Credit Card Processing Blog

Verified by Visa (VbV) is a card authentication service for Visa credit and debit cards. Visa developed VbV as an additional security layer to help protect merchants that accept cards over the internet. Based on the 3-D Secure protocol, VbV benefits participating e-commerce merchants in the following ways:

• Reduces merchant liability for fraud resulting from accepting unauthorized Visa cards.
• Minimizes chargebacks. Merchants who use VbV are protected from fraud-related chargebacks on all personal Visa cards – credit or debit – whether or not the issuer or cardholder is participating in VbV, with limited exceptions.
• Provides a safer place for consumers to shop.
• In many cases using VbV lowers participating merchants’ Visa credit card processing costs. Depending on the structure of your pricing agreement, you could qualify for lower discount fee on internet transactions that use VbV. To take advantage, you should require that your pricing is based on the interchange-plus model.

Merchants offering VbV to their customers must install a software module called a Merchant Plug-In (MPI), on their hosting server. The plug-in is easily installed and is compatible with all major eCommerce systems.

To use Verified by Visa, cardholders must first activate their cards. The activation can be done in one of several ways:

• Card issuers usually provide an online activation site and have integrated Verified by Visa activation in the card issuer’s online banking site. Cardholders should have an easy access to the activation site or they can ask the card issuer for assistance.
• Visa, card issuers, and participating merchants may display “Activation Anytime” banners or buttons that enable cardholders to activate their Visa card by clicking on the banner or button and following the prompts.
• Cardholders may also register with VbV during shopping, on the merchant’s website.

Once VbV is activated, a Visa credit or debit card is automatically recognized when used for purchases at participating eCommerce websites. The verification process goes through the following stages:

1. When ready to finalize a purchase, a Visa cardholder clicks “Complete Order” or an equivalent option at the checkout. Software previously installed on the merchant website’s server recognizes a VbV eligible Visa card account and initiates the next steps of the process.
2. At this time a Verified by Visa page appears in a new browser showing the merchant website’s URL. If the cardholder has previously activated the card with Verified by Visa, he or she will be asked to enter the password that they created during the activation process. There is an option for retrieving forgotten passwords as well. If the cardholder has not previously activated the card, he or she may be asked to do so now. If the card issuer does not participate in Verified by Visa, no cardholder interaction takes place. However, the merchant still qualifies for certain fraud liability protection. The merchant receives an “Attempted Authentication” response with authentication data to be submitted with the authorization request as proof of qualification for chargeback protection for the transaction.
3. The card issuer verifies its cardholder’s identity for cards that have been activated and sends a response to the merchant with the authentication result. If the authentication fails, the merchant should request an alternative payment method.
4. When the Verified by Visa verification process is complete, the merchant includes the authentication data received from the card issuer with the transaction authorization request.

Merchants participating in VbV get additional chargeback protection:

• If the cardholder is successfully authenticated, the merchant is protected from fraud-related chargebacks, and can proceed with authorization using Electronic Commerce Indicator (ECI) of “5.”
• If the card issuer or cardholder is not participating in Verified by Visa, the merchant is protected from fraud-related chargebacks, and can proceed with authorization using ECI of “6.”
• If the card issuer is unable to authenticate, the merchant is not protected from fraud-related chargebacks, but can still proceed with authorization using ECI of “7.” This condition occurs if the card type is not supported within VbV or if the cardholder experiences technical problems.

If you decide to implement Verified by Visa into your fraud prevention strategy, contact your payment processing provider and make sure they support the service. Most processors now support it and will be able to help you integrate it into your system.

MasterCard’s equivalent to Verified by Visa is MasterCard SecureCode.