use any kind of authentication method (the protocol does not cover this) but typically, a password tied to the card is entered when making online purchases. The Verified-by-Visa protocol recommends the card issuer's verification page to load in an inline frame session. In this way, the card issuer's systems can be held responsible for most security breaches. Today it is easy to send a one-time password as part of an SMS text message to users' mobile phones and emails for authentication, at least during enrollment and for forgotten passwords. The main difference between Visa and Mastercard implementations lies in the method to generate the UCAF (Universal Cardholder Authentication Field): Mastercard uses AAV (Accountholder Authentication Value) and Visa uses CAVV (Cardholder Authentication Verification Value). ACS providers In the 3-D Secure protocol, the ACS (access control server) is on the card issuer side. Currently, most card issuers outsource ACS to a third party. Commonly, the buyer's web browser shows the domain name of the ACS provider, rather than the card issuer's domain name; however, this is not required by the protocol. Dependent on the ACS provider, it is possible to specify a card issuer-owned domain name for use by the ACS. MPI providers Each 3-D Secure version 1 transaction involves two Internet request/response pairs: VEReq/VERes and PAReq/PARes. Visa and Mastercard do not permit merchants to send requests directly to their servers. Merchants must instead use MPI (merchant plug-in) providers. Merchants The advantage for merchants is the reduction of "unauthorized transaction" chargebacks. One disadvantage for merchants is that they have to purchase a merchant plug-in (MPI) to connect to the Visa or Mastercard directory server. This is expensive (setup fee, monthly fee, and per-transaction fee); at the same time, it represents additional revenue for MPI providers. Supporting 3-D Secure is complicated and, at times, creates transaction failures. Perhaps the biggest disadvantage for merchants is that many users view the additional authentication step as a nuisance or obstacle, which results in a substantial increase in transaction abandonment and lost revenue. Buyers and credit card holders In most current implementations of 3-D Secure, the card issuer or its ACS provider prompts the buyer for a password that is known only to the card issuer or ACS provider and the buyer. Since the merchant does not know this password and is not responsible for capturing it, it can be used by the card issuer as evidence