3-D Secure: when merchants should challenge a card payment
3-D Secure is the card-network protocol that lets the issuer check the person paying online is the real cardholder. Version 2 can approve quietly (frictionless) or ask for a challenge in a banking app. Merchants should score each payment first, challenge medium risk, decline clear fraud, and keep low-risk checkouts smooth.
Updated · RiskCogs team
Key facts
- EMV 3-D Secure 2 is the current protocol used by Visa Secure, Mastercard Identity Check and other brands.
- The issuer chooses frictionless or challenge based on data the merchant and gateway send.
- Successful authentication can shift liability for many fraud-coded chargebacks to the issuer.
- Challenging every payment hurts conversion; risk-based routing keeps friction where it helps.
How 3-D Secure works
When a shopper pays with a card online, 3-D Secure lets the card issuer authenticate the cardholder. EMV 3-D Secure 2 sends rich data about the device, browser, amount, shipping address and account history. The issuer then either approves without extra steps (frictionless) or asks the shopper to confirm in a banking app or with a one-time code (challenge).
Merchants do not pick the flow. Issuers do. Merchants decide whether to request authentication, whether to ask for an exemption where rules allow, and how much risk data to send so the issuer can decide well.
Frictionless flow vs challenge
- Frictionless: the issuer is satisfied by data alone; the shopper sees little or no extra step.
- Challenge: the issuer asks for proof, usually in a banking app or OTP.
- Exemptions: in some regions, low-value or low-risk payments can skip a challenge within regulatory limits.
- Liability: authenticated fraud disputes often move liability toward the issuer; service disputes usually stay with the merchant.
When to request 3-D Secure
- Score the payment before capture using device, network, card and history signals.
- Let low-risk returning customers through without a challenge when rules allow.
- Request 3-D Secure for medium risk instead of a hard decline.
- Decline clear fraud so it never reaches authentication or capture.
- Send chargeback and fraud outcomes back into your rules.
Merchant checklist
- Send complete 3DS data fields your gateway supports.
- Align challenge rules with your risk score bands.
- Watch challenge success rate and checkout drop-off separately.
- Do not treat 3-D Secure as a full fraud stack; it does not stop friendly fraud.
How RiskCogs works with 3-D Secure
RiskCogs scores each payment before you call your payment provider and returns a score from 0 to 100 with readable reasons. Teams typically approve under 40, send 40–69 to review or 3-D Secure, and decline from 70.
RiskCogs sits beside your payment provider and does not process payments. Plan details are on /pricing/.
See what you would have blocked — free shadow modeFrequently asked questions
What is 3-D Secure in simple terms?
It is a card-network check that the person paying online is the real cardholder. The issuer may approve quietly or ask for a challenge in a banking app. Merchants use it on riskier payments to cut fraud chargebacks and, for many fraud cases, to move liability to the issuer after successful authentication.
Does 3-D Secure stop all chargebacks?
No. It mainly helps with fraud disputes when authentication succeeds. It does not cover most service disputes such as goods not received, not as described, or hard-to-cancel subscriptions. Pair it with clear descriptors, easy refunds and risk scoring before capture.
Should I challenge every payment?
Usually no. Blanket challenges hurt conversion and still miss some fraud. Score first, challenge medium risk, decline clear fraud, and keep low-risk returning buyers on a smoother path when exemptions and issuer decisions allow.
Is 3-D Secure the same as SCA?
Strong Customer Authentication is the regulatory requirement in the EEA and UK for many online payments. 3-D Secure is the main card protocol merchants use to meet that requirement. Rules and exemptions differ by region, so follow your acquirer guidance.
Sources and related reading
- EMVCo, EMV 3-D Secure Protocol and Core Functions Specification (public materials).
- European Banking Authority, Regulatory Technical Standards on strong customer authentication (public).
- Visa and Mastercard public merchant materials on Visa Secure and Identity Check.