3-D Secure Liability Shift: The Disputes It Doesn't Cover

Turn on 3-D Secure and the chargebacks stop. That is roughly how the liability shift gets sold to online merchants, and it is half right. When a Visa or Mastercard transaction is authenticated through 3-D Secure, the issuing bank generally cannot charge it back to you as fraud. But fraud is only one family of chargebacks. Customers who say the order never arrived, that it was not as described, or that they cancelled a subscription can still dispute, and for many high-risk merchants those claims make up much of the dispute volume.

This guide explains what the liability shift actually covers under the card network rules, the merchant categories Visa excludes from it, what it does not do for your Visa Acquirer Monitoring Program (VAMP) ratio, and how to decide where to use it. The Visa material comes from the Visa Core Rules and Visa Product and Service Rules dated 18 April 2026, and the Mastercard material from the Mastercard Chargeback Guide, Merchant Edition, dated 19 May 2026.

What 3-D Secure is

3-D Secure, or 3DS, is the protocol that lets the card issuer check that the person paying online is the cardholder before the payment is authorized. Each network brands its own version: Visa Secure (formerly Verified by Visa) and Mastercard Identity Check (formerly SecureCode). The current version, EMV 3DS, sends the issuer information about the device and the order. The issuer can approve the shopper silently, which is called a frictionless flow, or challenge them with a one-time passcode or a banking-app approval.

The result travels with the authorization. On Visa, a successful authentication produces a cryptogram called the Cardholder Authentication Verification Value (CAVV) and an Electronic Commerce Indicator (ECI) of 5. When the issuer or the cardholder is not participating in Visa Secure, the issuer or Visa can return what Visa calls an attempt response, and the transaction carries ECI 6. A transaction with no authentication carries ECI 7. Those values are what the dispute rules look at, which is why a 3DS integration that drops them in the authorization request gets none of the protection described below. Our guide to what non-VBV means covers how card enrollment in Visa Secure works.

What the liability shift covers on Visa

Visa's fraud dispute for online and phone orders is dispute condition 10.4, Other Fraud – Card-Absent Environment. It applies when the cardholder denies authorizing or taking part in the transaction. Visa's rules list the transactions on which a 10.4 dispute is invalid, and two of them are the liability shift:

• A transaction processed with ECI 5, where the issuer responded to the authentication request with an authentication confirmation using Visa Secure with EMV 3DS, and the CAVV was included in the authorization request.
• A transaction processed using EMV 3DS with ECI 6, where the issuer, or Visa on the issuer's behalf, responded with an attempt response and a CAVV, and the CAVV was included in the authorization request. This does not apply to non-reloadable prepaid cards.

Two details matter here. First, the protection turns on the issuer's response and the CAVV, not on whether the shopper saw a challenge screen, so a frictionless approval counts. Second, the attempt case means you can be protected even when the issuer or cardholder is not enrolled in Visa Secure, provided the attempt response and CAVV came back and were sent with the authorization. The exception is a non-reloadable prepaid card, where an attempt does not shift liability.

The Visa merchant categories the shift does not protect

This is the part most 3DS sales pitches leave out, and it falls squarely on high-risk businesses. For US domestic transactions, Visa's rules say a 10.4 fraud dispute applies regardless of the ECI value when the merchant is classified under any of these merchant category codes (MCCs):

• 4829, wire transfer and money orders
• 5967, adult content and services
• 6051, non-financial institutions selling foreign currency, cryptocurrency, money orders, travelers cheques and debt repayment
• 6540, stored value card purchase and load
• 7801, government-licensed online casinos
• 7802, government-licensed horse and dog racing
• 7995, betting, including lottery tickets, casino gaming chips and off-track betting

Visa also requires US acquirers to tell merchants in these categories that their authenticated transactions are not eligible for protection from 10.4 disputes. If your account is coded under one of these MCCs, authenticated fraud disputes still land on you. 3DS can still be worth running for these merchants, because an issuer that authenticates the shopper is less likely to approve a stolen card in the first place, but the liability shift itself does not apply.

What the liability shift covers on Mastercard

Mastercard's equivalent fraud chargeback is message reason code 4837, No Cardholder Authorization. The Chargeback Guide lists among the transactions ineligible for it any transaction properly authenticated in authorization with a Security Level Indicator (SLI) of 211, 212, 217 or 242, naming Identity Check and Digital Secure Remote Payment as examples. In Mastercard's coding, 212 is a fully authenticated Identity Check transaction and 211 carries an attempt, so as on Visa an attempt can protect you.

