What Is the Electronic Commerce Indicator (ECI)?

The Electronic Commerce Indicator (ECI) is the grade on a 3-D Secure check. After the issuer looks at an online card payment, it returns a two-digit code that says "authenticated," "attempted" or "not authenticated." The merchant forwards that code with the payment, and card network rules use it to decide who pays if the payment turns out to be fraud.

What is the ECI?

The ECI comes out of 3-D Secure. The issuer's Access Control Server (ACS) puts it in its authentication response, next to the cryptogram: the CAVV on Visa, the AAV on Mastercard. Mastercard requires the ECI in every authentication response, whatever the result (Y, A, N, R or U).2Mastercard Identity Check Program Guide, November 19, 2019

The merchant's processor then copies the ECI into the authorization request, and the acquirer carries it into the clearing record. Visa's rules use two names behind the codes: a Secure Electronic Commerce Transaction is one "authenticated using an Authentication Method" (ECI 5), and a Non-Authenticated Security Transaction uses encryption but no authentication.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Most networks follow Visa's numbering (05, 06, 07). Mastercard uses its own, and some of its numbers overlap with Visa's but mean something else.

ECI values for Visa and Mastercard

Sources: Visa Core Rules, April 2026, sections 5.8.4.4 and 11.7.5.3;1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 Mastercard Identity Check Program Guide, November 19, 2019, Appendix L, p. 180.2Mastercard Identity Check Program Guide, November 19, 2019 Mastercard's guide tells issuers to check its Chargeback Guide for current liability rules, so confirm with your acquirer.

On Mastercard, a transaction status R (rejected) also returns ECI 00, and the guide says authorization should not be attempted.2Mastercard Identity Check Program Guide, November 19, 2019 The full liability rules for Visa sit on the CAVV and liability shift pages.

Inside Tagada

See every payment's route, processor by processor

Set the order your processors are tried in, per store, per country or per product.

See how routing works

Where merchants see the ECI

You rarely type an ECI. Your 3DS provider returns it and your processor shows it:

• Stripe. On the charge, payment_method_details.card.three_d_secure.electronic_commerce_indicator. When you import results from another 3DS provider, the same field on the PaymentIntent is required on all networks except Cartes Bancaires. Stripe's enum lists 05, 06, 01, 02 and 07, with 06 as "Acquirer SCA exemption" on Mastercard and 07 as "Fully authenticated recurring transaction."3Stripe API reference, Create a PaymentIntent (three_d_secure)4Stripe Docs, Import 3D Secure results
• Adyen. In threeDS2Result.eci after authentication, sent as mpiData.eci in the /payments request when 3-D Secure ran elsewhere.5Adyen Docs, Standalone 3D Secure authentication

If the cardholder later reports this $64 order as fraud, the 10.4 dispute is invalid under Visa's rules because the authorization carried ECI 5 and a CAVV.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 The same order with ECI 07 would leave the loss with the merchant. In Stripe's own example of an imported low-risk exemption, the ECI is 07:4Stripe Docs, Import 3D Secure results an exemption skips the challenge but does not bring the 3-D Secure liability shift.

Visa rules that use the ECI

• No ECI 5 or 6 without a CAVV. An acquirer may put ECI 5 or 6 in the clearing record only if the authorization included the CAVV (section 5.8.4.4).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• No changes on retries. After a decline, a merchant must not manipulate data from the original request when retrying, and the ECI is on Visa's list (section 1.7.2.1).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• Some MCCs get no protection. For US domestic e-commerce under MCCs 4829, 5967, 6051, 6540, 7801, 7802 and 7995, the 10.4 fraud dispute applies "regardless of the Electronic Commerce Indicator value" (section 11.7.5.2).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• ECI 7 with a CAVV still has a use. For disputes processed from October 24, 2026, Visa Secure payments with ECI 7 and a valid CAVV (Visa data only) can use the purchase order number in Compelling Evidence (section 11.7.5.3).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026
• Regional rules. In India, issuers must only authorize domestic e-commerce with ECI 5 (section 10.15.2.8). In Europe, Delegated Authentication participants use ECI 05 or 07, and the acquirer accepts liability on ECI 07 (section 7.9.3.3).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

For the full 3-D Secure flow and SCA exemptions, see our guide to payment authentication. For dispute strategy, see chargeback prevention.