Verified by Visa (VBV) Explained: How Visa Secure and 3D Secure 2 Protect Your Online Payments in 2026

You are five seconds away from clicking “Pay.” Suddenly, a small window pops up asking for a code from your phone or a fingerprint scan. Annoying? Maybe. But that quick check is Verified by Visa doing exactly what it was built to do: make sure the person paying is really you, not someone with your stolen card details.

This guide unpacks what Verified by Visa (VBV) is in plain English, how it grew up into today’s Visa Secure powered by EMV 3-D Secure 2 (3DS2), why it matters for shoppers and store owners, and how to use it without hating the checkout process.

TL;DR — Verified by Visa was rebranded to Visa Secure in 2019. It uses the 3D Secure 2 protocol to verify online Visa payments in real time, mostly invisibly. Around 95% of transactions sail through without any user action, while risky ones trigger a quick biometric or one-time passcode challenge.

---

What Is Verified by Visa (VBV)? A Quick Answer

Verified by Visa is Visa’s anti-fraud program that confirms a shopper’s identity during online card payments. It sits quietly between you, the merchant, and your bank, and it kicks in only when something looks off.

Visa launched VBV in the early 2000s using a static password system called 3D Secure 1.0. That version was clunky. Shoppers hated the extra password step, and merchants watched carts get abandoned.

In 2019, Visa retired the “Verified by Visa” name and rolled out Visa Secure, running on the smarter, mostly frictionless EMV 3-D Secure 2 standard. You will still hear people say “VBV,” “verified by visa,” or “vbv visa” — those terms all point to the same service today.

Fast facts:

• Rebranded from Verified by Visa to Visa Secure in 2019
• Powered by EMV 3-D Secure 2.x (versions 2.1, 2.2, and 2.3)
• Automatically enrolled by your card-issuing bank — no signup required
• Works on desktop, mobile web, in-app, and digital-wallet purchases
• Satisfies Europe’s PSD2 Strong Customer Authentication (SCA) requirements

---

Verified by Visa vs. Visa Secure: Are They Different?

Short answer: no. They are the same product at different life stages. Think of them like an older iPhone and the latest model — same purpose, but the new one is faster, smoother, and safer.

Feature	Verified by Visa (Legacy)	Visa Secure (Today)
Launch era	Early 2000s	2019 rebrand
Protocol	3-D Secure 1.0	EMV 3-D Secure 2.x
User step	Static password every time	Frictionless for ~95% of transactions
Data shared with issuer	~15 fields	150+ fields
Mobile & app support	Weak	Native, deep integration
Auth methods	Password only	OTP, biometrics, passkeys, app approval
Global compliance	Limited	PSD2 SCA and regional mandates

For merchants, the practical business signal is this: Visa reports around a 9% lift in authorization approvals on transactions authenticated through Visa Secure, according to an insight piece published by the Visa corporate site titled “3D Secure: your guide to safer transactions”.

---

How 3D Secure Actually Works, Explained Simply

The name “3-D Secure” refers to the three domains that check every transaction together:

• Acquirer domain — the merchant and their bank
• Issuer domain — the bank that gave the shopper their Visa card
• Interoperability domain — Visa’s network, which passes messages between the two

These three parties trade encrypted data in milliseconds. The issuer scores the risk, then either approves silently or asks the cardholder to verify.

The Frictionless Flow (Most Transactions)

When the risk score is low, the issuer approves the payment quietly. You might notice a brief spinning wheel on the checkout page — that is Visa Secure working behind the scenes, exactly as the Visa Secure consumer page describes it.

The Challenge Flow (High-Risk Transactions)

When something looks unusual — new device, big purchase amount, mismatched shipping address — the issuer triggers a step-up challenge. You will typically prove identity with one of these:

• One-time passcode (OTP) sent by SMS or email
• Biometrics such as fingerprint or Face ID inside the banking app
• Push notification approval (“Tap Yes to confirm this $999 payment”)
• PIN or password entered on the issuer’s secure page
• Passkey stored on your device, using Visa’s newer FIDO-based flow

Pass the challenge, and the payment goes through. Liability for fraud on that transaction moves from the merchant to the issuing bank.

