3D Secure explained: how it works and when to use it

3D Secure is an extra check at online checkout that lets the bank that issued the card confirm the buyer really is the cardholder before the sale goes through. Your gateway sends the issuer details about the order and the customer's device. Most of the time the issuer is satisfied and approves in the background. When it isn't, it asks the customer to prove who they are, usually with a one-time code or a tap in their banking app. EMVCo, the body that manages the chip card specifications, publishes the current version, EMV 3-D Secure, as a tool to help issuers and merchants verify the cardholder and prevent card-not-present fraud.

You'll see it written as 3D Secure, 3-D Secure, or 3DS. Visa calls its program Visa Secure, and Mastercard calls its program Identity Check. Whatever the label, merchants care for one reason: when an online sale turns out to be fraud, you usually eat the loss, and 3D Secure is the main tool the card networks give you to hand that loss back to the issuer. Below, we cover how it works, the two flows, the liability rules, what it does to conversion, and when we'd turn it on. Network rules are current as of October 2026.

How does 3D Secure work?

3D Secure runs between the moment your customer clicks Pay and the moment your gateway asks for authorization. It answers a different question. Authorization asks whether there's money or credit to cover the sale. Authentication asks whether the person paying is the cardholder. An online sale with 3D Secure goes like this:

1. The customer enters their card at your checkout.
2. Your gateway, or the 3D Secure service it connects to, sends an authentication request with details about the order, the customer, and the browser or app they're using.
3. The card network routes that request to the issuer.
4. The issuer scores the risk. If it's comfortable, it authenticates the buyer with no visible step. If not, it shows the customer a challenge.
5. The result comes back to your gateway, with proof of authentication when it succeeds.
6. Your gateway sends the normal authorization request, carrying that proof.
7. The issuer approves or declines the sale as usual.

Step 7 trips people up. Passing authentication doesn't guarantee an approval, because a real cardholder can still be over their limit. A decline at that point is an ordinary decline, not a 3D Secure failure. Our guide to what a payment gateway is covers the authorization half of the trip.

What is the difference between frictionless and challenge flows?

The frictionless flow authenticates the buyer in the background; the challenge flow stops and asks the buyer for something. EMVCo's guide to optimising authentication describes the frictionless flow as the issuer accepting a transaction after a real-time risk assessment, without challenging the cardholder. A transaction the issuer judges high risk goes to a challenge instead. EMVCo says that risk assessment draws on the transaction details, the cardholder's history and relationship with the merchant, the device used, and technical details such as device location or IP address.

That table explains why the data you send matters so much. The issuer can only go frictionless when it has enough to judge the risk. EMVCo says version 2.3 of the specification further enhances the exchange of data between merchants and issuers, so issuers can set the level of authentication without adding friction that isn't needed. A checkout that sends little more than a card number and an amount gives the issuer little to go on, and more of your customers land on a challenge screen.

Why 3D Secure had a bad reputation

If you tried 3D Secure years ago and hated it, there's a good chance you were on version 1. EMV 3-D Secure was published in October 2016, and Visa discontinued support for 3-D Secure 1.0.2 effective October 15, 2022. Any current setup should run EMV 3-D Secure. If a provider can't tell you which version it runs, find one that can.

Who is liable for fraud when you use 3D Secure?

When authentication succeeds, liability for fraud disputes generally moves to the issuer. Without it, the loss is usually yours. The US chip liability shift of October 1, 2015 doesn't help online, because Visa built it for counterfeit fraud on card-present transactions. These network rules apply the same way for merchants anywhere in the United States.

Each network writes its own rules. Visa's dispute guide for merchants sets out three outcomes for Visa Secure (Visa):

Mastercard words it more tightly. Its Identity Check guide says merchants receive the liability shift only for transactions submitted for authentication that receive a valid authentication value. Ask your acquirer how it treats Mastercard attempts before you count on protection there.

Two limits apply on every network. The protection covers fraud disputes, the "I didn't make this purchase" kind. A customer who says the parcel never arrived, or the item wasn't as described, is making a different claim, and 3D Secure does nothing for it. Our guides to friendly fraud and preventing chargebacks cover those.

What the liability shift is worth: an example

Take a made-up online cycling shop in Pittsburgh that sells a $480 wheelset costing it $300, plus $15 to ship. A fraudster buys one with a stolen card.

• Without authentication, the cardholder disputes the charge. The shop loses the $480 sale, and it's still out the $300 wheelset, the $15 shipping, and a chargeback fee (say $20). That's $335 out of pocket.
• With a successful Visa Secure authentication, the shop is protected from that fraud dispute and keeps the $480.

Each good wheelset sale earns $165 in gross profit ($480 minus $300 minus $15). One fraud loss of $335 wipes out the profit on about two good sales. That's the math that makes 3D Secure worth testing for anyone who sells expensive, easy-to-resell goods.

