The 3-D Secure Protocol, Explained Simply
What 3-D Secure is, who runs it, how the two flows work, and what it will and will not do for your store.
A customer types a card number into your checkout. The bank that issued the card wants proof the person holding the card is the real cardholder. The 3-D Secure protocol is how that proof gets collected without a phone call.
What is 3-D Secure?
3D Secure 2 is a set of rules for checking who is paying. It adds a check for online card sales, where you never see the card. In plain terms, it lets the card issuer check that the shopper is the real cardholder before the sale goes through. It applies to online card payments, where you never see the card or the person.
EMV 3DS enables the exchange of data between the merchant and the issuer, and the 3D Secure 2 page covers adding it.
You will also see the name EMV 3DS. That is the specification EMVCo maintains. Our page on EMV 3-D Secure covers the naming in more detail.
Who maintains the protocol
EMVCo owns and updates the EMV 3DS rules. It also works with the PCI Security Standards Council. Together they check that 3DS tools are safe. EMVCo suggests version 2.2 or newer. It works best.
Visa runs its own program on the protocol. Visa's program is called Visa Secure. It helps merchants and issuers confirm legitimate cardholders and reduce fraud. See Visa 3-D Secure for how one network brands it.
How the flow works: frictionless vs. challenge
A sale can take one of two paths. The bank picks a frictionless flow or a challenge flow. Here is the difference.
In a frictionless flow, the sale finishes with no extra step for the shopper. An EMV 3DS transaction uses consumer data to evaluate risk and prevent fraud. The issuer weighs the risk and approves. The customer never sees a prompt. EMV 3DS lets your store and the bank share this data. The bank uses it to check the shopper and approve the sale.
In a challenge flow, the issuer wants more proof. For riskier sales, the bank may ask for more proof. This can be a one-time passcode, security questions, or a fingerprint. The customer gets a prompt, answers it, and the sale proceeds or fails.
For a step-by-step walkthrough, see how does 3D Secure work.
3-D Secure and Strong Customer Authentication
Adyen recommends using 3D Secure 2 to comply with regulations that require strong customer authentication for online payments, such as PSD2 SCA.
The protocol fits the rule. EMV 3DS supports Strong Customer Authentication through two-factor login.
What it means for your checkout conversion
Merchants worry that an extra step will lose sales. EMVCo says EMV 3DS authenticates consumers without adding unnecessary friction to checkout.
A challenge flow requires additional shopper interaction, such as biometrics or two-factor authentication. Plan for that, and keep everything else in your checkout as easy as you can.
Implementation options: redirect vs. native
Adyen offers two ways to run the challenge step.
The redirect implementation sends shoppers to the card issuer's site. It takes the customer off your page, and Adyen's docs note it may lead to lower conversion rates.
The native option keeps the bank's check inside your own website or app. The customer sees a prompt without leaving your checkout.
Ask your provider which options it supports before you choose, and check its current pricing page for any cost differences.
What it does and does not do
EMV 3DS helps banks and stores stop online card fraud. It makes web payments safer. That is real.
But it does not stop all fraud. A real cardholder may later dispute a charge they do not know. A fraudulent sale can then turn into a chargeback. The protocol checks who the person is at checkout. It does not judge every order after the fact.
So use it as one layer. Keep your own order checks, your refund rules, and your fraud signals running alongside it. The protocol covers the card. The rest of the order is still yours to read.