What is the 3DS liability shift?
When the issuer authenticates a transaction through 3-D Secure, frictionless or challenged, liability for fraud chargebacks such as Visa 10.4 or Mastercard 4837 moves from the merchant to the issuer. It does not cover non-fraud disputes, and it does not apply when the merchant requested an exemption instead of authenticating.
In detail
When the issuer authenticates a transaction through 3-D Secure, frictionless or challenged, liability for fraud chargebacks such as Visa 10.4 or Mastercard 4837 moves from the merchant to the issuer. It does not cover non-fraud disputes, and it does not apply when the merchant requested an exemption instead of authenticating.
Who carries the fraud: the liability shift
When the issuer authenticates, fraud liability moves from the merchant to the issuer: Visa reason code 10.4 and Mastercard 4837 fraud disputes are no longer chargeable to the merchant. A frictionless result counts as much as a completed challenge. When the merchant requests an exemption, no authentication takes place and the fraud liability stays with the merchant. The shift covers fraud only: a “goods not received” chargeback is still the merchant’s problem, authenticated or not.
Evidence for disputes and audits
ECI, cryptogram, 3DS version, exemption flag and the issuer’s response must be stored on the transaction and exported with it. They decide whether a fraud chargeback is representable, and regulators can ask for the quarterly fraud-rate calculation behind each TRA exemption.
More detail in our #PayDecoding episode on 3-D Secure.