What Is 3D Secure (3DS) and Does Your Business Need It?

So what is 3D Secure? It's an authentication step for card-not-present transactions that verifies a cardholder's identity with their bank before a payment goes through. Visa brands its own implementation Visa Secure, built on the current EMV 3-D Secure (3DS2) standard (Visa), and its biggest practical benefit for a merchant is a liability shift: use it correctly, and fraud liability on a disputed transaction generally moves from the merchant to the card-issuing bank instead.

How 3D Secure Actually Works#

When a customer checks out, the merchant's system sends transaction data to the card-issuing bank through the 3DS network. EMVCo, the organization that owns the 3-D Secure specification, defines two possible outcomes (EMVCo):

• Frictionless flow: the issuing bank reviews risk data in real time and approves the transaction silently, with no extra step for the customer.
• Challenge flow: the issuer decides it needs direct confirmation from the cardholder, a one-time passcode, biometric verification, knowledge-based questions, or another method, before authorizing the sale.

That second flow is the friction merchants worry about. It's also the mechanism that makes the liability shift work: real cardholder confirmation is what gives the issuer confidence to accept fraud risk on that transaction.

Why the Liability Shift Is the Real Reason to Care#

Here's the mechanism in plain terms. When a transaction is successfully authenticated through 3DS and the issuer returns a valid authentication result, fraud liability on that specific transaction generally shifts from the merchant to the card-issuing bank. If the cardholder later disputes it as unauthorized, the issuer absorbs that loss instead of the merchant eating a chargeback.

That protection is narrower than it sounds, though, and it's worth being precise about the limits. The liability shift only applies to fraud-related disputes, not to other reasons a customer might file a chargeback, like a product never arriving or not matching its description. It also doesn't apply if the merchant uses an exemption to skip full authentication instead of running it. Skip the authentication step to reduce friction, and the liability stays with the merchant, exactly where it would sit without 3DS at all.

3DS1 vs. 3DS2: Why the Newer Version Matters#

The original 3D Secure protocol (3DS1) redirected every customer to a separate verification page, no exceptions, which created real cart abandonment risk on every single transaction. EMV 3-D Secure (3DS2) fixed the core problem by adding the frictionless flow described above, exchanging far more risk data behind the scenes so most legitimate transactions never see a challenge screen at all. The challenge flow still exists for genuinely risky transactions, but it's the exception now, not the default.

Europe Mandates This. The US Doesn't.#

This is the single biggest difference in how 3DS gets used depending on where a business operates. In the European Union, PSD2's Strong Customer Authentication requirement came into force on September 14, 2019, requiring two-factor verification (from something the customer knows, has, or is) on most electronic payments, including e-commerce card transactions (European Commission, 2019). That's a legal requirement enforced by national regulators, not a merchant's choice.

The US has no equivalent regulation. Whether a US merchant uses 3DS at all, and on which transactions, comes down entirely to card network program rules and the merchant's own risk tradeoff, not a legal mandate. That's exactly why the decision deserves real thought instead of a default answer.

The Honest Tradeoff: Fraud Protection vs. Checkout Friction#

A challenge flow adds a real step to checkout, and that step can cost a business a sale if a legitimate customer abandons rather than completes it. Vendor claims about exactly how much conversion this costs vary wildly and rarely cite real methodology, so treat any specific percentage you see quoted with real skepticism. What's true directionally, without needing an invented number to prove it: more challenge flows generally means more friction, and frictionless-flow-eligible transactions get the liability-shift benefit with essentially none of the downside.

On the fraud-reduction side, the most concrete figure available comes from Visa itself, though it's dated: in 2021, Visa reported EMV 3DS transactions in the US carried 35% lower fraud rates than non-3DS transactions (PYMNTS, 2021, reporting Visa data). That's a real, network-sourced number, even if it's a few years old now, and it's consistent with the underlying logic: authenticated transactions carry less fraud risk than unauthenticated ones by design.

When 3DS Genuinely Makes Sense for a High-Risk Merchant#

A business with elevated dispute exposure, large average ticket sizes, or a history of friendly fraud is exactly the profile where the liability shift matters most, since those are the businesses losing the most to chargebacks in the first place. Pairing 3DS with a broader fraud prevention strategy rather than treating it as a standalone fix gets the most value out of it: 3DS handles authentication-eligible fraud risk, while other tools cover what 3DS structurally can't touch, like non-fraud disputes and delivery issues.

A business running mostly low-risk, low-ticket transactions with a clean dispute history may reasonably decide the friction isn't worth it for every sale. This isn't an all-or-nothing decision either. Many merchants apply 3DS selectively, on higher-risk transactions specifically, rather than across the board.