A 3DS liability shift can protect a merchant from a fraud loss and still leave the payment counting against its VAMP ratio.
Visa counts the fraud report too, and the liability shift only reaches the dispute.
The published formula adds fraud reports (TC40) to disputes (TC15) and divides by settled card-not-present VisaNet transactions. Since 1 April the threshold for an excessive merchant in the EU has been 150 basis points, down from 220, with at least 1,500 of the two in a month.
The liability shift reaches the dispute. Under Visa's rules a fraud dispute under condition 10.4 is invalid when the issuer confirmed a Visa Secure EMV 3DS authentication and the authorisation carried ECI 5 and the CAVV. The issuer cannot raise that fraud dispute, so the loss stays with the issuer.
The liability shift does not reach the fraud report. Visa requires the issuer to report fraud activity whatever the transaction's status, approved, declined or not settled, and nothing in that rule asks who carried the loss. Visa's public fact sheet lists two exclusions from the ratio: disputes resolved through pre-dispute solutions, and fraud reports that qualify for Compelling Evidence 3.0, both subject to the timing of Visa's data extract. A liability shift is not one of them.
In the EU, PSD2 Article 73 separately requires the cardholder's bank to refund an unauthorised payment immediately, and at the latest by the end of the business day after it notes or is told of it, subject to exceptions. Nothing in Visa's reporting rule turns on that refund.
None of this says 3DS cannot help with VAMP. Authentication can stop a fraudulent payment going through at all, which is a different outcome from moving its loss once it has. So one fraudulent payment writes three ledgers: who pays, whether a fraud dispute is raised, and whether fraud is reported. The liability shift moves the first and blocks the second. VAMP counts the third.
If you turned on 3DS to manage VAMP: when the monthly numbers came back, did your fraud reports fall, or only your fraud disputes?
This post is from Out of band, the shorter arguments I make on LinkedIn between essays, kept here with their sources. For the long form, read the essays.