Authentication, fraud, and liability

When unauthorized transactions occur using compromised card credentials, card scheme regulations dictate which participant absorbs the financial loss. In digital commerce, that determination hinges on whether the transaction was cryptographically authenticated at the moment of authorization.

Distinguishing fraud screening from cryptographic authentication

Payment conversations frequently treat fraud screening and authentication as interchangeable concepts. In payments architecture, they represent entirely separate functions with distinct legal implications:

• Fraud screening is an internal risk assessment performed by the merchant or a third-party risk engine. It inspects device fingerprints, IP geolocation, behavioral telemetry, order velocity, and historical patterns to generate an empirical risk score. Fraud screening involves no participation from the cardholder's issuing bank and produces zero change in legal liability. If a merchant screens a transaction, approves it, and it later turns out to be fraudulent, the merchant bears full financial liability for the resulting chargeback.
• Authentication is an interactive or cryptographic verification process where the cardholder proves their identity directly to their issuing bank. If the issuing bank validates the cardholder's credentials, legal liability for unauthorized fraud transfers from the merchant to the issuing bank. This statutory transfer of financial responsibility is known as the liability shift.

Merchants deploy both mechanisms in tandem: algorithmic fraud screening eliminates high-risk attacks prior to payment submission, while authentication provides definitive legal shielding against fraud disputes on accepted transactions.

Standard verification attributes in card-not-present processing

Every card-not-present authorization can transmit standardized verification fields:

• The card verification value (CVV / CVC) is the three-digit cryptographic security code printed on the signature strip of Visa and Mastercard cards, or the four-digit code printed on the front of American Express cards. Supplying a valid CVV demonstrates that the purchaser possessed the physical card credential or image. Under PCI DSS regulations, merchants may never store CVV values on disk following authorization completion.
• The address verification service (AVS) compares the numeric digits of the customer's billing address and postal code against the address records maintained by the issuing bank. The issuer returns a standardized match code (e.g. full match, postal code match only, street address match only, or no match). AVS is primarily supported in the United States, United Kingdom, and Canada.

Neither CVV nor AVS produces a liability shift; a transaction with matching CVV and AVS can still be disputed as fraudulent. However, they serve as vital fraud screening signals and provide compelling evidence during dispute representment.

3-D Secure and the mechanics of the liability shift

3-D Secure (branded as Visa Secure, Mastercard Identity Check, and American Express SafeKey) is the global protocol that provides a formal liability shift in card-not-present commerce.

During checkout, the merchant's checkout application communicates with the card network and issuing bank's Access Control Server (ACS). If the authentication completes successfully, the issuer returns an electronic commerce indicator (ECI) and an authentication value (such as a CAVV or AAV). When the transaction is subsequently authorized with these values, the issuer becomes legally barred from initiating chargebacks under fraud reason codes (such as Visa Reason Code 10.4 or Mastercard 4837).

Modern 3-D Secure 2 optimizes user experience through risk-based authentication:

• Frictionless flow: The merchant transmits extensive device telemetry and transaction context to the issuer. If the issuer's risk algorithms rate the transaction as low-risk, authentication executes silently in the background without user intervention. The merchant receives full liability protection without displaying a challenge prompt.
• Challenge flow: If the transaction exhibits elevated risk or falls under statutory mandates, the cardholder is presented with an interactive authentication challenge—such as confirming biometric verification or entering an out-of-band one-time passcode (OTP) within their mobile banking application.

The liability shift applies exclusively to fraud-related dispute categories. If a consumer initiates a dispute alleging that physical merchandise was never delivered, arrived damaged, or was returned without a refund, 3-D Secure provides no protection.

Strong Customer Authentication (SCA) mandates

In the European Economic Area (EEA) and the United Kingdom, authentication is an enforced legal mandate. Under the Second Payment Services Directive (PSD2), payment service providers must execute Strong Customer Authentication (SCA) on all consumer-initiated electronic transactions unless specific exemptions apply.

SCA mandates two-factor authentication incorporating at least two of three independent categories:

1. Knowledge: Something only the user knows (password, PIN).
2. Possession: Something only the user possesses (mobile banking device, hardware token).
3. Inherence: Something the user is (fingerprint, facial recognition).

3-D Secure 2 serves as the primary technical mechanism to comply with SCA for card payments. Issuers in SCA jurisdictions enforce compliance by issuing soft declines on unauthenticated transactions, prompting the checkout engine to restart the payment flow with an active 3-D Secure challenge.

First-party misuse ("friendly fraud")

A substantial proportion of fraud chargebacks do not involve compromised credentials. First-party misuse (colloquially termed "friendly fraud") occurs when a legitimate cardholder authorizes a transaction, receives the purchased goods or services, and subsequently disputes the charge with their bank claiming the transaction was unrecognized or fraudulent.

First-party misuse ranges from accidental oversight (such as an unremembered recurring subscription or a family member using a shared account) to intentional deception.

Deploying 3-D Secure serves as a primary operational barrier against friendly fraud, because the issuing bank's own authentication logs document that the cardholder actively verified the payment. Furthermore, maintaining clear statement descriptors, sending instant digital order receipts, and providing automated cancellation workflows significantly reduce friendly fraud dispute volume.

Mitigating card-testing attacks

Because e-commerce checkouts operate publicly, malicious actors use automated scripts to test batches of stolen payment credentials across unsuspecting merchant checkout forms—an attack vector known as card testing.

Card testing inflicts severe financial damage on merchants:

• Transaction processing fees accumulate on every attempt, regardless of whether authorizations approve or decline.
• Card networks assess excessive decline surcharges and misuse fees on testing bursts.
• Elevated decline rates degrade the merchant's risk reputation with acquiring banks, potentially triggering funding holds.

Card testing mitigation controls

Implement progressive defense-in-depth controls across digital checkout workflows.

1. Implement strict rate-limiting policies governing payment submissions by IP subnet, session identifier, and device fingerprint.
2. Trigger invisible CAPTCHAs or interactive challenges upon detecting abnormal authorization velocity bursts.
3. Require complete CVV verification and AVS address data on all card-not-present payment submissions.
4. Establish automated operational alarms that fire when authorization decline ratios deviate significantly from historical baselines.
5. Issue immediate authorization reversals for any approved transactions identified as originating from automated testing attacks.

Terms introduced

• Liability shift: the transfer of fraud loss from the merchant to the issuer when a transaction was authenticated.
• Fraud screening: the merchant's own assessment of whether a transaction is genuine. It shifts no liability.
• Card verification value: the three- or four-digit code on the card, sent at authorization and never stored. Often shortened to CVV.
• Address verification service: the issuer's comparison of the typed billing address against the one it holds, returning a match code. Often shortened to AVS.
• Strong customer authentication: the PSD2 requirement in the EEA and UK for two-factor authentication on most customer-initiated electronic payments. Often shortened to SCA.
• First-party misuse: a cardholder disputing a purchase they made. Also called friendly fraud.
• Card testing: attackers validating stolen card numbers by running small transactions through a merchant's checkout.