3D Secure (3DS) is the extra check a card issuer can run when a card is used online, to confirm that the person paying is the real cardholder. For the customer it usually means approving the payment in their banking app, or nothing at all. For the merchant it means less fraud and, in most cases, protection from fraud chargebacks.
This guide explains what 3D Secure is, how 3D Secure authentication works, when it is required, what it means for merchants, and why authentication sometimes fails.
Key takeaways
- 3D Secure is a card authentication protocol run by the card issuer during an online card payment. The current version is EMV 3-D Secure, often called 3DS2.
- Each card scheme brands it differently: Visa Secure, Mastercard Identity Check and American Express SafeKey, for example.
- In the EEA and the UK, Strong Customer Authentication rules mean most online card payments must be authenticated, and 3D Secure is how card payments do it. Exemptions exist for some payments.
- When a payment is authenticated with 3D Secure, liability for most fraud chargebacks usually shifts from the merchant to the issuer.
- 3DS2 shares far more data with the issuer than the old version, so many payments are approved without the customer having to do anything.
What is 3D Secure?
3D Secure is a security protocol that lets a card issuer verify the cardholder during an online, or card-not-present, payment. The first version was introduced by Visa in the early 2000s. Today the standard is managed by EMVCo, the body owned by the major card schemes, and is known as EMV 3-D Secure.
The “3D” stands for the three domains involved:
- The acquirer domain: the merchant and its acquirer, where the payment starts.
- The issuer domain: the cardholder’s bank, which authenticates the cardholder.
- The interoperability domain: the card scheme’s systems that connect the two.
Card schemes market 3D Secure under their own names:
| Card scheme | 3D Secure programme |
|---|---|
| Visa | Visa Secure (formerly Verified by Visa) |
| Mastercard | Mastercard Identity Check (formerly SecureCode) |
| American Express | American Express SafeKey |
| Discover and Diners Club | ProtectBuy |
| JCB | J/Secure |
How 3D Secure authentication works
- The customer pays. They enter their card details at checkout, or use a stored card.
- Data is sent to the issuer. Your payment provider’s 3DS server sends the issuer information about the payment and the device: amount, shipping and billing details, browser or app data and more.
- The issuer assesses the risk. Based on that data, it decides whether it is confident the cardholder is genuine.
- Frictionless or challenge. If the risk looks low, the payment is authenticated in the background and the customer sees nothing (the frictionless flow). If not, the customer is challenged, usually with a confirmation in their banking app, a one-time code or a biometric check.
- The result comes back. Your provider receives the authentication result and sends it with the authorisation request.
- The payment is authorised or declined as normal.
Authentication and authorisation are separate steps. A payment can pass 3D Secure and still be declined, for example for insufficient funds.
3D Secure 1 vs 3D Secure 2
| 3D Secure 1 | EMV 3D Secure (3DS2) | |
|---|---|---|
| Status | Retired by the card schemes | Current standard |
| Data shared with the issuer | Very little | Much richer payment and device data |
| Customer experience | Pop-up or redirect, often a static password | Frictionless for many payments; app-based or biometric challenges |
| Mobile apps | Poor support | Built for in-app payments |
| Non-payment use | No | Can be used when storing a card or setting up recurring payments |
Within 3DS2, card schemes have retired version 2.1, and versions 2.2 and 2.3 are in use. Your payment provider handles the version, but it is worth checking that it supports the current ones.
Is 3D Secure mandatory?
It depends on where you and your customers are.
Europe and the UK: Strong Customer Authentication
Under the EU’s second Payment Services Directive (PSD2) and its regulatory technical standards on strong customer authentication, most electronic payments started by the payer must be authenticated with two of three factors: something the customer knows, has or is. The UK kept the same rules after Brexit. For online card payments, 3D Secure is the way this is done.
The rules include exemptions, which the issuer decides whether to accept. The main ones are:
- Low-value payments: remote payments of up to 30 EUR, within cumulative limits of 100 EUR or five payments since the last authentication.
- Transaction risk analysis: payments up to set amounts when the provider’s fraud rate is low enough.
- Recurring payments of the same amount to the same merchant, after the first one is authenticated.
- Trusted beneficiaries that the customer has whitelisted with their bank.
Merchant-initiated transactions, such as subscription renewals charged without the customer present, fall outside SCA, provided the agreement was set up with authentication.
