Short answer
3D Secure is an extra identity check for online card payments, where the customer's bank confirms the buyer is the real cardholder. Most payments pass without any extra step, and risky ones trigger a code or app approval. A successful check usually moves fraud chargeback liability from the merchant to the card issuer.
Part of How payments work. Start with the main guide: How a card payment works: authorisation, clearing and settlement
Key takeaways
- 3D Secure lets the cardholder's bank confirm identity during an online payment. Version 2, also called 3DS2, replaced the older redirect.
- Most payments pass without any extra step, called frictionless. Riskier ones get a challenge such as a one-time code.
- A successful check usually moves fraud chargeback liability from the merchant to the issuer, with exceptions for some exemptions.
- In the UK and Europe, strong customer authentication rules make it mandatory for most online payments. Elsewhere it is mainly a fraud tool.
- It does not apply to card-present or MOTO payments, and it may add a small per-check fee.
You buy something online and your banking app buzzes. A message asks you to approve the payment with a fingerprint or a code. That is 3D Secure at work. It is the layer of checking that sits between a customer typing in a card number and the bank saying yes.
This guide explains what 3D Secure is, how the two flows work, what the liability shift means for a merchant, where the rules require it, what it can cost, and what a payment consultant should check on a merchant statement.
What is 3D Secure?
3D Secure is a protocol that lets a card issuer check, during an online payment, that the buyer is the real cardholder. The name refers to three domains: the merchant side, the card network side and the issuer side. The card brands market it under their own names, such as Visa Secure, Mastercard Identity Check and American Express SafeKey.
The current version is EMV 3-D Secure, often called 3DS2, managed by EMVCo. It replaced the first version, which sent every customer to a separate bank page and caused many to abandon the purchase. The newer version shares more data with the bank so it can approve most payments without bothering the customer.
How does 3D Secure work?
When a customer pays online, the merchant's system sends the issuer data about the payment, the device and the customer. The issuer uses that to judge the risk and decides whether to approve silently or ask for more proof.
- Customer pays onlineThey enter their card details on the merchant's checkout.
- Merchant shares dataAmount, device, billing details and past behaviour go to the issuer.
- Issuer assesses riskIt compares the payment with what it knows about the cardholder.
- Low risk: frictionlessThe payment is approved with no extra step.
- Higher risk: challengeThe customer approves in a banking app or enters a one-time code.
The issuer decides which path applies to each payment.
The two paths matter for sales. A frictionless payment feels like any other checkout. A challenge adds a step and some customers drop out, so merchants and providers try to send as much data as possible to keep payments frictionless without raising fraud.
What is the difference between frictionless and challenge flows?
| Question | Frictionless | Challenge |
|---|---|---|
| What does the customer see? | Nothing extra | A code, app approval or biometric check |
| When does it happen? | Low-risk payments the issuer trusts | Higher-risk or high-value payments |
| Effect on conversion | Little or none | Some customers abandon |
| Who decides? | The issuer | The issuer |
| Liability shift | Usually yes | Yes, when authentication succeeds |
Merchants cannot force the issuer to skip a challenge. They can influence the outcome by sending complete data and by asking for an exemption where the rules allow it, though exempt payments can behave differently for liability.
What is the liability shift?
The liability shift is the main reason merchants care. When a payment is authenticated with 3D Secure and the cardholder later disputes it as fraud, responsibility for the loss usually moves from the merchant to the card issuer. Without 3D Secure, an online fraud chargeback usually falls on the merchant.
There are exceptions that a merchant should understand.
- Exemptions. If the merchant or provider asks for an exemption, such as for a low-value payment, and the issuer grants it, the liability shift may not apply. Check the rules with your provider.
- Merchant-initiated payments. Repeat payments such as subscriptions, taken after the customer has agreed, are generally treated differently from the first payment.
- Other disputes. The shift covers fraud disputes. A customer who says goods never arrived or were faulty can still raise a chargeback that 3D Secure does not prevent. See refunds, chargebacks and turnover.
Rules vary by card scheme and region, so merchants should confirm the details with their provider.
Is 3D Secure compulsory?
It depends on where the merchant and customer are.