---

The 30-Second Story: What Happens When You Click “Pay”

Here is a real-world example. Sarah is buying a $650 laptop on a Friday night.

1. She enters her card details and clicks Pay.
2. The merchant’s 3DS server bundles device fingerprint, browser info, shipping address, cart contents, and behavioral signals into an authentication request.
3. Visa’s Directory Server hands the request to the ACS (Access Control Server) run by Sarah’s bank.
4. The ACS scores the risk. The amount is high and the device is new, so it triggers a challenge.
5. Sarah’s phone lights up. She opens the banking app and approves the purchase with Face ID.
6. The ACS returns a “successful authentication” response along with an ECI 05 value, which tells the merchant liability has shifted.
7. The transaction settles. Sarah gets her laptop. The merchant is protected against fraud-based chargebacks on this order.

Total added time: about 6 seconds. That is the entire point of 3D Secure 2 — real security without breaking the checkout.

---

Why Verified by Visa Matters More in 2026 Than Ever

Card-not-present fraud is not slowing down. According to fraud-prevention firm Feedzai’s CNP guide, ecommerce-based CNP fraud losses are expected to reach $28.1 billion by 2026. Around 81% of global fraud cases in 2025 fell into the CNP bucket.

Regulation is pushing back. Since Europe made 3DS-based Strong Customer Authentication mandatory under PSD2, the region recorded roughly a 47% drop in fraud pressure. That is a big deal — proof that smart authentication actually moves the needle.

Where you will meet Visa Secure in real life:

• Buying anything from a mid-to-large online retailer
• Booking flights, hotels, and rentals
• Adding a new card to Apple Pay, Google Pay, or Samsung Wallet
• Paying for streaming or SaaS subscriptions
• Sending money through fintech apps

Understanding the fraud side of things also helps if you have ever been on the receiving end of a bad charge. If you want the flip side of this coin — what happens after a fraudulent charge hits your card — read our primer on chargebacks to see how the dispute process works.

---

Benefits of Verified by Visa for Shoppers

For everyday cardholders, Visa Secure runs in the background and only shows up when it needs to. That is the whole design.

• Stronger fraud protection — a stolen card number alone is not enough anymore.
• Real-time alerts — many banks push instant notifications when a Visa Secure challenge triggers.
• No signup or software — your card is enrolled automatically.
• Global reach — it works at any merchant displaying the Visa Secure badge.
• Fast approvals for clean transactions — no friction for low-risk purchases.
• Fewer identity-theft losses — biometrics tie the payment to a physical device.

Good card habits pair well with broader money hygiene. Storing your emergency fund in one of the best savings accounts and checking statements weekly makes it far easier to spot the rare fraud attempt that slips past 3DS.

---

Benefits of Verified by Visa for Merchants

For online sellers, Visa Secure is not just a compliance box to tick. It is a growth tool.

• Chargeback liability shift — fraud-related chargebacks move from merchant to issuer on authenticated transactions.
• Higher approval rates — issuers trust the enriched 3DS2 data and decline fewer good orders.
• Fewer false declines — genuine shoppers stop getting mistaken for fraudsters.
• Lower interchange fees — some markets offer preferred rates for authenticated ecommerce transactions.
• Regulatory compliance — Visa Secure meets PSD2 SCA in Europe, RBI mandates in India, and similar rules elsewhere.
• Consumer trust — the Visa Secure badge signals a serious, safe checkout.

There is one caveat every merchant should know. Visa Secure only shifts liability for fraud disputes. Non-fraud chargebacks — “item not received,” “not as described,” friendly fraud — still land squarely on the merchant, as CardFellow explains clearly in its “Use Verified by Visa” merchant walkthrough.

---

Liability Shift and ECI Codes: The Merchant’s Cheat Sheet

The Electronic Commerce Indicator (ECI) is the small numeric value returned after a 3DS check. It tells the acquirer whether the transaction was fully authenticated, attempted, or failed — and therefore who pays when a fraud dispute lands.

