Update on Visa's CVV2 requirement in Europe

In our October playbook we advised that Visa intended to phase out the requirement to supply a CVV2 when making a payment authenticated using Visa Secure (EMV 3DS) in Europe in April.

For Ireland and the United Kingdom, Visa has postponed this change until August 12, meaning you’ll still need to supply a CVV2 for the time being.

After August 12, you'll no longer need to provide the Card Verification Value 2 (CVV2) when authorizing transactions authenticated using Visa Secure (EMV 3DS) in Europe.

Additionally, issuers will not be allowed to decline a Visa Secure transaction in Europe based solely on a missing CVV2 value.

‍How will this benefit you?

• Issuers will no longer be able to decline a transaction based on the CVV2 value - currently, if the CVV2 is incorrect, the issuer will most likely decline the transaction. A customer could go through full SCA checks, but the issue may still decline the transaction due to user input error when entering the CVV2. 
  ‍
• ‍Issuers must not decline a transaction missing a CVV2 - issuers must remove any real-time decline strategies for Visa Secure transactions in Europe based solely on a missing CVV2 by August 12, 2024. It will be your choice to submit this value for these transactions. 
  ‍
• ‍Visa Secure transactions will be exempt from CVV2 card not present requirements - acquirers can optionally provide the CVV2 in the authorization for Visa Secure transactions in Europe on a risk basis.

What do you need to do? 

You may want to make the CVV2 field optional or remove it completely if your customer is paying with a Visa card. Please also review and make any amendments to any fraud detection or risk settings that you have in place by this date. 

If you have any questions or need further support, please email us at [email protected] or reach out to your dedicated Account Manager.

‍

‍