What Is Non VBV

What non-VBV means

A non-VBV card range is one whose issuer does not enforce 3D Secure during authorisation. VBV stands for Verified by Visa, and Mastercard SecureCode is the equivalent, so the phrase covers both networks. Where a VBV range is enrolled, a card-not-present transaction triggers a challenge. Where a range is not, the transaction is authorised on the usual card data alone.

• VBV and Mastercard SecureCode are the consumer authentication programmes
• Enrolled ranges challenge card-not-present transactions
• Non-enrolled ranges do not, so authorisation is simpler
• The status belongs to the issuer's configuration, not to the card brand

How enrolment works

When a card is issued, the issuer decides whether to enrol it in the authentication programme. The decision is made at the portfolio level rather than card by card, which is why a whole range tends to share the same behaviour. An enrolled card will, for a card-not-present transaction, generate a challenge that the cardholder completes in their banking app and that returns a signed result to the issuer.

Why issuers differ

The decision is commercial as much as technical. An issuer that has invested in strong fraud controls and strong customer authentication may not enrol a range that is rarely used online. An issuer with a high fraud rate in one market may enrol, because the friction is worth the lost transactions. And an issuer may change its mind: a range can be non-VBV this year and VBV next year.

• Fraud rates in the portfolio drive the decision
• Enrolment costs conversions, so it is priced
• Regulation moves it in one direction and fraud moves it in the other
• A range's status can change without the cards being reissued

How to identify a non-VBV range

The status is a property of the issuer's configuration rather than something encoded in the number, which is why no tool can derive it from the digits alone. It has to be recorded from observation, and it has to be dated, because it decays.

• It is not derivable from the BIN: the BIN identifies the issuer, not its configuration
• It has to be recorded from observed transaction behaviour
• The date of the observation is part of the fact
• A range that is non-VBV today may be enrolled tomorrow

What it means in practice

For a card-not-present transaction, a non-enrolled range is simpler and more frictionless, which is exactly why it attracts attention. It is also why a merchant should never treat a successful transaction as evidence that a range is safe: the absence of a challenge says something about the issuer's configuration, not about the data.

• Simpler authorisation, fewer dropped transactions
• A non-enrolled range attracts attention in card-not-present fraud
• The standard dispute rules still apply, and a stolen card can still be disputed
• Never read a successful authorisation as a signal about the range