Secure Remote Commerce (EMV SRC) Explained

Secure Remote Commerce (SRC) is an EMVCo payment standard that lets customers check out online with a single click. It uses tokenized card data and a unique cryptogram in place of a typed card number. SRC powers Click to Pay, the checkout button you see beside the card-network logos on participating merchant sites.

I've put together representment evidence for disputes on my own stores. The reason code decided what I sent. SRC's cryptogram is the kind of evidence that carries a card-absent fraud dispute.

Key takeaways

• Secure Remote Commerce is the payment standard behind the Click to Pay button.
• SRC authenticates each purchase with a cryptogram generated at checkout.
• Customers can store cards from 5 brands, from Visa to UnionPay.
• Point to SRC data when answering Visa 10.4 or Mastercard 4837 fraud claims.
• Card network rules shift, so recheck your SRC evidence process every 12 months.
• Ask your acquirer how SRC data counts toward a Compelling Evidence 3.0 filing.

What is Secure Remote Commerce?

Secure Remote Commerce is an EMVCo specification that authenticates online checkout with a tokenized card and a cryptogram. The customer picks a stored card instead of typing the number. It works the same way across every participating card brand.

The cryptogram is what separates this from a saved card. EMVCo's specification calls for "dynamic data, such as cryptograms or other transaction unique data."

Every purchase makes a fresh value, so data copied from an earlier sale is useless to a fraudster.

The real card number stays out of the exchange, because tokenization swaps it for a stand-in value.

Visa, Mastercard, Amex, Discover, and UnionPay each run their own version of the specification. Issuers add it on their own timelines. So two customers with the same card brand can see different checkouts on your site.

Wait, what's EMV?

EMV is the chip standard for in-person cards, while SRC applies the same dynamic-data idea online. The acronym stands for Europay, Mastercard, and Visa, the three companies behind it. Most merchants know it from the chip in a physical card.

The acronym trips people up, because both specs come from EMVCo and both use dynamic data.

The chip standard also triggers the EMV liability shift for counterfeit fraud at the register. SRC covers card-absent payments online, where no terminal reads a chip.

The two rules stay in their own lanes. Your chip terminal has no bearing on an online SRC sale. An SRC rollout leaves your in-person liability unchanged.

And what's Click to Pay?

Click to Pay is the branded button built on the SRC specification, so both names describe one payment path. SRC is the technical standard. Click to Pay is what your customer sees and clicks.

EMVCo says these solutions come from "various industry participants." All are "based on the EMV SRC Specifications."

The shared specification is why the button behaves the same everywhere. Each network ships its own Click to Pay product. Your customer still sees one icon and one flow.

How does SRC work at checkout?

An SRC-enabled checkout knows an enrolled customer, shows their stored cards, and finishes the sale with a cryptogram. It runs in two stages. The first one usually happened long before the customer reached your site:

1. Enrollment. The card issuer registers the customer's card with the SRC System once.
2. Checkout. Your Click to Pay button recognizes the customer, presents their stored cards, and requests a cryptogram-backed authorization.

The split matters because the SRC System holds the enrollment.

Say a customer signed up at a different merchant last year. They reach your SRC-enabled checkout and see that same Click to Pay button. Their stored cards are already there, ready to select.

Portability is what makes SRC different from a saved card on your own site. You inherit every enrollment the card networks have built. A first-time buyer can check out like a returning one.

Recognition happens before they ever create an account with you.

Everyone else gets your standard card form and types the number as usual. SRC adds a second path and leaves the first one alone.

What cards can customers store in SRC wallets?

Customers can store Visa, Mastercard, American Express, Discover, and UnionPay cards through the same Click to Pay interface. Five brands participate:

1. Visa
2. Mastercard
3. American Express
4. Discover
5. UnionPay

Enrollment is decided issuer by issuer, so brand support alone tells you little. A bank under a participating brand may never enroll its cardholders.

Keep your standard card form on the same page as the Click to Pay button, so a customer without an enrollment never has to go back a step.

A share of your traffic will always type the card number by hand.

Does SRC data help if a dispute still happens?

The cryptogram and enrollment record from an SRC purchase strengthen your response to a card-absent fraud claim. They prove the sale was authenticated as it happened. Networks treat that as stronger evidence than a typed card number.

Your argument becomes that the network itself authenticated the sale.

Visa's Compelling Evidence 3.0 framework already works this way. To qualify by hand, a merchant matches four data points across past undisputed sales.

Sales authenticated through Visa Secure (3D Secure) skip that work. Visa and the issuer already hold the data.

SRC's cryptogram is the same kind of data. Visa has not named it an automatic qualifier, so ask your acquirer how yours treats it.

Start by naming the right code. Card-absent fraud claims run under specific chargeback reason codes. Each asks whether the cardholder approved the purchase:

These codes cover fraud claims only. A cardholder who admits the purchase but reports no delivery files under a product code. No cryptogram proves a box arrived. Friendly fraud falls in the same gap.

Winning a response is still the slow path. We built our chargeback alerts to reach you before a dispute files.

How is SRC beneficial for merchants?

SRC cuts checkout abandonment for enrolled customers and produces authentication data you can reuse in a dispute. Both come from one change. The customer stops typing a card number.

Three things follow from that:

1. Fewer fields. A card number, an expiry date, and a security code is three chances to lose the sale.
2. A reusable record. The cryptogram that replaces the typed number is proof you can pull months later.
3. No teardown. EMVCo built SRC to work with 3D Secure and EMV payment tokenization, so you keep both.

Store the record while the sale is fresh. Ask your processor where it shows SRC authentication data, then save that field with the order.

Chargebacks often arrive weeks later, when that data is harder to dig out of your processor's records. Check our reason code lookup to see which field each fraud code expects.

The benefit applies only to enrolled customers. Everyone else checks out the way they always have, which leaves you no cryptogram to point at later.

FAQ

Is Click to Pay the same thing as SRC?

Yes. Any merchant who accepts Click to Pay is accepting SRC.

What is an SRC card?

An SRC card is an ordinary card from a participating brand, enrolled with its issuer for Click to Pay. The card in your customer's wallet does not change.

Do I need to change my payment processor to accept SRC?

Support varies by processor and gateway. Ask yours whether they already handle Click to Pay transactions before you weigh a switch.

Does SRC cost anything extra to accept?

Your processor sets the pricing, since EMVCo publishes the specification without charging merchants. Ask how your Click to Pay transactions price against your standard card-not-present rates.