Payments, retention and operations
3D Secure: how card authentication works, what the liability shift covers and when a US store should use it
3D Secure asks the card’s issuing bank to confirm that the cardholder is the one paying, often without the buyer noticing and sometimes with a one-time code. For a US store it’s optional, so the questions that matter are what the fraud liability shift really covers, where Europe’s rules require the check and which of your orders should get it.
Reading pathPart 5 of 8 · Getting paid, from the CTA click to the bank
- Checkout Abandonment: Why Buyers Leave, How to Fix It
- Trust Badges: Which Help at Checkout and Which Mislead
- How Payment Processing Works, From Pay to Payout
- Payment Authorization Rate: Declines and Retry Rules
- 3D Secure: Liability Shift, SCA and When to Use It
- Card Testing: How to Spot and Stop a Carding Attack
- Chargeback Representment: How to Win a Chargeback
- How to Reduce Chargebacks: Fix Each Dispute Reason
On this page
- How a 3D Secure check works
- Frictionless or challenge: the issuer decides
- What the 3D Secure liability shift covers, and what it doesn't
- Where 3D Secure is required: strong customer authentication in Europe
- Does a US supplement store need 3D Secure?
- 3D Secure on subscriptions and rebills
- What 3D Secure won't fix
- Before you switch on 3D Secure
- Frequently asked questions
3D Secure is a check the card's issuing bank runs during an online payment to confirm that the buyer is the cardholder. Low-risk payments pass in the background; riskier ones get a prompt, such as a one-time code. If an authenticated payment is later disputed as fraud, liability typically shifts to the issuer. Europe's rules require it for most online card payments; in the US it's optional.
How a 3D Secure check works
EMVCo, which maintains the specification and calls it EMV 3-D Secure, describes an exchange of data between the merchant and the issuer that lets the issuer authenticate the consumer and helps prevent card-not-present fraud. The data covers the transaction, the payment method and the device, and the check works in browser and in-app checkouts (EMVCo). Here's one check, from the Pay button to a possible dispute:
One 3D Secure check, stage by stage
1Your checkout sends the data
What happens: Your checkout sends the issuer data about the transaction, the card and the device.
Why it matters: The issuer judges the risk from what it receives.
What goes wrong:
- Sending the bare minimum
- Expecting it everywhere: Stripe says wallets and off-session payments may not support 3D Secure
2The issuer picks the path
What happens: It authenticates the buyer in the background, asks for a challenge, or declines to authenticate.
Why it matters: You can state a preference, but the issuer determines the flow.
What goes wrong:
- Promising buyers a checkout with no extra step
3If challenged, the buyer proves it’s them
What happens: The buyer enters a one-time passcode, answers knowledge-based questions or uses a biometric check.
Why it matters: It’s the only step the buyer sees, so any friction lives here.
What goes wrong:
- Buyers who give up at the prompt
- Challenging every order instead of the risky ones
4The payment is authorized as usual
What happens: After the check, the payment goes to the issuer for authorization and can still be approved or declined.
Why it matters: Authentication answers who is paying; authorization answers whether the issuer will pay.
What goes wrong:
- Treating an authenticated payment as an approved one
5Later: a fraud dispute
What happens: If the cardholder disputes an authenticated payment as fraud, liability typically shifts from you to the issuer.
Why it matters: This is what a US store gets for the extra step.
What goes wrong:
- Leaving an inquiry on an authenticated charge unanswered
- Expecting it to cover not-received or not-as-described disputes
Read more: How to Reduce Chargebacks: Fix Each Dispute Reason
Authentication isn't approval. After the check, the issuer still has to authorize the payment and can turn it down, for insufficient funds for example. The names cause confusion too. Each network brands its own program: Visa Secure, Mastercard Identity Check and American Express SafeKey (Stripe). Older names such as Verified by Visa and Mastercard SecureCode linger; Visa's own October 2026 dispute guide still says "Verified by Visa". The protocol in use today is EMV 3DS, often called 3DS2. EMVCo recommends version 2.2 or higher, and major card brands no longer support 3DS1 (Stripe).
Frictionless or challenge: the issuer decides
Each check ends one of three ways, and the issuer picks. Visa's data guide for Visa Secure puts it in one line: issuers "decide to frictionlessly authenticate, challenge, or decline authentication requests" (Visa). Truly low-risk payments pass without a step, moderate-risk ones get a challenge and high-risk ones are declined:
Three ways a 3D Secure check can end
No step for the buyerFrictionless
The issuer authenticates from the data your checkout sent.
