%201.svg)
VBV Meaning, Visa Secure & 3D Secure Guide 2026
Chargebacks?
No longer your problem.
Recover 4x more chargebacks and prevent up to 90% of incoming ones, powered by AI and a global network of 20,000 merchants.
600+ reviews
TL;DR:
- VBV means Verified by Visa, the earlier name for Visa Secure, which uses 3-D Secure authentication before payment authorization.
- Non-VBV describes a payment without a completed authentication result; it does not by itself mean the payment is fraudulent.
- Authentication and authorization are separate events, so a VBV label alone does not prove a fraud liability shift.
- Keep the 3DS result (frictionless, challenged, failed, or unavailable) with each payment record.
- Authentication does not cover friendly fraud or service-related chargebacks.
VBV means Verified by Visa, the earlier name for Visa Secure. Visa Secure uses 3-D Secure authentication to help an issuer verify a cardholder before payment authorization. According to Visa, authentication and payment authorization are different events, so a VBV label on a payment does not by itself prove the payment was authorized or that fraud liability moved to the issuer.
The name "VBV" is still widely used by merchants, processors, and checkout pages, and the newer 3D Secure 2 (3DS2) version of the protocol is risk-based. This guide explains the VBV meaning, how Visa Secure and 3D Secure relate, what non-VBV means, and which authentication results a merchant should keep. For background on what is a chargeback, plus the disputes authentication can't prevent, see our guides on chargeback fraud and Visa Compelling Evidence 3.0.
What Is Verified by Visa (VBV)?
What is VBV? Verified by Visa is an anti-fraud tool that helps verify whether the rightful cardholder is making a purchase. The identity check uses 3D Secure technology. "Three-Domain Secure" refers to three parties in the flow: the merchant's bank (acquirer), the card issuer, and the payment network (Visa).
When a merchant sends additional transaction data such as shipping location and device type, the issuer's risk engine can use it to assess the cardholder. Depending on the result, the payment can proceed without a visible step, or the bank can ask for an extra verification step. A "VBV credit card" or "VBV card" is simply a card whose issuer supports Visa Secure authentication, not a separate card product.
Is Verified by Visa the Same as Visa Secure?
Yes, for naming purposes. Visa Secure is the current name for Verified by Visa, and it is the Visa program that uses the 3-D Secure authentication standard. "VBV" persists in everyday merchant and processor language, while "Visa Secure" is the term used in Visa documentation today. The name matching does not mean every payment labeled VBV has the same authentication result, which is why the next section matters.
Read the Authentication Result, Not Just the VBV Label
The useful question is not whether a payment carries a VBV label, but which authentication state the record shows. Fraud liability treatment depends on the actual authentication outcome, the transaction, and the applicable conditions, as described in the Stripe documentation on 3D Secure authentication and liability. It is not guaranteed for every payment, and it should not be carried automatically to every later recurring charge.
| Observed state | Meaning | Merchant record | Remaining limitation |
|---|---|---|---|
| Frictionless authentication | Issuer completed the data-based authentication flow | 3DS result and transaction reference | Absence of a challenge does not mean no authentication |
| Challenge completed | Cardholder completed the requested verification | Challenge result linked to this payment | Does not prove fulfillment or prevent cancellation claims |
| Failed or abandoned | Authentication did not complete successfully | Result or error and subsequent payment state | Do not label the payment authenticated |
| Unavailable or exempted | No completed authentication result under this route | Exemption or unavailable status and authorization result | Do not assume a fraud liability shift |
Illustrative example: a payment has successful 3DS authentication, but the buyer claims a canceled subscription was billed again. Preserve the authentication result, then address cancellation and renewal timing. Authentication alone does not answer that non-fraud complaint. For what to retain and where each record comes from, see chargeback evidence sources.
How Does Verified by Visa Work?
Verified by Visa runs a verification process between checkout and authorization:
- Enrollment: For Verified by Visa enrollment, merchants enable 3D Secure 2 through their payment service provider or processor. Cardholders are generally covered through their issuing bank, and the older 1.0 flow of registering a separate password is not how 3DS2 is designed to work.
- Customer checkout: The shopper enters standard card details, and the merchant's integration sends the data the issuer uses to assess risk.
- Frictionless or step-up: The issuer can approve authentication without a visible step, or request an extra factor such as a one-time passcode, biometric approval, or in-app confirmation.
- Result and authorization: The authentication result is passed on with the payment, and authorization is a separate event. A completed authentication can support liability treatment under the applicable conditions, and a failed one should not be treated as authenticated.
Understanding 3D Secure
Verified by Visa is Visa's branded implementation of 3D Secure, a messaging protocol for authenticating cardholders. The first version relied heavily on password steps and created checkout friction. 3D Secure 2 moved to risk-based authentication, where data and device signals let issuers decide whether a step-up is needed. It also underpins Strong Customer Authentication (SCA) under PSD2 in Europe, and other card networks run their own programs, such as Mastercard Identity Check and American Express SafeKey.
Card-not-present fraud is the reason this matters: online payments have no physical card to inspect, so card networks invest in authentication programs. For a deeper technical walkthrough of the protocol, see our 3D Secure 2 guide.
What Does "3D Secure Eligible" Mean?
