Visa Launches VDCAP: The Authentication Standard Reshaping Online Payments

Paying Merchants to Share Better Data

On April 18, 2026, Visa activated its Digital Commerce Authentication Program (VDCAP) across the United States and Canada, introducing a fee structure that flips the traditional payment cost model: instead of only penalizing fraud, Visa now pays merchants who prove their transactions are legitimate.

The mechanics are straightforward. Merchants who pass four specific data elements with each card-not-present transaction — Device ID, IP Address, Customer Email, and Billing Address — qualify for a 0.05% incentive on consumer credit purchases. Merchants who also use Visa Network Tokens can stack that to 0.10%. On high-volume ecommerce, these basis points compound into material savings.

Visa’s own data makes the case for why this matters. Analysis from Checkout.com confirms that simply ensuring the IP Address field is populated drives an average acceptance rate increase of 0.35%, while including a validated customer email adds another 0.26%. Better data does not just reduce fraud — it recovers revenue that merchants currently lose to false declines.

The program launched alongside a broader April 2026 rule change that introduced separate Consumer Credit Fee Programs for token-based DCAP transactions and non-token DCAP transactions. For payment processors, acquirers, and merchants already investing in tokenization infrastructure, VDCAP creates a direct financial return on that investment.

The Bigger Picture: Authentication for an Agentic Future

VDCAP is not arriving in isolation. It lands at a moment when both Visa and Mastercard are rebuilding their payment rails to accommodate a fundamentally new type of customer: AI agents that shop autonomously on behalf of humans.

Visa launched its Intelligent Commerce initiative in late 2025, predicting that millions of consumers will use AI agents to complete purchases by the 2026 holiday season. The company introduced the Trusted Agent Protocol, an open framework built on existing web infrastructure that helps merchants distinguish between malicious bots and legitimate AI agents. Over 30 partners are actively building within Visa’s sandbox, and hundreds of controlled agent-initiated transactions have already been completed in live production environments.

Mastercard is moving on a parallel track. Its Agent Pay system, launched with Citi and US Bank as early issuers, enables AI agents to shop online with full authentication. In March 2026, Mastercard and Google co-developed Verifiable Intent, an open-source cryptographic framework that creates tamper-resistant records of what a user authorized when an AI agent acts on their behalf. The specification links three elements into a single immutable record: the consumer’s identity, their original instructions, and the transaction outcome.

Both frameworks rely on Cloudflare’s Web Bot Auth technology, developed with Microsoft, Shopify, Checkout.com, Worldpay, and Adyen. Built on the IETF RFC 9421 standard, Web Bot Auth provides cryptographic verification of agent identity — a prerequisite for any payment network to trust an AI-initiated transaction.

McKinsey projects that AI agents could orchestrate up to $1 trillion in US-based transactions alone within five years. VDCAP’s data-sharing requirements — Device ID, IP, email, billing address — are the exact signals an authentication system needs to verify that an AI agent is acting within its authorized scope.

Stablecoins Enter the Payment Stack

The authentication question extends beyond traditional card rails. Stablecoins are emerging as a parallel payment infrastructure, and the major networks are positioning themselves to bridge both worlds.

PayPal expanded its PYUSD stablecoin to 70 markets in March 2026, enabling cross-border payments with near-instant settlement and lower fees. Nium launched a stablecoin card platform on March 30, 2026, allowing businesses to issue Visa and Mastercard cards funded by PYUSD. Mastercard joined the Paxos Global Dollar Network to support stablecoins including PYUSD and USDC across its network.

For agentic commerce, stablecoins solve a specific problem that traditional card networks struggle with: micropayments. An AI agent negotiating real-time pricing, executing dozens of small transactions per hour, or paying for API access on behalf of a user needs a payment rail that settles instantly without the per-transaction overhead of card processing. Stablecoins on programmable rails offer exactly that.

The convergence is already visible. Both Visa and Mastercard are building infrastructure that spans traditional card authentication, tokenized transactions, and blockchain-based settlement — creating a payment stack flexible enough for both human checkout flows and autonomous agent transactions.

Digital Wallets and BNPL Complete the Shift

VDCAP also arrives as digital wallets consolidate their dominance over online commerce. Digital wallets are projected to capture 61% of global ecommerce transaction value by 2027, with total transaction value expected to reach $25 trillion. For merchants, wallets already pre-package much of the data that VDCAP requires — device fingerprints, verified emails, tokenized card credentials — making program qualification nearly automatic for wallet-based transactions.

Meanwhile, Visa is introducing Installment Credential products in the United States as part of the same April 2026 rule update, allowing Buy Now, Pay Later programs to operate using standard Visa card form factors. The global BNPL market continues expanding, with ecommerce transaction value projected to exceed $442 billion by 2027. By embedding installment capabilities directly into the Visa credential, the company is pulling BNPL into its authentication and fraud prevention ecosystem rather than leaving it to operate on separate rails.

What This Means for Payments Strategy

VDCAP signals a structural shift in how payment networks monetize trust. Rather than treating authentication as a cost center or compliance obligation, Visa is turning it into a revenue-sharing mechanism: share better data, pay lower fees, get higher approval rates.

For merchants processing significant card-not-present volume, the action items are concrete. Ensure Device ID, IP Address, customer email, and billing address flow through with every transaction. Evaluate Network Token adoption to capture the full 0.10% incentive. Audit payment processor capabilities to confirm DCAP qualification data is being passed correctly.

For payment technology providers, VDCAP previews a future where authentication infrastructure is the competitive moat. The companies best positioned are those building systems that can authenticate humans at checkout today, verify AI agent authorization tomorrow, and settle across both card and stablecoin rails. In a payments landscape being reshaped by agentic commerce, programmable money, and AI-driven rewards optimization, the ability to prove “this transaction is legitimate” is becoming the most valuable capability in the stack.

Sources & Further Reading

• What is Visa’s Digital Commerce Authentication Program (DCAP)? — Checkout.com
• Top 9 Payment Trends for 2026 — Checkout.com
• 2026 Interchange Updates (Visa, Mastercard, Amex, Discover) — Merchant Cost Consulting
• April 2026 Association Updates — Xplor Pay
• Visa and Partners Complete Secure AI Transactions — Visa Newsroom
• How Visa and Mastercard Are Approaching Agentic Commerce — Digital Commerce 360
• Mastercard Unveils Open Standard to Verify AI Agent Transactions — PYMNTS
• How Verifiable Intent Builds Trust in Agentic AI Commerce — Mastercard
• Securing Agentic Commerce: Helping AI Agents Transact with Visa and Mastercard — Cloudflare
• PayPal Expands PYUSD Stablecoin to 70 Markets — CoinDesk
• Nium Launches Stablecoin Card Issuance Platform on Visa, Mastercard — Bitcoin Ethereum News