- Typically gets the liability shift, unless an exemption was requested (Stripe)
You can ask for it, not make it happen.
The buyer answers a promptChallenge
A one-time passcode, knowledge-based questions or a biometric check (EMVCo).
- Typically gets the liability shift too
- The one step where a buyer can give up
Not authenticatedDeclined
The issuer refuses to authenticate an attempt it judges high-risk (Visa).
- No authentication, so no liability shift for that attempt
Don’t route the order around it.
You can ask for one path. Stripe lets a merchant request a frictionless flow or a challenge, then warns that it "can't guarantee your preference because the issuer determines the ultimate authentication flow" (Stripe).
What you do control is the data. Visa's guide lists the elements it found most useful, among them the cardholder's email and phone number, the shipping address, a common device identifier and the browser's IP address and screen size, and it reports better results for merchants that send more than half of its priority elements. A checkout that sends the bare minimum gives the issuer less to go on.
What the 3D Secure liability shift covers, and what it doesn't
The liability shift is the reason a US store bothers. If a cardholder disputes a 3D Secure payment as fraudulent, liability "typically shifts" to the issuer, Stripe says, while a dispute for any other reason, such as a product not received, follows the standard process (Stripe). Visa's wording is just as careful: authentication can shift liability for authenticated or attempted-authentication transactions (Visa). "Typically" and "can" carry real weight there. Here's how the shift plays out case by case:
Who carries a fraud dispute after 3D Secure
Authenticated
The issuer authenticated the buyer, frictionlessly or after a challenge. A fraud dispute typically leaves the liability with the issuer.
Not guaranteed, Stripe says, and liability can be downgraded after authorization.
Exemption
The payment skipped authentication under an SCA exemption. Stripe says it gets no liability shift.
Mastercard: for a successful acquirer exemption, “Liability for this transaction is with the Acquirer.”
Issuer unavailable
The network required it, but the issuer’s 3D Secure provider was down or doesn’t support it.
Liability can still shift (Stripe). Visa’s wording covers “attempted-authentication transactions”.
Card or error
The card doesn’t support 3D Secure, or an error occurred, and the payment goes ahead.
Liability doesn’t generally shift (Stripe).
Fraud program
In the US, the Visa Secure Excessive Fraud Program applies when monthly fraud on domestic 3D Secure payments reaches $75,000 and a 0.9% fraud rate.
No fines, but no shift on domestic 3D Secure payments until the store fully exits (Stripe).
Not fraud
Not received, not as described, a canceled subscription: the shift doesn’t apply.
The standard dispute process applies.
Even when the shift holds, three things can still reach you. Early fraud warnings may arrive, along with a small share of fraud disputes. An inquiry on an authenticated charge still needs an answer, because a "no-reply" chargeback can invalidate the shift. And the monitoring programs keep counting, whoever carried the loss: fraud reports on authenticated payments go into Visa's VAMP ratio like any others (Visa), and Mastercard counts a chargeback regardless of liability shift (Stripe). Authentication moves the loss; on its own, it doesn't take the fraud out of either network's chargeback ratio.
Where 3D Secure is required: strong customer authentication in Europe
In the European Economic Area it's the law. PSD2, the EU's payment services directive, defines strong customer authentication, and a Commission delegated regulation sets the detailed rules and the exemptions, which the bank decides whether to apply (Directive (EU) 2015/2366, Regulation (EU) 2018/389). For online card payments, 3D Secure is how the requirement is met, and Stripe describes the same rule for the UK (Stripe). The rules in four numbers:
Strong customer authentication in four numbers
The regulation also exempts recurring payments of the same amount to the same payee after the first (Article 14), and payments to trusted beneficiaries (Article 13).
For a store, two catches matter. An exempted payment doesn't move the liability to the issuer, as the cases above show. And the scope is narrower than it looks: Stripe says SCA applies when both the business and the cardholder's bank are in the EEA, and that businesses based outside the EEA are out of scope. A US store charging a German card is a one-leg payment, not subject to SCA, but some European issuers may still decline it if it isn't authenticated. This is a summary, not legal advice.
Does a US supplement store need 3D Secure?
