The protocol for secure online credit card transactions is 3-D Secure.
3-D Secure adds an authentication layer to card-not-present payments, linking the merchant and acquiring bank, the card issuer, and the payment network’s interoperability infrastructure. The “3-D” refers to these three domains, not to three-dimensional graphics or three separate passwords.
Visa first commercialized the system as Verified by Visa, while Mastercard used the SecureCode brand. Other networks created related versions, including J/Secure from JCB, ProtectBuy from Discover, and American Express SafeKey. These brand names can make the underlying protocol seem like several unrelated technologies.
The original version often redirected shoppers to an issuer page for a password or one-time code. EMVCo later developed EMV 3-D Secure, with version 2 published in 2016. Modern implementations can use risk-based, often “frictionless,” authentication and challenge customers only when a transaction appears risky. TLS or SSL may protect the connection, but they are transport-security technologies, not the card-authentication protocol itself.