Visa ECI Codes at a Glance

Visa ECI Code	Meaning	Liability Shift?
05	Cardholder authentication successful	Yes — shifts to issuer
06	Authentication attempted, not completed	Usually yes (varies by region)
07	Authentication failed or not performed	No — stays with merchant

Who Pays When Something Goes Wrong

Scenario	3DS Used?	Fraud Loss Falls On
Cardholder approves via OTP or biometrics	Yes (ECI 05)	Issuing bank
Merchant attempted 3DS, issuer did not respond	Attempted (ECI 06)	Issuing bank
Merchant skipped 3DS entirely	No	Merchant
“Item not received” complaint	Any	Merchant (not a fraud dispute)
Friendly fraud / first-party misuse	Any	Merchant, most of the time

Liability shift only covers fraud-coded chargebacks like Visa reason code 10.4. It does not protect you from processing errors, cancellation disputes, or refund complaints.

---

What’s New in EMV 3DS 2.3

EMV 3DS 2.3 is the current-generation specification, and 2026 is when adoption really scales. Card schemes have largely retired 3DS 2.1 worldwide.

• FIDO / passkey support — device-bound passkeys replace SMS OTPs, which blocks SIM-swap attacks.
• Split SDK model — lighter mobile SDKs, easier updates.
• Decoupled authentication — you can approve a purchase minutes later inside your banking app, which suits voice and IoT payments.
• Enhanced recurring & installment data — cleaner rebill approvals.
• Better CIT/MIT signaling — separates cardholder-initiated from merchant-initiated transactions.
• Wider whitelisting — trusted merchants can bypass challenges on repeat purchases.

Visa also officially launched the Visa Payment Passkey Service at the Payments Forum 2024, using FIDO-based, device-bound credentials to replace passwords and SMS codes entirely. Since then, Visa has rolled it out in markets like India and the UAE, and merchants like Noon Payments have integrated it directly. The Visa developer portal describes it as “strong, device-based authentication for online payments”, which is a solid summary of where the industry is heading.

---

How Merchants Enable Visa Secure

Most merchants never touch 3DS code directly. Their payment processor or PSP handles the plumbing. Here is the practical setup path.

• Confirm with your acquirer or PSP — Stripe, Adyen, Braintree, Cybersource, and Checkout.com all ship EMV 3DS 2 out of the box.
• Enable a 3DS server or MPI — a Merchant Plug-In (or its hosted equivalent) sends authentication requests to Visa’s Directory Server.
• Integrate the 3DS2 SDK — required for native mobile apps, so you can capture the device data the ACS needs.
• Choose your authentication rules — always authenticate, only high-risk transactions, or only above a certain amount.
• Use SCA exemptions wisely — low-value payments, trusted beneficiaries, and TRA exemptions can reduce friction.
• Test in sandbox — simulate frictionless flows, challenge flows, failures, and issuer timeouts before going live.
• Monitor weekly — track auth rate, challenge rate, approval rate, and cart abandonment.

Two questions worth asking your processor:

1. Is EMV 3DS 2.x already enabled on my account?
2. Am I being charged extra for it?

Visa itself does not bill merchants directly for the service, but some gateways bundle it into their pricing.

If you handle payments as a solo operator, the same discipline applies. Building a business as an independent freelancer also means learning how to accept cards without eating fraud losses.

---

The Drawbacks You Need to Know

Visa Secure is a big net positive, but it is not perfect. Merchants and shoppers deserve the honest tradeoffs.

• Cart abandonment risk — a small share of shoppers bail when a challenge appears. Smart merchants route only high-risk transactions to the challenge flow.
• Phishing lookalikes — fraudsters build fake “Visa Secure” pop-ups to harvest OTPs.
• Fraud disputes only — VBV does nothing for friendly fraud or service-related complaints.
• Occasional false challenges — new devices, VPNs, or unusual travel can trigger checks even for real shoppers.
• Pop-up blockers and old browsers — sometimes the 3DS challenge page fails to load.
• Data-only 3DS — some low-friction flows share data with issuers but do not grant liability shift.

Understanding these gaps is part of being a smart consumer, whether you are shopping online or navigating scams like the ones tied to a CPN number, which are illegal and frequently confused with legitimate identifiers.

