2DS - What It Means in Online Card Payments

In payment discussions, 2DS or 2D payment is sometimes used as shorthand for a card-not-present payment processed without EMV 3-D Secure authentication. It is not the name of an EMVCo protocol, and “Two-Domain Secure” should not be described as an official or simplified version of EMV 3DS.

What Does 2DS Usually Refer To?

When a processor or merchant uses the label, it normally means that card credentials are submitted and the payment proceeds to authorization without an EMV 3DS authentication exchange. The standard authorization route still applies: the request passes from the merchant side through the acquirer and card network to the issuer, which approves or declines it.

The issuer may consider available funds or credit, account status, transaction data, fraud signals, authentication information from other sources, and its own risk rules. Skipping 3DS does not remove the issuer, card network, or acquirer from the payment flow.

The “two-domain” explanation is therefore misleading. EMV 3DS defines the merchant/acquirer domain, issuer domain, and interoperability domain. A non-3DS payment does not create a formal two-domain protocol; it simply does not use the EMV 3DS authentication layer.

How Non-3DS Payments Differ from EMV 3DS

EMV 3DS allows the merchant side to send payment, device, and transaction data to the issuer for cardholder authentication. The issuer can complete the assessment without customer interaction or request a challenge, such as an in-app approval, biometric check, or one-time passcode.

Authentication and authorization remain separate. A successfully authenticated payment can still be declined during authorization because of insufficient funds, account restrictions, issuer risk controls, or other reasons.

Some qualifying 3DS transactions receive liability-shift protection for specified fraud disputes. That protection is not universal: it depends on the authentication result, card-scheme rules, transaction category, regional requirements, and any applicable exclusions. Non-3DS payments generally do not receive the liability benefit associated with a qualifying 3DS authentication.

When Can a Card Payment Proceed Without 3DS?

This depends on the market, regulation, issuer, acquirer, scheme, and transaction type. In the European Economic Area, Strong Customer Authentication may apply unless a payment is out of scope or an exemption is available and accepted. Even where 3DS is not legally required, an issuer or acquirer may still request it or decline the payment.

For glossary purposes, non-3DS card payment is the more accurate term. If the page retains “2DS” because the label appears in merchant searches or operational conversations, its non-standard status should be stated clearly.

Frequently Asked Questions

Is 2DS the same as 3DS?

No. EMV 3DS is a formally defined protocol that enables data exchange and cardholder authentication between the merchant and issuer domains. “2DS” is an informal label sometimes used for card-not-present payments processed without EMV 3DS; it is not a separate payment protocol.

Do non-3DS payments receive a 3DS liability shift?

Generally, no. Processing a payment without 3DS does not provide the liability protection associated with qualifying 3DS authentication. The final allocation of liability still depends on the card scheme rules, dispute reason, transaction type, authentication result, and market.

Why might a merchant process a payment without 3DS?

A payment may be processed without 3DS when the transaction is outside the scope of an authentication requirement, qualifies for an exemption, or follows a payment flow in which 3DS is not applicable. Avoiding an authentication challenge may reduce checkout friction, but it can also increase exposure to fraud, chargebacks, or issuer declines. The effect on conversion therefore depends on the transaction and market.

Can non-3DS card payments be processed in the EEA under PSD2?

Yes, in certain circumstances. A transaction may be outside the scope of SCA, qualify for an exemption, or use another compliant authentication method. If SCA is required but has not been completed, the issuer may decline the payment. EMV 3DS is the main card-industry mechanism used to support SCA, but 3DS and SCA are not the same concept.