I'm sending my address just fine right now — why is this changing?
I'm sending my address just fine right now — why is this changing?
Visa and Mastercard are tightening address-data requirements for 3D Secure authentication scheme-wide — this isn't a change we're introducing unilaterally. If your integration works today, it will continue to work exactly as-is until the relevant date below; nothing changes before then.
There are several dates mentioned (1 October, 1 November, 4 January) — which one do I actually need to worry about?
There are several dates mentioned (1 October, 1 November, 4 January) — which one do I actually need to worry about?
If you only run a live/production shop: 4 January 2027 is the date that affects you. The two demo-environment dates (1 October 2026 for country format, 1 November 2026 for address line changes) exist purely so you can test ahead of time — they don't affect real payments.
If I do nothing, will my payments stop working on 4 January 2027?
If I do nothing, will my payments stop working on 4 January 2027?
Before that date, nothing changes. From 4 January 2027, any request with non-conforming data (f.e. address line over 50 characters) will be rejected as an API/payment error — it won't silently go through, and it also won't silently keep working. We strongly recommend testing in demo beforehand so this isn't a surprise on the day.
I have my address in three fields (f.e. billing_line1, billing_line2, billing_line3) — how do I combine them?
I have my address in three fields (f.e. billing_line1, billing_line2, billing_line3) — how do I combine them?
Join them in order with a comma and space, e.g. billing_line1, billing_line2, billing_line3, then check the result against the 50-character limit. If the combined result is longer than 50 characters:
Prioritize the street name and house/apartment number — these matter most for authentication.
Avoid cutting off mid-word if possible; trim at a field or word boundary instead.
If you're unsure how to map your specific data, contact support and we can advise.
Where do I find the ISO 3166-1 numeric code for countries?
Where do I find the ISO 3166-1 numeric code for countries?
Link to full ISO 3166-1 numeric code reference: https://www.iso.org/obp/ui/#search/code/
Does the 50-character limit count special characters and diacritics (e.g. õ, ä, ü)?
Does the 50-character limit count special characters and diacritics (e.g. õ, ä, ü)?
The limit is based on character count, not bytes, so diacritics count as one character each.
I have customers with saved/tokenized cards and recurring payments — do their existing stored addresses need to be updated?
I have customers with saved/tokenized cards and recurring payments — do their existing stored addresses need to be updated?
No. Address data for recurring payments and saved-card agreements is captured once when the agreement is created and reused for all subsequent charges — it is not re-validated or re-submitted on each charge. This means existing agreements will continue to work without changes after the new format takes effect. Only new agreements created on or after the relevant dates need to comply with the new address format.
You mention "higher decline rates" if I don't do this — am I already losing sales because of my address data today?
You mention "higher decline rates" if I don't do this — am I already losing sales because of my address data today?
Not necessarily. This is about the new scheme requirements going forward, not a signal that your current setup is causing declines today.
I use WooCommerce/OpenCart/a plugin — does this apply to me?
I use WooCommerce/OpenCart/a plugin — does this apply to me?
If you use one of our official plugins, there will be a new plugin version available for you on our Support Page.
If you use a custom/API integration you need to update it yourself.
Not sure which applies to you? Contact support and we'll confirm.
You say address fields are "not yet hard-required" — so are they optional or mandatory?
You say address fields are "not yet hard-required" — so are they optional or mandatory?
Sending address data is optional. What's mandatory is the format — if you do send address data, it must meet the length/format rules or the request will be rejected. We recommend sending it because of the decline-rate and fraud-screening benefits, but it isn't a strict requirement to send it at all.
My shop only sells digital downloads — I don't ship anything. Do I need a shipping address?
My shop only sells digital downloads — I don't ship anything. Do I need a shipping address?
No. If there's no physical shipment, simply omit the shipping address fields entirely rather than filling them with placeholder data. We recommend still populating billing address fields, since these support 3DS authentication regardless of whether anything ships.
What if a customer's address doesn't fit in 50 characters?
What if a customer's address doesn't fit in 50 characters?
Don't silently truncate arbitrary parts. Prioritize keeping street name and house/apartment number, trim at a word boundary, and drop less critical details (e.g. building/unit descriptors) first if needed.
Who do I contact if something breaks after go-live?
Who do I contact if something breaks after go-live?
Please contact our support team. We strongly recommend testing in the demo environment well ahead of 4 January 2027 so any issues surface before they affect live payments.
Will you remind us before the changes actually go live?
Will you remind us before the changes actually go live?
Yes — we'll send follow-up notices ahead of each date (1 October 2026, 1 November 2026, and a final reminder shortly before the 4 January 2027 production cutover).