After multiple rejections of my online order, I emailed the helpdesk at the Vatican to find out why I couldn't buy tickets. The response may be helpful for others, so I'm sharing it here:
When you book a ticket on the website of the Vatican Museums, it is requested a private code that gives added protection against unauthorized use of your card when you shop at participating online merchants.
If you're using a Mastercard, the private code is called "3d Secure Code
If you're using a Visa, the private code is called "3d Secure Full Authentication" (Verified by Visa). Tel number 1-800-654-9214
Just FYI with Bank of America. Tel. number to call for Visa Verification is 877-388-6581
In order to purchase the tickets on the website of the Vatican Museums, you have to contact Mastercard or Visa and you have to ask to join the "3D Secure" program. In case, ask also to your bank if they join the OTP (One Time Password). It works with most browsers.
Chase Bank at the moment does not subscribe to “VISA - 3d Secure Full Authentication” or “Mastercard - 3d Secure Code” program needed to complete the transaction on our website. You can try to call Chase Bank and ask to manually approve the charge and then you have to run it again. You can’t call the bank in advance. You have to try the charge once and have it denied, and only later, Chase will approve it the second time.