Visa’s Digital Commerce Authentication Program (DCAP) is an optional program from Visa intended to reduce fraud and improve transaction performance.
To participate, you’ll need to use Visa authentication solutions to share customer data with issuers.
What are the benefits?
Using DCAP in combination with Network Tokens, you can unlock significant net incentives for Visa Consumer Credit purchases in the United States.
- DCAP only: 0.05% net incentive for each qualifying transaction (0.10%, minus a 0.05% scheme fee)
- DCAP and Network Tokens: 0.10% net incentive for each qualifying transaction (0.05% net for DCAP, plus 0.05% for Network Tokens)
Note that DCAP savings apply to qualifying Customer Initiated Transactions (CITs) only. Merchant-Initiated, stored-credential, Mail Order Telephone Order (MOTO), Account Funding, and Installment transactions are out of scope of both the DCAP scheme fee and incentive.
What data fields does Visa require for DCAP?
To qualify for the data sharing element of the DCAP, you will need to provide the data elements outlined below. We also recommend enabling network tokens to benefit from the full -0.10% interchange reduction.
The API fields you’ll need to send will depend on your 3D Secure integration. You should ensure the data you provide is complete and avoid using dummy fields or invalid data.
For the Integrated 3D Secure integration
- risk.device.network.ipv4 (device IP address)
- customer.email (customer email address)
- source.billing_address (customer billing address - include all billing address fields)
- 3ds.exemption set as "data_share"
You’ll also need to send the customer’s device ID using one of the following options:
- risk.device_session_id through our Risk.js SDK
- risk.device.provider.id using data you collect via your own risk solution
- Our Flow integration, which collects the device ID automatically as part of the payment process
For our Standalone (Hosted and Non-Hosted) 3D Secure integrations
- channel_data.ip_address (device IP address)
- source.email (customer email address)
- source.billing_address (customer billing address - include all billing address fields)
- challenge_indicator set as "data_share"
You’ll also need to send the customer’s device ID using one of the following options. We'll set these fields live in our API reference in the coming weeks.
- device_information.device_session_id through our Risk.js SDK - optional for the Hosted integration
- device_information.device_id using data you collect via your own risk solution - optional for the Hosted integration
Frequently Asked Questions
Can I qualify for DCAP if I authenticate with FPAN and authorize with DPAN?
No. This will cause the CAVV associated with the token to fail qualification at the authorization stage. There must be 1:1 mapping between the PAN used across authentication and authorization for a transaction to qualify for DCAP.
Do I need to be opted in to DCAP?
No. If you provide the data elements above, you’ll benefit from DCAP savings automatically for qualified transactions.
Will non-issued credit cards qualify for the DCAP incentive for US acquirers?
No. The DCAP incentive is strictly for US-issued cards.
Will Google Pay and Apple Pay transactions qualify for DCAP incentives?
No. Wallet-based transactions do not qualify for DCAP incentives?
Does Visa allow retrying the cryptogram for DCAP transactions across multiple PSPs?
Yes. The cryptogram is tied to the transaction rather than the 3D Secure server so Visa will still give the incentive. However, Visa does not recommend sharing cryptograms across PSPs if the initial attempt fails.
Will my customers have to authenticate through 3D Secure for their transactions to qualify for DCAP?
No. DCAP uses Visa’s data only flow. This a frictionless 3D Secure flow and customers don’t need to go through authentication.
Could the data only flow add latency to my transactions?
Yes. Data only will add an API call to Visa’s risk engine. If you notice an impact on performance, please let us know.
Do DCAP qualified transactions benefit from liability shift?
No. Because the data only flow does not authenticate the transaction, there’s no liability shift benefit.
Will issuers decline transactions sent through the data only flow if data elements are invalid or missing?
No. However, poor data quality can lead to transactions not qualifying for DCAP and can contribute to an issuer decline.
Will Visa launch DCAP in other countries?
Visa will also launch DCAP in Canada in October 2026. We’ll share details of the Canada incentive when we have more information from Visa.