In the UK and Europe, strong customer authentication rules under the payment services regulations require two-factor checks for most online payments, and 3D Secure is the standard way to meet them. Some payments are exempt, and some payments are out of scope, which is why MOTO and card-present payments do not use it.
In Australia, New Zealand, South Africa and the US, there is no equivalent single legal rule that we found for ordinary online card payments, so 3D Secure is mainly a fraud-prevention tool. Merchants may still choose to use it, providers may require it for higher-risk businesses, and some banks apply it to many payments. Check local rules and your provider's terms, because practice changes.
Which payments does 3D Secure not cover?
3D Secure only applies to online payments where the customer takes part in a checkout.
- Card-present payments. Chip and PIN or tap already authenticate the customer at the counter.
- MOTO payments. The merchant keys the details in, so there is no customer checkout to challenge. See MOTO payments explained.
- Merchant-initiated repeat payments. Taken later under an earlier agreement.
- Some corporate and anonymous prepaid cards, depending on the rules.
For card-present payments, the nearest equivalent is the PIN or the device authentication on a phone wallet, which uses a device token as described in payment tokenisation explained.
What does 3D Secure cost?
3D Secure itself is often included in the service, but the way it is priced varies. Some providers include it in the gateway fee. Others charge a small amount for each authentication, and some charge for extra tools that choose when to request it.
Costs can also appear indirectly. A challenge that makes some customers abandon the purchase is a cost in lost sales. A fraud loss that would have been avoided is a cost in chargebacks. The right balance depends on the merchant's average order value, fraud rate and customer base.
- Average order valueHigh-value orders gain more from the liability shift. Low-value orders gain less.
- Customer typeReturning customers often pass frictionless. New customers are challenged more.
- Fraud and chargeback rateA high rate points to stronger authentication.
- Checkout abandonmentIf challenges lose sales, ask the provider to send more data to the issuer.
Four factors pull in different directions.
The point is the trade-off. A merchant who sells low-risk goods to returning customers may want fewer challenges. A merchant selling high-value items to new customers may value the liability shift more.
What should a payment consultant check?
Look at the online part of the merchant's business and ask four questions.
- Does the merchant sell online?If not, 3D Secure does not apply.
- Is it switched on and by whom?The provider, the gateway or the merchant's web platform may control it.
- Is there a per-check or gateway fee?Look for authentication, 3DS or gateway lines on the statement.
- What is the chargeback rate?A high rate suggests fraud controls need attention.
The answers affect fees, conversion and chargebacks.
See authorisation and per-transaction fees for the other per-payment lines that sit next to 3D Secure on a statement, and add any 3D Secure fee to the monthly cost in the calculator. For how an online payment moves from checkout to bank account, see how a card payment works.
Frequently asked questions
What is 3D Secure in simple terms?
It is an extra identity check for online card payments. The customer's bank confirms the buyer is the real cardholder, usually without any extra step, and asks for a code or app approval only when a payment looks risky.
What is the difference between 3D Secure and 3DS2?
3DS2 is the current version of 3D Secure, also called EMV 3-D Secure. It shares more data with the bank so most payments pass without a redirect, which makes checkout smoother than the first version.
Does 3D Secure protect merchants from chargebacks?
It usually moves liability for fraud chargebacks to the card issuer when a payment is authenticated. It does not stop disputes about goods not received or faulty items, and some exempt payments may not get the shift.
Is 3D Secure the same as strong customer authentication?
Not exactly. Strong customer authentication is a legal requirement in the UK and Europe for two-factor checks on most online payments. 3D Secure is the technology most merchants use to meet it.
Does 3D Secure apply to phone orders or card machines?
No. It only applies to online payments with a customer checkout. Card-present payments use chip and PIN or tap, and MOTO payments keyed by the merchant do not use it.
Does 3D Secure hurt sales?
A challenge adds a step and some customers abandon, but most payments pass without one. Sending complete data and using a modern version helps keep most payments frictionless.
Sources and further reading
Figures in this guide are examples to show the method. Fees, rules and rates change, so check your own statement, contract and current rules before you decide. This is general information, not financial or legal advice.