Verified by Visa - Is the user-agent all that matters?

[Osiris]

Hi
As we all know, Verified by Visa is an extra layer of security which banks employ to prevent unauthorised transactions.
3D Secure (VBV) uses a technique called browser fingerprinting (and cookies) to identify the shopper, without this everyone would appear to be the same person (IP being the only identifier left), after the card holder has successfully proven themselves their browser fingerprint is remembered and cookies are stored on the computer, this way the card holder does not need to complete verification in the future, instead VBV recognises that the device was previously used and gives the all clear, however if a new device appears then the shopper will be asked to call their bank to confirm the purchase (they only do so if the payment or item is high risk), if the device appears to have been tampered with in an attempt to obfuscate the true fingerprint (Antidetect, fraudfox, useragent changers, VPNs, socks etc.) then VBV will block the transaction and will not give you the option to enter or reset the password (it also does this if the payment is out of the ordinary or high risk).
This is my understanding... What I would like to know is whether Verified by Visa / MasterCard SecureCode uses more than just the user-agent string? I've noticed that fullz sellers provide only this information so that leads me to believe it's all that's needed.
The logical side of me keeps saying "Why would fullz seller go through the hassle of selling cards when they could quite easily use the cards for themselves".
A year ago I was trying to figure this all out, I gave up and came to the conclusion VBV is unbeatable except in cases where the merchant doesn't use VBV (non-vbv/cardable site) or the card is not enrolled (non-vbv) (and fuck being one of these people hunting down bins, after all they'll eventually run out and what then?), since then I've been using payment processors but my method is now burnt so I'm back to square one which is why I'm here asking this question.
I'm going over this, appreciate any help I get

[lazy5143]

Find Non-VBV BiNs bro.

[dedauk]

Its really hard to bypass VBV now even in Aus so yea.. but always sites with Non VBV so yea do that instead brother

[mortal25]

i am working with browser fingerprinting techniques for more than a year now (i am a software developer working on web projects), and I can tell you for sure that its not only the user agent that matters. Fullz seller are just too lazy to collect more information from their victims.. VBV pages and generally antifraud systems on websites are collecting a shitload of data about your browser and your device so thats why you need to use apps for spoofing these informations. If you wont use these apps antifraud systems will link your tries and block it immediately regardless of the CC validity..