MasterCard SecureCode authenticates that the person checking out online is the authorized cardholder, and in exchange offers merchants liability protection on the fraudulent chargebacks it covers.
How it works
The flow runs in five stages: checkout, an enrollment check, a pop-up authentication prompt if the card is enrolled, issuer validation of the password, PIN, or device authentication, and finally the result passed back to the merchant.
What implementation requires
- eCommerce only — MOTO transactions need to be handled separately
- Merchant, consumer, issuer, and acquiring bank all have to participate
- It doesn't replace other fraud checks, it complements them
- You'll need to pass ECI marking, AVS results, enrollment status, CAVV/AVV codes, and an XID transaction number
- A digital certificate from MasterCard, which typically takes about two weeks to obtain
What's actually covered
In the U.S. (as of October 2011), liability shifts for both successful authentications and attempted authentications where the consumer wasn't enrolled. Outside the U.S., only successful authentications get the shift. Coverage applies specifically to chargeback reason codes 4837 (No Cardholder Authorization) and 4863 (Cardholder Does Not Recognize/Potential Fraud) — nothing else.
Excluded categories are the same as other 3-D Secure programs: procurement cards, recurring billing, split shipments, and higher-risk verticals like adult content and gaming.