the convenience and speed of E-commerce. But that digital opportunity also attracts savvy fraudsters. E-commerce fraud losses are only increasing—up to $41 billion globally in 2022 and are expected to reach $48 billion in 2023. As online payment usage grows, so does the risk of fraud.

To better protect cardholders and online merchants, Visa introduced Verified by Visa. Also known as Visa Secure, the security feature includes an extra verification layer for all online transactions. With better cardholder authentication, Visa can help limit the rising fraud threat. 

But what type of protection does it offer you, the merchant? Let's explore Verified by Visa and how 3D Secure works.  

What Is Verified by Visa?

Verified by Visa is an anti-fraud tool that verifies if the rightful cardholder is making a purchase. The identity check uses a technology called 3D Secure. "Three-Domain Secure" means three separate parties confirm the authenticity of a transaction (the merchant bank, the card issuer, and the payment network). 

When enrolled in Visa Secure, you (the merchant) share ten times more transaction data with Visa. Example info includes merchandise sold, shipping location, device type, etc. Visa then uses advanced tools to assess that data and determine the cardholder's identity. 

If verified, the transaction proceeds. And on certain rare occasions, Visa will also ask for extra customer verification. Because of these extra safety measures, all transactions become far more secure. 

How Does Verified by Visa Work?

Verified by Visa works with a step-by-step verification process: 

• Enrollment: First, you and the customer must enroll in the Verified by Visa program. For consumers, registration involves a simple initial authentication (which is often conducted by the card-issuing bank). Merchants must also enroll and use various technologies to participate in Verified by Visa. Enrollment ensures that Verified by Visa is enabled with the correct security and checkout best practices. 
• Customer checkout: Second, your customer will input the standard credit card info to make a purchase. Once the purchase order is confirmed, Verified by Visa will automatically analyze extra context data. The assessment occurs in real-time, behind the scenes. Your customer will have no concept of the extra security action. Nor will they experience added checkout friction. If Visa discovers no issues, they will approve the transaction.  
• Secondary authentication: Third, Visa may demand additional verification. This second layer of verification occurs if suspicious activity is flagged. Any out-of-the-ordinary behavior (e.g. orders from foreign locations, unusual products, high-value items, or bulk transactions) may trigger an alert. Visa Secure will then redirect the cardholder to a popup window. The secondary page is encrypted and will ask your customer for authentication information. The customer must present an extra security factor like a PIN, a one-time passcode, or biometric approval.  
• Confirmation: If Visa verifies the secondary security check, you the merchant can complete the transaction with confidence. If authentication fails, the transaction will be placed on hold to help prevent fraud. 

Pros of Verified by Visa:

Verified by Visa offers the clear benefit of robust fraud prevention. Simply put, enhanced security decreases costly payment fraud losses. But Verified by Visa also includes some additional advantages: 

• Liability shift: If you use the program and Visa makes a mistake during its analysis (on qualified transactions), all responsibility shifts to Visa. In those cases, you get to save your resources and let Visa handle the problem.    
• Reduced chargebacks: Liability shift also means you are not responsible for the possible chargeback, some fees, or payment fraud losses. 
• Easy compliance: Verified by Visa and 3D Secure 2.0 are now the global standard in security. You can satisfy compliance requirements in numerous markets with ease. 
• Frictionless consumer protection: Verified by Visa occurs in real-time. It usually requires no extra actions from the consumer. A smooth payment journey combined with a second layer of security boosts consumer confidence. 
• Better risk assessments: A wealth of shared data helps you better identify fraud (and leads to fewer false positives).
• Interchange discounts: Visa will reduce interchange fees on qualified transactions.   

Cons of Verified by Visa:

By and large, Verified by Visa achieves its goals of improving transaction security. But there are some drawbacks to consider as well:

• Possible cart abandonment: Some consumers will find the extra verification step a hassle. Additional security can also cause glitches with your checkout. And some transactions may slow, as no technology operates without the occasional issue. Customers may find these delays too much of a nuisance and abandon their purchase. 
• Exposure to scams: Fraudsters are crafty and may create their own fake Verified By Visa pop-ups. The risk of phishing attacks always exists—like any defense method, the Visa Secure program presents a new attack zone. 
• Lack of standardization: Not all merchants or customers enroll with Verified by Visa. Plus, each card issuer has its own program with 3D Secure.. The lack of uniformity can introduce confusion and lead to an inconsistent consumer experience. 
• Lack of buy-in: New security practices inconvenience consumers. For example, the program does force consumers to own a device that can receive PIN codes. It also means customers must remember yet another password. Enrollment itself requires time and effort (especially for merchants who deal with extensive documentation). Many consumers resist these types of annoyances and will avoid the program. In turn, such a lack of acceptance limits the effectiveness of Visa Secure. 

Understanding 3D Secure:

As stated, Verified by Visa is a branded program of 3D Secure, a messaging protocol. Visa first used the technology in 1999, then known as 3D Secure 1.0. The first version of 3D Secure only included the secondary verification step for users. 

While useful, the forced verification introduced far too much user friction. Plus, the industry developed new security options as online/mobile payments became normal. As a result, 3D Secure evolved towards what is now known as risk-based authentication. The change occurred for two main reasons. First, data and device security factors (EMV chips, biometrics) can enhance the security protocol. Second, on the consumer end, all analysis is invisible, making the entire process user-friendly.

Today, 3D Secure 2.0 is the global standard (it fits the Strong Customer Authentication regulation of the European Revised Directive on Payment Services). As a result, all primary card issuers have adopted the technology with their own programs: MasterCard SecureCode, American Express SafeKey, etc. 

Conclusion:

Verified by Visa is an important protection mechanism. It safeguards the transaction process. For that reason, you can consider it a useful security support. 

But Visa Secure, while improved with 3D Secure 2.0, does introduce new risks and checkout friction. Plus, it is only a preventative tool—it offers no help in fighting false disputes related to numerous other chargeback reasons. Verified by Visa is but one part of a comprehensive fraud and chargeback strategy. For true protection, you also need custom chargeback and fraud solutions that fully defend all aspects of your business.

Want more information on how you can create complete fraud and chargeback defenses? Contact Chargeflow to explore our automated chargeback tools.   

‍