---

How Shoppers Can Use Visa Secure Safely

You do not need to sign up for Verified by Visa. Your bank does that automatically the moment your Visa card is issued. Your job is to make sure the tool actually reaches you and to spot fakes.

• Keep your phone and email up to date with your bank so OTPs arrive.
• Turn on biometric login in the banking app for one-tap approvals.
• Never share an OTP over the phone — legitimate staff will never ask for it.
• Check the URL on any challenge pop-up before entering a code.
• Watch for the Visa Secure badge on unfamiliar stores.
• Enable transaction alerts so you spot every attempt in real time.
• Update your browser to avoid failed 3DS pop-ups.
• Close and report suspicious pop-ups instead of clicking through.

---

Visa Secure vs. Other Card Authentication Programs

Every major card network runs its own version of 3-D Secure. They all share the same EMVCo backbone, so a single 3DS2 integration covers most of them.

Program	Network	Protocol
Visa Secure (formerly Verified by Visa)	Visa	EMV 3DS 2.x
Mastercard Identity Check	Mastercard	EMV 3DS 2.x
American Express SafeKey	Amex	EMV 3DS 2.x
Discover ProtectBuy	Discover	EMV 3DS 2.x
JCB J/Secure	JCB	EMV 3DS 2.x
UnionPay 3D Secure	UnionPay	EMV 3DS 2.x

The user experience feels similar across all of them. The differences sit in each network’s specific rules for exemptions, liability, and dispute reason codes.

---

Verified by Visa in Different Regions

Rules vary by geography, and that matters if you sell internationally.

• European Economic Area & UK — 3DS-based SCA is mandatory under PSD2 for most electronic payments.
• India — RBI requires additional factor authentication on domestic card transactions, typically via 3DS.
• United States — 3DS is optional but strongly recommended, especially for high-ticket goods.
• Australia, Singapore, UAE — increasing adoption, with some issuers mandating 3DS for cross-border transactions.
• Latin America — mixed; Brazil and Mexico are leaning heavily into 3DS2 rollouts.

Even in optional markets, the 3D Secure liability shift makes a strong business case for turning it on.

---

Common Myths About Verified by Visa

Let us clear up a few things people still get wrong.

• “VBV is dead” — No, it was renamed to Visa Secure. The technology is more active than ever.
• “Non-VBV cards exist for private sales” — Every legitimate Visa card is enrolled. Sites offering “non-VBV” cards are almost always fraud.
• “3DS guarantees no chargebacks” — False. It shields you from fraud disputes only.
• “Only Europe uses it” — Wrong. It is a global standard used across dozens of markets.
• “The password is the same as CVV” — No, the CVV is static; VBV uses dynamic, real-time verification.

---

Quick Answers

Is Verified by Visa still active in 2026? Yes. The service continues as Visa Secure, now running on EMV 3-D Secure 2.x.

Does VBV cost the cardholder? No. There is no fee for shoppers, and Visa does not directly charge merchants either.

Is Visa Secure mandatory? In the EEA, UK, India, and several other markets, yes. In the US, it is optional but widely adopted.

Does 3DS work with Apple Pay and Google Pay? Yes. Device biometrics usually satisfy authentication, so extra challenges are rare.

Can I bypass Visa Secure? No legitimate way exists. Any site promising a bypass is a scam.

---

FAQ: Verified by Visa, Visa Secure, and 3D Secure

---

Final Thoughts

Verified by Visa started as a clunky password screen and quietly grew into one of the most important pieces of ecommerce plumbing on the planet. Today’s Visa Secure, powered by EMV 3-D Secure 2 and increasingly by passkeys, protects billions of transactions a year while staying invisible for the vast majority of shoppers.

For consumers, it is free protection that already lives on your card. For merchants, it is a proven way to cut fraud, lift approval rates, and stay ahead of regulation. And with EMV 3DS 2.3, delegated authentication, and Visa Payment Passkey rolling out worldwide, the checkout of 2026 is on track to be both safer and faster than the one you used a year ago.

So the next time you see a Visa Secure prompt during checkout, remember: those six seconds of friction are what stand between your money and someone else’s late-night shopping spree.