Does 3D Secure hurt conversion?

It can, but only at the challenge step, and how much depends on how often your customers get challenged. The frictionless flow adds no visible step, so it costs you nothing in lost sales. A challenge asks the customer to find their phone, open an app, or type a code, and some won't bother.

We're not going to quote an industry abandonment rate. Published figures come from different checkouts, countries, and versions of the protocol, and a number from someone else's store says little about yours. What you can do is measure three numbers on your own orders once 3D Secure is running:

1. Challenge rate: the share of authentication attempts that end in a challenge.
2. Completion rate: the share of challenged customers who finish and pay.
3. Fraud dispute rate on authenticated orders compared with orders that skipped 3D Secure.

Here's the trade-off in a made-up example. A store takes 2,000 online orders a month with $30 of gross profit per order, and it runs 3D Secure on every order. Say 6% get challenged (120 orders) and 15% of those customers abandon (18 orders). That's $540 a month in lost profit. If 3D Secure also prevents 10 fraud disputes a month that would each have cost $80 in goods, shipping, and fees, it saves $800. Net gain: $260 a month. Halve the fraud or double the challenges and the answer flips.

Mastercard's Identity Check guide recommends risk-based authentication, where the extra checks are saved for riskier transactions, and the example shows why. You can apply the same idea from your side: send complete data so more orders go frictionless, and point 3D Secure at the orders where your own fraud history says it pays.

When should you turn on 3D Secure?

Turn it on where fraud costs you more than an occasional abandoned checkout would. Here's how we'd decide, as a starting point rather than a rule:

The fourth row has teeth. Visa's acquirer monitoring program divides fraud reports plus disputes by settled card-not-present transactions, and in the US it labels a merchant excessive at a ratio of 1.5% or more from April 1, 2026, when the merchant also has at least 1,500 fraud reports and disputes in the month (Visa). Mastercard is more direct about 3D Secure. Under its security rules, once a merchant's card-not-present fraud passes 100 gross basis points, the acquirer must act, and for e-commerce that means capturing the CVC 2 code or enabling Identity Check (Mastercard).

The cycling shop above doesn't need 3D Secure on a $12 water bottle. It probably does on the wheelsets.

How do you set up 3D Secure without losing sales?

Most of the work is choosing rules and sending good data. The checklist we'd use:

1. Confirm your gateway supports EMV 3-D Secure, and ask which version it runs.
2. Send everything the issuer can use: billing and shipping addresses, email, phone number, and the browser or device data your gateway collects.
3. Decide which orders go through it: all of them, or only orders above a value, from first-time buyers, or with mismatched addresses.
4. Test the challenge screen on a phone, since that's where most customers will meet it.
5. Store the authentication result with each order, so you can show it if a fraud dispute arrives anyway.
6. Keep address verification, security code checks, and velocity rules running. 3D Secure sits on top of them.
7. After 30 days, compare challenge rate, completion rate, and fraud disputes with the month before.

Picture a made-up electronics reseller in Phoenix that switches 3D Secure on for orders above $250 and for any order shipping somewhere other than the billing address. Small accessory orders from returning customers go through as before. After a month, it checks the numbers from step 7 and widens or narrows the rule.

Step 6 deserves more than a line. Our guides to address verification and the CVV explain those two layers, and card testing fraud explains why velocity limits stay your main defense against bots. Clearo's online payments include fraud screening with AVS, CVV checks, and velocity rules, along with chargeback management tools for the disputes that still come in.

What doesn't 3D Secure do?

It's a narrow tool, so know its edges before you lean on it:

• It doesn't cover in-person sales. Chip and contactless handle the counter.
• It doesn't protect you from "item not received" or "not as described" disputes.
• It doesn't turn a declined card into an approval.
• It isn't your main defense against bots testing cards on a donation form or a $1 product. Velocity limits and bot checks are.
• It can't help on orders where your gateway never sent it, so spot-check that it's running where you think it is.

For the bigger picture, our ecommerce fraud prevention guide shows how 3D Secure fits with manual review and the other layers, and card-not-present transactions explains why online sales cost more to process in the first place. If most of your sales happen online, our page for ecommerce businesses covers the rest of the setup.

Common 3D Secure mistakes

• Switching it on for every order without ever checking the challenge rate.
• Sending thin order data, then blaming 3D Secure for the challenges.
• Assuming it covers every chargeback reason.
• Turning off AVS and CVV checks once it's live.
• Running an old version because nobody asked the gateway.
• Counting on Mastercard protection for attempts without confirming it with your acquirer.

Your next step

If fraud disputes or chargeback fees keep showing up on your statement, send us a recent one for a free statement review. We'll show you what fraud and disputes are costing you now, which makes the 3D Secure math above much easier to run. If you're setting up an online store and want a second opinion on your fraud rules, talk to us.