3D Secure (3DS) is an authentication protocol for online card payments that lets the card issuer verify the cardholder before a transaction is authorized. The issuer either approves the shopper silently, using data about the device and the purchase, or asks them to confirm with a one-time code, banking app, or biometric check.
For merchants, 3DS does two jobs: it stops fraud that depends only on stolen card details, and when a transaction is authenticated, liability for fraud-related chargebacks generally moves from the merchant to the issuer. The current version, EMV 3DS (often called 3DS2), fully replaced the original protocol in October 2022 and is built so that most low-risk shoppers pass without being challenged.
What Is 3D Secure?
The “3D” stands for three domains: the issuer domain (the cardholder’s bank), the acquirer domain (the merchant’s bank and payment provider), and the interoperability domain (the card networks and the infrastructure that connects them). EMVCo, the body jointly owned by the major card networks, maintains the technical specification.
Shoppers mostly know 3D Secure by network brand names. Visa’s program is Visa Secure, which replaced the older Verified by Visa name. Mastercard’s is Mastercard Identity Check, and American Express uses SafeKey.
From 3DS1 to 3D Secure 2.0
The first version of 3D Secure sent shoppers to a pop-up or redirect page to type a static password, which hurt conversion and worked poorly on phones. EMVCo published EMV 3DS in October 2016 to fix that.
According to Visa’s notice on retiring 3DS 1.0.2, Visa ended support for the old protocol on October 15, 2022, and Mastercard followed on October 18, 2022. The newest version, EMV 3DS version 2.3.1, adds data elements for out-of-band authentication and Secure Payment Confirmation.
3DS1 vs EMV 3DS comparison
| Feature | 3DS1 (retired) | EMV 3DS (3DS2) |
|---|---|---|
| Authentication method | Static password on a redirect or pop-up page | Risk-based, with app push, one-time codes, or biometrics when a challenge is needed |
| Data shared with the issuer | Limited | Much richer device, transaction, and account data |
| Frictionless approvals | Not supported | Supported for low-risk transactions |
| Mobile and in-app support | Poor | Native app SDK and mobile-friendly flows |
| Status | Retired by Visa and Mastercard in October 2022 | Current standard (versions 2.2 and 2.3.1) |
How 3D Secure Authentication Works
When a shopper submits a card payment, the merchant’s 3DS server collects transaction and device data and sends it through the card network’s directory server to the issuer’s access control server (ACS). The ACS scores the risk and chooses one of two paths.
The Frictionless Flow
If the data points to a low-risk purchase, the issuer approves the 3DS authentication without involving the shopper. A returning customer on a known device, shipping to a familiar address, typically goes through this way and never sees a 3D Secure checkout step.
The Challenge Flow
If the risk looks higher, the issuer asks the shopper to prove who they are. That might be a one-time passcode sent by text, a push notification to the banking app, or a fingerprint or face check on the phone.
What happens after authentication
The ACS returns an authentication result, including a cryptographic value and an electronic commerce indicator (ECI). The merchant passes both into the authorization request, and that is how the issuer and the network know the transaction was authenticated.
Why 3D Secure Authentication Fails
A 3D Secure authentication failed message usually means the issuer could not confirm the shopper. Common causes include a wrong or expired one-time code, a challenge window that timed out or was closed, a shopper who could not reach their banking app, a technical outage at the issuer’s ACS, or a fraudster who could not pass the challenge. Merchants should log the failure reason their provider returns, because a jump in technical failures calls for a different fix than a jump in shoppers abandoning challenges.
How the 3D Secure Liability Shift Works
The 3D Secure liability shift is the main financial reason merchants adopt the protocol. Under card network rules, liability for fraud-coded chargebacks generally moves to the issuer when a transaction is fully authenticated, and in many cases when the merchant attempts authentication but the issuer does not take part.
The shift has limits. It covers fraud claims, not disputes over items not received, goods not as described, or cancelled subscriptions, so a 3D Secure chargeback for those reasons still lands on the merchant. Network rules also include exceptions by region and merchant category, so confirm the details with your acquirer. Strong evidence and processes still matter for friendly fraud chargebacks, and our guide on how to fight chargebacks covers the disputes 3DS does not touch.
3D Secure, PSD2, and Strong Customer Authentication
In the European Economic Area, the revised Payment Services Directive (PSD2) requires strong customer authentication (SCA) for most customer-initiated online card payments. The European Banking Authority’s SCA migration opinion set December 31, 2020, as the deadline for eCommerce card payments.
EMV 3DS is the main way card issuers apply SCA, and it is also the channel merchants and acquirers use to request SCA exemptions, such as low-value payments, transaction risk analysis, and merchant-initiated transactions. MFJ’s breakdown of PSD2 SCA requirements and exemptions covers these in detail. The US has no equivalent mandate. American merchants choose when to use 3DS, which gives them more room to apply it selectively.
Balancing Fraud Protection and Conversion at Checkout
Every fraud control added to checkout comes with a tradeoff. Extra verification steps, false declines, and manual reviews can stop fraudsters, but they can also frustrate legitimate customers and drive them to abandon their carts or shop elsewhere. For eCommerce merchants, the goal is not to block fraud at any cost but to apply the right amount of friction to the right orders.
Trusted, low-risk shoppers should move through checkout quickly, while suspicious transactions receive the extra scrutiny they warrant. The strategies below show how merchants can tighten protection where it matters most without giving up conversions.
Use 3DS Selectively With Risk-Based Rules
Outside regulated markets, merchants do not have to send every order through 3D Secure. Many route only higher-risk orders, such as first-time buyers, expensive or resellable goods, or any high-risk transaction flagged by their fraud tools, while letting trusted customers check out without it. This approach targets the cost of 3DS at the orders most exposed to card-not-present fraud.
Send Rich Data to Raise Frictionless Rates
Issuers approve more transactions without a challenge when they receive complete data. Send the billing and shipping addresses, email, phone number, account age, and device information the protocol supports, not just the minimum fields.
Check Your 3D Secure Payment Gateway Support
Ask your 3D Secure payment gateway which EMV 3DS versions it supports, whether it offers an in-app SDK, whether it can flag SCA exemptions, and how it reports authentication outcomes. Older integrations may lack features introduced in versions 2.2 and 2.3.1. MFJ has covered how EMV 3DS and seamless authentication improve the shopper experience.
Track the Right Metrics
Measure frictionless rate, challenge rate, challenge success rate, authentication failure reasons, and checkout abandonment after a challenge. Compare fraud and chargeback rates for authenticated and unauthenticated orders to see whether your routing rules are working. Industry research on 3-D Secure effectiveness can help benchmark your results.
Roll Out 3D Secure Where It Pays Off
3D Secure lets the issuer confirm the cardholder, blocks fraud that relies on stolen card data alone, and moves liability for fraud-coded chargebacks off the merchant when authentication succeeds. EMV 3DS makes that possible with far less friction than the original protocol. Apply it to the orders where fraud risk justifies it, send the issuer as much data as the protocol supports, confirm your gateway is on a current version, and watch your frictionless and abandonment rates so security gains do not come at the cost of sales.
Frequently Asked Questions
Charity Amancio
Charity Amancio specializes in SaaS solutions for global eCommerce businesses, including payments and risk management applications. She bridges the gap between technology and merchant needs, offering practical perspectives on the tools shaping eCommerce. Her insights appear regularly in B2B publications covering the digital commerce space.