The US has no equivalent mandate. For a store selling to US cardholders, 3D Secure is optional and used mainly for the fraud liability shift. That makes it a risk tool, so the question is which orders it should cover. On every order, it can put a challenge in front of buyers you paid to bring to checkout. On none, every fraud dispute stays yours.
Four situations argue for it:
- A card issued in Europe. Its bank may decline an unauthenticated payment even though your business is outside SCA.
- The issuer or your processor asks. An issuer can answer with a soft decline such as Visa's code 1A, "Additional customer authentication required" (Stripe), and Stripe, for one, runs 3D Secure automatically when an issuer asks, when regulation requires it or when your fraud rules request it.
- The order shows fraud signals: billing, shipping and IP countries that don't agree, an order far above your usual size, a burst of attempts from one device. That last one can be a card-testing script at work, and Visa lists 3D Secure among its controls against card testing (Visa).
- Fraud is climbing. In Stripe's summary, Mastercard's Excessive Fraud Merchant program applies to online stores with at least 1,000 e-commerce Mastercard payments, more than $50,000 of net fraud volume and a fraud chargeback rate above 0.50%, that use 3D Secure on 10% of their Mastercard payments or fewer; its fines reach $100,000 from the 19th month (Stripe). Authenticating more than a tenth of payments takes you out of that profile, not out of Mastercard's chargeback program.
Walk any order through the same questions:
Should this order get 3D Secure?
For a US store; your processor’s rules come first
Was the card issued in the EEA or the UK?
Has the issuer or your processor asked for authentication?
A soft decline such as Visa’s code 1A, or a processor rule.
Does the order show a fraud signal?
Mismatched billing, shipping and IP countries, an unusually large order, many attempts in a short time.
Are fraud warnings or disputes rising on your account?
Best fit
Request 3D Secure
A card issued in the EEA or the UK. Your US business is outside SCA, but issuers there may decline unauthenticated payments.
Best fit
Authenticate, as asked
A non-European card, and the issuer or your processor asked. Run 3D Secure and try again rather than resending the same request.
Read more: Payment Authorization Rate: Declines and Retry Rules
Best fit
Request 3D Secure for this order
A non-European card and no request, but a fraud signal on the order. If it turns out to be fraud, an authenticated payment typically leaves the loss with the issuer.
Read more: Card Testing: How to Spot and Stop a Carding Attack
Best fit
Widen it where fraud concentrates
A non-European card, no request and no signal on this order, but fraud rising on your account. Turn 3D Secure on for the segment the fraud comes from: a country, a BIN range or a product.
Read more: Chargeback Ratio: How Visa and Mastercard Count It
Best fit
No 3D Secure request needed
A non-European card, no request, no fraud signal and fraud steady. Let it through without a challenge request, with the security code and address checks on.
Visa argues the upside with network-wide figures. It reports a 9% lift in authorization approval rates for transactions authenticated through Visa Secure (Q4 2023), and cites Datos Insights data showing "approximately a 45% reduction in fraud" on authenticated transactions, 11 basis points against 20 (Visa). Those describe Visa's network, not your store. The cost, buyers who give up at a prompt, depends on your buyers and your checkout. Stripe says only that the old 3DS1 "adds friction to the checkout flow and can lead customers to abandon the purchase", and that 3DS2's experience can help reduce the impact on conversion (Stripe).
So measure what it costs you. Change one rule at a time and compare orders per checkout for a few weeks before and after. In an illustrative week, 1,000 checkouts bring 350 orders before you widen 3D Secure and 340 after: the change costs 10 orders a week, and it pays only if the fraud losses it stops or moves to the issuer outweigh the margin on those orders. In RevvyScales, each VSL shows its CTA clicks next to the orders your checkout reports back, so a drop in orders per click after a 3D Secure change shows up VSL by VSL (conversion tracking).
3D Secure on subscriptions and rebills
A subscription has one moment when the buyer is present: the first order. Authenticate that one. Renewals are merchant-initiated transactions, charged under the agreement the buyer accepted without the buyer taking part (Stripe), and Stripe gives off-session payments as an example of payments that don't support 3D Secure. In the EU, an answer published by the EBA, prepared by the European Commission and not binding, says card payments initiated by the payee alone fall outside SCA, while setting up the mandate remotely requires it (EBA).