Mastercard extends the protection beyond the first charge. The same rule covers any subsequent transaction related to the original authenticated one, such as a partial shipment or a recurring payment. For a merchant-initiated transaction that relates to a prior authenticated cardholder-initiated transaction (SLI 212 or 242), the Chargeback Guide says the issuer should not use 4837 and should consider a different reason code, such as a cardholder dispute of a recurring transaction. The issuer can still use 4837 if neither it nor the cardholder can link the charge to the authenticated one after reasonable effort, and the acquirer can answer with evidence of that link. That is a reason to authenticate the first payment of a subscription and to keep the record of it.

What 3-D Secure does not cover

The liability shift moves fraud liability. It does nothing for the disputes where the cardholder admits making the purchase but says something went wrong with it. On Visa, those sit under different dispute conditions, and the fraud exclusions above do not apply to them:

• 13.1, merchandise or services not received
• 13.2, cancelled recurring transaction
• 13.3, not as described or defective merchandise
• 13.5, misrepresentation
• 13.6 and 13.7, credit not processed and cancelled merchandise or services
• The processing error disputes in group 12, such as duplicate processing or an incorrect amount

For a subscription business, a supplement seller or a coaching program, those are often the bulk of the dispute volume. A customer who forgot to cancel files 13.2 whether or not the first charge was authenticated. A customer unhappy with results files 13.3. Fixing those means clear descriptors, cancellation flows, refund policies and delivery evidence, not authentication. Our guide to Visa chargeback reason codes covers the evidence that answers each one.

The shift also does not stop the cardholder's bank from contacting you, and it does not make an authenticated sale immune to every claim. A shopper who authenticated and then says the goods never came is making a 13.1 claim, and you answer it with delivery proof like any other.

Authenticated fraud still counts toward your VAMP ratio

Since June 2025, Visa's Acquirer Monitoring Program measures card-not-present merchants with one ratio: the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled transactions (TC05). Visa's VAMP fact sheet lists two exclusions: disputes resolved through pre-dispute solutions, and TC40 fraud reports that qualify for Compelling Evidence 3.0. Authenticated transactions are not on that list.

Visa's rules require an issuer to report the fraud to Visa before it can file a 10.4 dispute, and that fraud report is a separate record from the dispute. So when a stolen card gets through 3DS and the issuer cannot charge it back, the TC40 can still be counted against you. The liability shift protects the money on that transaction, not your monitoring ratio. Where 3DS helps the ratio is upstream: an issuer that challenges a suspicious shopper declines more stolen cards before they ever settle, so fewer fraud reports are filed at all.

This matters because the thresholds have tightened. Visa's fact sheet puts the excessive merchant threshold at a VAMP ratio of 150 basis points, or 1.5%, in the US, Canada, the EU and Asia-Pacific from 1 April 2026, with a minimum of 1,500 fraud and dispute counts a month. Our VAMP guide covers how the program is enforced.

The trade-off: approvals and checkout friction

3DS is not free. A challenge adds a step, and some shoppers abandon the checkout rather than complete it. The case for running it depends on what is costing you money:

• If fraud disputes under 10.4 or 4837 are a large share of your chargebacks, and your MCC is not on Visa's excluded list, authenticating card-not-present orders is likely to pay for itself.
• If most of your disputes are not-received, not-as-described or cancelled-recurring claims, 3DS will not change them. Spend the effort on the causes of those disputes first.
• If you sell subscriptions, authenticating the first payment protects the Mastercard recurring series that follows and gives you evidence of who signed up.
• If you are in an excluded Visa MCC, run 3DS for its effect on fraud approvals and issuer trust, not for dispute protection, and price your risk accordingly.

Many gateways let you apply 3DS selectively, for example to first-time customers, high-value orders or orders a fraud tool flags. Check with your gateway which rules it supports and whether it passes the ECI, CAVV and other authentication data through to the authorization exactly as received, since that is what the protection depends on.

A checklist before you rely on the liability shift

1. Confirm your MCC with your processor and check it against Visa's excluded list.
2. Check that your gateway sends the CAVV and ECI from Visa Secure, and the SLI and authentication value from Identity Check, in every authorization request.
3. Pull a sample of recent authenticated transactions and confirm they cleared with ECI 5 or 6 on Visa and SLI 211 or 212 on Mastercard.
4. Break your disputes down by reason code. For online orders, the liability shift reaches only the card-absent fraud codes: 10.4 on Visa and 4837 on Mastercard.
5. Keep authentication records with your order data so you can prove the link between a recurring charge and the authenticated first payment.
6. Track your TC40 fraud reports alongside your chargebacks. Authenticated fraud still counts toward VAMP.
7. Run the numbers on checkout drop-off after you turn it on, and adjust which orders you send to a challenge.

3-D Secure is one of the few tools that moves fraud losses off a merchant's books entirely, and for most card-not-present businesses it is worth having. It is not a chargeback program on its own. PayKings places high-risk merchants with acquiring banks and gateways that support 3DS, and can help you work out whether your category is protected and which of your disputes it will actually stop.