3D Secure, Explained for Online Merchants
What the 3D Secure screen at checkout is, how the check runs, and what it does and does not do for fraud and liability.
A customer is at your checkout. The card details are in. Then a screen appears asking for a code from their bank. That is 3D Secure at work, and here is what it means for you, the merchant.
What is 3D Secure?
3D Secure is a protocol that adds a security layer to card transactions. It is a global authentication protocol that adds a real-time identity check for online card payments. Visa built the first version. It formed the base for the standards used around the world today.
The point of the check is simple. 3DS helps cut fraud risk for you and your buyers. It checks that the buyer is the real card owner. It checks who the buyer is before the payment goes through. It looks at things like the device, the location, and past spending.
What the customer sees
During the check, the bank may ask the buyer for a password, a one-time code, or a fingerprint or face scan. Customers may know it by other names. Card networks brand it as Visa Secure, Mastercard Identity Check, or American Express SafeKey. Same process, different names. You can read more about the biggest one in Visa 3D Secure.
Not every 3DS transaction shows a challenge. Issuers might request different 3DS flow action types, which might not always result in visibly displaying a 3DS challenge. So a customer who never sees a code may still have gone through 3DS.
How a 3D Secure transaction works
The 3DS ecosystem is made up of three key stakeholders who work together. The issuer runs the identity check. The merchant's side sends the request and the data the issuer needs.
That data is where the value sits. 3DS gives banks a better view of the order. That helps them say yes to good sales they might have turned down.
Why it matters for online merchants
Selling online means card-not-present payments. Visa data shows card-not-present fraud rates are 7.5 times higher than card-present rates, accounting for nearly 89% of all payment fraud. Small and mid-size stores are targets for online fraud. They take many payments where the card is not present.
Using 3DS can cut down fraud chargebacks. It can also help customers trust your store. A fake sale that gets through can later turn into a chargeback.
Liability shift: what it does and does not cover
Here is the part merchants care about most. If a cardholder disputes a 3DS payment as fraudulent, the liability typically shifts from you to the card issuer. When the check passes, fraud risk goes down. The blame for a fraud claim can also move off you, the merchant.
But read that word "typically" carefully. Even when 3DS works, the shift is not a sure thing. There are exceptions, and a dispute can still land on you. Treat the shift as a strong default, not a promise.
Required or optional?
The card issuer decides if the buyer must pass the check. Stripe then starts the check. In some regions, regulation decides. Some places require it by law. One rule is called Strong Customer Authentication. On Stripe, 3DS turns on by itself there. You do not choose it there. It happens.
3DS is optional in other regions and you can use it to reduce fraud. If you sell into a region with a mandate, the check is not a choice. If you sell only where it is optional, turning it on is a fraud decision you make.
When you cannot use it
Not all transactions support 3DS, for example wallets or off-session payments. A wallet payment can skip the 3DS screen entirely. A recurring charge billed while the customer is away from your site has no one present to enter a code. So you cannot lean on 3DS for every sale, and your other fraud checks still matter.
When the check runs and the customer cannot pass it, the sale stops there. See 3D Secure authentication failed for what a failed check means and what to do with the order.
Where to learn more
If you accept 3D Secure credit card payments, read about 3D Secure 2 next.