Outside Europe
Some other countries also require strong authentication for online card payments. Elsewhere, 3D Secure is optional, but card schemes and acquirers may still ask high-risk merchants to use it, and it brings the liability shift wherever it is used.
Why 3D Secure matters for merchants
- Liability shift. When a payment is authenticated with 3D Secure, liability for most fraud chargebacks moves to the issuer. Disputes for other reasons, such as goods not received, are not covered.
- Less fraud. Stolen card details are much harder to use when the issuer checks the cardholder.
- Fewer declines in Europe. Issuers in the EEA and UK decline many payments that should have been authenticated and weren’t.
- Lower dispute ratios. Fewer fraud chargebacks help keep your ratio below card scheme thresholds such as those under Visa VAMP.
- Acquirer requirements. Many acquirers require 3D Secure for high-risk merchants as a condition of the account.
The trade-off is friction. Every challenge is a moment when a customer can give up. That is why good implementation, and using exemptions where they make sense, matters as much as having 3D Secure switched on.
3D Secure for high-risk merchants
Adult, dating, gaming and nutraceutical merchants see more fraud attempts and more disputes than average, so 3D Secure is usually part of the deal with their acquirer. A few points matter more in these industries:
- Authenticate the first payment of every subscription and store the card with authentication, so renewals can run as merchant-initiated transactions.
- Use a recognisable billing descriptor, because 3D Secure does not stop friendly fraud from customers who don’t recognise a charge. See our guide to discreet billing.
- Watch your challenge and success rates by country. Some issuers challenge far more often than others.
Read more in our guides to fraud protection and prevention and preventing chargebacks.
Why 3D Secure authentication fails, and how to fix it
Missing or poor data
3DS2 depends on the data you send. Missing billing addresses, emails or device data make issuers challenge more and approve less. Send as much of the recommended data as your provider supports.
The customer doesn’t complete the challenge
Customers abandon challenges when the banking app notification doesn’t arrive, they don’t have their phone, or the window times out. Tell customers at checkout that their bank may ask them to confirm the payment.
Outdated integration
Old plugins and integrations may still use retired 3DS versions or send too little data. Keep your checkout and payment plugins up to date.
Issuer problems
Sometimes the issuer’s own authentication system is slow or unavailable. Your provider’s reporting should show whether failures cluster around particular issuers or countries.
Cards not enrolled
Some cards, particularly some prepaid and virtual cards or cards from regions where 3D Secure is rare, may not support it. How these payments are handled depends on your provider’s rules and your risk appetite.
Frequently asked questions
What is 3D Secure authentication?
3D Secure authentication is a check run by the card issuer during an online card payment to confirm that the person paying is the cardholder. It may happen in the background or ask the customer to confirm the payment in their banking app or with a code.
What does 3D Secure mean on a credit or debit card?
It means the card supports the issuer’s online authentication programme, such as Visa Secure or Mastercard Identity Check. When you pay online, your bank may ask you to confirm the payment before it goes through.
Is 3D Secure mandatory?
In the EEA and the UK, most online card payments must be authenticated under Strong Customer Authentication rules, and 3D Secure is how card payments meet them, with some exemptions. In many other countries it is optional.
Does 3D Secure protect merchants from chargebacks?
It protects against most fraud chargebacks, because liability usually shifts to the issuer when a payment is authenticated. It does not cover disputes about goods not received, items not as described or cancelled subscriptions.
What is the difference between 3D Secure 1 and 3D Secure 2?
3D Secure 2 sends much more data to the issuer, so many payments are approved without a challenge, and it works properly in mobile apps. 3D Secure 1 has been retired by the card schemes.
Why did my 3D Secure verification fail?
Common reasons are a challenge that timed out or wasn’t completed, a wrong code, missing data in the payment, or a problem at the card issuer. Try again with your banking app open, or contact your bank.
Can a payment pass 3D Secure and still be declined?
Yes. 3D Secure only confirms who is paying. The issuer still decides whether to authorise the payment, for example based on funds or limits.
Next step
3D Secure is part of every serious high-risk payment setup. Fasto works with adult, subscription, nutraceutical, gaming, dating and hospitality merchants, and approval typically takes two to three weeks.
Get a free quote, or read more about our high-risk payment gateway.
Source: EMVCo: EMV 3-D Secure specifications.