A card or transaction is "3D Secure eligible" when the card's BIN (bank identification number) is enrolled in a 3D Secure program and the transaction data can be checked against it. Not every card is eligible: some issuing banks, prepaid cards, or older card ranges may not support 3DS2, so those transactions may skip authentication and rely on other fraud screening. Payment gateways typically flag eligibility during checkout, which also explains why some cards trigger a Visa Secure challenge and others do not.
What Does VBV vs Non-VBV Mean?
A "VBV" transaction is one routed through 3D Secure authentication, where the issuer takes part in verifying the cardholder. A "non-VBV" transaction did not complete that authentication. The non-VBV meaning (and the non-VBV card meaning) is therefore about the authentication state of a payment, not a verdict on the cardholder. The difference between VBV and non-VBV matters to merchants because, without a completed authentication result, you should not assume a fraud liability shift.
A non-VBV label also does not establish that a payment is fraudulent. The meaning of informal labels such as "auto VBV" or "pending VBV" varies by who uses them, and they are not Visa program terms, so rely on the authentication result your processor returns for the payment.
| Aspect | VBV / Visa Secure (3DS-Authenticated) | Non-VBV (Not Authenticated) |
|---|---|---|
| Fraud liability | May shift to the card issuer when authentication succeeds and the applicable conditions are met | No authentication-based shift should be assumed |
| Checkout experience | Frictionless or a step-up challenge, depending on the issuer's assessment | No extra authentication step |
| Data shared with issuer | Contextual data from the merchant's 3DS request (such as device and shipping details) | Standard transaction data only |
| What to keep | 3DS result, transaction reference, and authorization result | Exemption or unavailable status and authorization result |
| Chargeback exposure | Relevant to unauthorized-fraud disputes only | Exposed to fraud disputes; other dispute types are unaffected either way |
Checks such as the address verification service (AVS) and CVV are context, not conclusive identity proof or a universal liability shift. See the Stripe documentation on AVS and CVC verification. Retain permitted verification outcomes rather than the raw CVC.
Pros of Verified by Visa
Verified by Visa's core benefit is an extra layer of fraud prevention, with several additional advantages:
- Possible liability shift: On authenticated transactions that meet the applicable conditions, responsibility for fraud-based disputes can move from the merchant to the issuer.
- Fewer unauthorized-fraud disputes: Authentication adds an issuer-side check before authorization.
- Compliance support: 3D Secure 2 is commonly used to meet SCA and similar mandates in many markets.
- Low-friction paths: Risk-based flows let issuers skip the visible challenge when they consider it unnecessary.
- Better risk assessment: Richer shared data can help issuers assess the payment.
Cons of Verified by Visa
Visa Secure aims for safer transactions, but there are drawbacks to weigh:
- Possible cart abandonment: A step-up challenge adds friction, and checkout glitches or abandoned challenges can cost completed orders.
- Exposure to scams: Fraudsters can create fake verification pop-ups, so phishing remains a risk.
- Limited scope: Visa Secure does nothing for friendly fraud or service-related chargebacks, and a missing or failed result needs its own review.
Does VBV Stop Chargebacks?
No. VBV can reduce exposure but does not eliminate chargebacks. Authentication addresses unauthorized-fraud disputes, and only where the authentication outcome and conditions support liability treatment. It offers no protection against friendly fraud (customers disputing legitimate purchases) or service-related disputes like "item not as described" or "credit not processed." Visa Secure should be one layer of a broader strategy, paired with chargeback alerts that surface disputes authentication can't stop.
Frequently Asked Questions
Is VBV the same as Visa Secure?
VBV is the earlier Verified by Visa name. Visa Secure is the current Visa program using the 3-D Secure authentication standard.
What is the difference between VBV and non-VBV cards?
A VBV transaction is authenticated through 3D Secure, so the issuer takes part in verifying the cardholder. A non-VBV transaction did not complete that authentication, so the merchant should not assume a fraud liability shift and should check the actual result.
Does non-VBV mean a payment is fraudulent?
No. A missing VBV label does not establish fraud. Review the actual authentication result, exemption or unavailable state, authorization, and order context.
Is VBV mandatory for merchants?
Not universally. In Europe, PSD2 Strong Customer Authentication requires strong authentication on many online card payments, and 3D Secure is commonly used to meet it. In other markets it is generally optional.
Does Verified by Visa stop all chargebacks?
No. It addresses unauthorized-fraud disputes where the authentication outcome and conditions support liability treatment, but it does not stop friendly fraud or service-related disputes, which still need their own evidence.
What does "3D Secure eligible" mean?
It means the card's BIN is enrolled in a 3D Secure program, so the transaction can be checked against the issuer's risk engine. Cards or transactions that are not eligible may skip authentication and rely on other fraud screening.
How do merchants enable Verified by Visa?
Through your payment gateway or processor's 3D Secure 2 integration. Many gateways support Visa Secure natively, so enabling it is often a configuration step rather than a separate enrollment.
Conclusion: Review the Transaction Record
Verified by Visa, now Visa Secure, is a useful layer of fraud defense, but the label is not the evidence. For each disputed payment, check the authentication state, the authorization result, and the order context before deciding what protection applies. Pair authentication with a broader ecommerce fraud prevention strategy for the disputes it does not cover.
Chargeflow automates evidence gathering and chargeback responses for those disputes. See Chargeflow automation.
Chargebacks?
No longer your problem.
Recover 4x more chargebacks and prevent up to 90% of incoming ones, powered by AI and a global network of 20,000 merchants.
.png)
