According to the Visa Payment Authentication Service, cardholders must verify their identity with a password when buying from a Web storefront. The goal is to secure merchant databases against attacks from hackers by password-protecting card numbers that may be stored in a database.