The first order, then, carries the renewals. Keep its authentication result with the terms the buyer accepted. A renewal disputed as a canceled subscription isn't a fraud dispute, so the shift wouldn't cover it anyway; the terms, the renewal notices and the cancellation records are what answer it.
What 3D Secure won't fix
It answers one question: whether the buyer is the cardholder. Disputes about a parcel that never came, a product that wasn't what the page promised or a subscription the buyer believed was canceled are fixed upstream instead, with tracking and honest delivery times, claims the product can live up to and plain subscription terms. Reducing chargebacks works through each of those reasons.
It doesn't make fraud free either. Authenticated payments that keep producing fraud reports can cost a US store the shift on its domestic 3D Secure payments. Treat 3D Secure as one layer among several: security code and address checks on every order, velocity limits against card testing, and quick refunds for buyers who complain before they call their bank.
Before you switch on 3D Secure
Run through this with your processor's settings open:
Before you switch on 3D Secure
0 of 9 done
Frequently asked questions
Can a 3D Secure payment still be charged back?
Yes. Authentication typically moves the liability for a fraud dispute to the issuer, but it doesn’t stop the cardholder from disputing. Disputes for other reasons, such as a product not received or not as described, go through the standard process, and Stripe says you may still receive early fraud warnings and a small share of fraud disputes on authenticated payments. Answer every inquiry, or a no-reply chargeback can undo the shift.
What is the difference between 3DS1 and 3DS2?
3DS2, also called EMV 3DS, is the current version. It sends the issuer data about the transaction, the card and the device, so low-risk payments can be authenticated without a prompt, and it works in browser and app checkouts. Stripe says major card brands no longer support 3DS1, and EMVCo, which maintains the specification, recommends version 2.2 or higher.
Does a frictionless 3D Secure payment get the liability shift?
Typically, yes. Stripe says frictionless authentications get the same liability shift as challenged ones, except when an exemption from strong customer authentication was requested, and Mastercard’s 2019 program guide puts liability for a successful acquirer exemption with the acquirer. Neither path is guaranteed: the shift covers fraud disputes only, and a US store can lose it in Visa’s fraud program for authenticated payments.
Does 3D Secure lower my chargeback ratio?
Not by itself. It typically moves the loss on fraud disputes to the issuer, but the monitoring programs keep counting: Visa’s VAMP counts every fraud report, apart from those that qualified for Compelling Evidence 3.0, and Mastercard counts chargebacks regardless of liability shift. Lowering the ratio means preventing fraud and the non-fraud disputes that 3D Secure doesn’t touch.
Why do some buyers get a code and others don’t?
The issuer decides from the data it receives. Visa says truly low-risk transactions are authenticated without a step, moderate-risk ones are challenged, with a one-time passcode or a biometric check for example, and high-risk ones are declined. A merchant can ask for a frictionless flow or a challenge, but Stripe says it can’t guarantee the preference, because the issuer determines the flow.
What does an “authentication required” decline mean?
It’s the issuer asking for authentication before it will approve. Visa’s response code 1A reads “Additional customer authentication required”, and processors treat it as a soft decline that can go through once the buyer is authenticated. Stripe, for example, runs 3D Secure automatically when an issuer asks this way and tries the payment again. Treat it as a request from the issuer, not a final no.
Sources
- EMV 3-D Secure — EMVCo
- 3D Secure: your guide to safer transactions — Visa
- Visa Secure with EMV 3-D Secure: data best practices guide (2024) — Visa
- Visa Dispute Management Guide for Merchants (October 2026) — Visa
- Mastercard Identity Check Program Guide (November 2019) — Mastercard
- Authenticate with 3D Secure — Stripe Docs
- 3D Secure 2 — Stripe guide
- Network decline codes — Stripe Docs
- Dispute and fraud card monitoring programs — Stripe Docs
- Visa Acquirer Monitoring Program Overview (fact sheet, 2025) — Visa
- Directive (EU) 2015/2366 (PSD2) — EUR-Lex
- Commission Delegated Regulation (EU) 2018/389 — EUR-Lex
- Strong Customer Authentication readiness — Stripe Docs
- Single Rulebook Q&A 2018_4031 — European Banking Authority
- Customer-initiated and merchant-initiated transactions — Stripe Docs
- Enumeration Mitigation and Considerations for Merchants (June 2026) — Visa