3-D Secure lets a business’s checkout and the customer’s card issuer exchange data about the payment, the card and the device being used, so the issuer can decide whether the payer is genuine. EMVCo, the card industry body that manages the specification, describes it as a way to prevent fraud on card-not-present payments. EMVCo says the three domains are the merchant side, the issuer side and the payment systems between. Visa’s programme based on it is called Visa Secure, formerly Verified by Visa.

How it works

• Frictionless flow. The issuer assesses the risk in real time and approves the payment without involving the customer.

• Challenge flow. If the issuer sees a higher risk or needs the cardholder to confirm, it asks for more, such as a one-time passcode or biometrics.

• EMV 3-D Secure supports Strong Customer Authentication and lets merchants tell issuers when an exemption may apply.

Why it matters for travel businesses

• Fraud disputes. Under Visa’s rules, a card issuer cannot use the card-absent fraud dispute reason against an online payment it authenticated through Visa Secure with EMV 3-D Secure, where the authentication value was included in the authorisation. The protection applies to that fraud reason only. A dispute that services were not provided falls under a different reason, so a chargeback is still possible.

• Travel data. EMVCo publishes a travel industry message extension so sellers can pass ticket, itinerary and traveller details to card issuers for their risk checks.

• Availability. Visa’s rules require acquirers to tell their online merchants that Visa Secure is available and to provide it on request.

Worth knowing

The original version, 3-D Secure 1.0.2, gave way to EMV 3-D Secure, first published in October 2016. The current version, 2.3.1.1, replaced 2.3.1.0 in May 2023. EMVCo published a first draft of version 2.4 for comment in June 2026.