Description and basic aspects

The basic concept of the protocol is to tie the financial authorization process with an online authentication. This
authentication is based on a three-domain model (hence the 3-D in the name). The three domains are:

Acquirer Domain (the merchant and the bank to which money is being paid).

Issuer Domain (the bank which issued the card being used).

Interoperability Domain (the infrastructure provided by the card scheme, credit, debit, prepaid or other type
of finance card, to support the 3-D Secure protocol). Interoperability Domain includes the Internet, MPI,
ACS and other software providers

The protocol uses XML messages sent over SSL connections with client authentication[citation needed] (this ensures
the authenticity of both peers, the server and the client, using digital certificates).
A transaction using Verified-by-Visa or SecureCode will initiate a redirection to the website of the card issuing
bank to authorize the transaction. Each issuer could use any kind of authentication method (the protocol does
not cover this) but typically, a password-based method is used, so to effectively buy on the Internet means
using a password tied to the card. The Verified-by-Visa protocol recommends the bank's verification page to
load in an inline frame session. In this way, the bank's systems can be held responsible for most security
breaches. Today, with the ease of sending white-listed text messages from registered bank senders, it is easy
to send a one-time password as part of an SMS text message to users' mobile phones and emails for
authentication, at least during enrollment and for forgotten passwords.
The main difference between Visa and MasterCard implementations lies in the method to generate the UCAF
(Universal Cardholder Authentication Field): MasterCard uses AAV (Accountholder Authentication Value) and
Visa uses CAVV (Cardholder Authentication Verification Value).

Implementations
The specifications are currently at version 1.0.2. Previous versions 0.7 (only used by Visa USA) and
1.0.1 have become redundant and are no longer supported. MasterCard and JCB have adopted version 1.0.2
of the protocol only.
In order for a Visa or MasterCard member bank to use the service, the bank has to operate compliant software
that supports the latest protocol specifications. Once compliant software is installed, the member bank will
perform product integration testing with the payment system server before it rolls out the system.