3-D Secure
3-D Secure
3-D Secure is a cardholder authentication protocol for online card payments in which the issuing bank confirms that the payment is being made by the card owner.
What is 3-D Secure?
3-D Secure (3DS) is an EMVCo standard that adds a payer identity verification step to online payments. The issuer (the cardholder's bank) decides whether to let the payment through without friction (frictionless), request confirmation (challenge: a one-time code, a push notification in the banking app, or biometrics), or decline it.
## How it works
The merchant or payment gateway sends transaction data through the card scheme's directory server to the issuing bank. The bank assesses risk based on device data, history and amount, and returns the authentication result. Version 2.x transmits more data about the purchase and the device, so it more often passes without an extra step for the customer.
## Why it matters and what it affects
The main benefit is liability shift: if a payment was authenticated successfully, the issuer typically bears the loss on a disputed fraud transaction rather than the merchant. That is why 3DS is often tied to scheme requirements and to PSD2/SCA rules in the EU, where such authentication is mandatory for most online payments.
## Where it appears in high-risk verticals
In fintech and payments, 3DS is a standard protection layer when accepting cards. In gambling and betting, the authentication step often becomes a point of loss: some banks decline or fail to pass payments to gaming merchants, and customers abandon the payment at the confirmation screen. In nutra, the check reduces fraud chargebacks but increases declines among legitimate buyers.
## Common mistakes
Typical mistakes include treating a 3DS failure as a card error, failing to distinguish authentication declines from authorization declines, ignoring exemption settings, and omitting data from the request (such as device and address details), which makes the bank more likely to send the payment to challenge.
FAQ
Are 3-D Secure and 3DS the same thing?
Yes, 3DS is the short form of 3-D Secure. Across protocol versions the volume of transmitted data and the authentication flows change, but the principle stays the same: the issuing bank performs the verification.
Why do payments get declined after enabling 3DS?
Usually because the customer did not complete the confirmation step or the bank rejected the authentication. The cause should be checked in the PSP or gateway logs, not just in the general decline status.
Does 3DS protect against all chargebacks?
No. It reduces the risk of fraud disputes but does not cover friendly fraud or disputes over goods or services, which are handled through the chargeback process.