Table of contents

Understanding 3-D Secure
How 3-D Secure Works
Potential Drawbacks and Limitations of 3DS
3DS 2.0: What’s New in the EMV 3DS Standard
3DS vs Other Security Methods
FAQ

Do you have a question?

Contact author

Show all

Main
Glossary
What is 3DS (3-D Secure)

What is 3DS (3-D Secure)?

3-D Secure (3DS) is an authentication protocol for online card payments. It enables merchants and card issuers to exchange transaction and device data to help verify that the person paying is the legitimate cardholder. Authentication may happen without additional customer input or require a challenge, such as a one-time code or confirmation in a banking app. Successful 3DS authentication does not guarantee payment approval.

Table of contents

Understanding 3-D Secure
How 3-D Secure Works
Potential Drawbacks and Limitations of 3DS
3DS 2.0: What’s New in the EMV 3DS Standard
3DS vs Other Security Methods
FAQ

Do you have a question?

Contact author

Show all

Understanding 3-D Secure

The name 3-D Secure refers to three domains: the acquirer domain, which includes the merchant; the issuer domain; and the interoperability domain, which connects them through the card network’s infrastructure. EMV 3DS is widely used for online card payments and can support Strong Customer Authentication (SCA) requirements in the UK and EU.

How 3-D Secure Works

When 3DS is used for an online card payment, the merchant’s payment gateway or authentication provider sends relevant transaction and device information to the issuer. The issuer may complete authentication without additional customer input or request a challenge, such as a code or banking app confirmation. Authentication is separate from payment authorisation: even after successful 3DS authentication, the issuer may decline the payment.

The standard payment flow with 3-D Secure

A customer enters or selects their card details at checkout. The merchant’s payment provider initiates 3DS authentication. The issuer completes authentication without a challenge or asks the customer for additional verification. If the authentication outcome permits the payment to proceed, it is submitted for authorisation, and the issuer approves or declines it.

Who are the key participants in a 3DS transaction?

Key participants include the cardholder, merchant, issuer, acquirer and card network, supported by the technology providers that manage the 3DS authentication flow.

Potential Drawbacks and Limitations of 3DS

While 3-D Secure helps prevent fraud, it can sometimes make payments harder. If customers don’t get the code or their bank’s system is slow, they may leave the site without finishing the purchase. That’s why businesses need to update to EMV 3DS 2.x, which works better with phones and apps.

3DS 2.0: What’s New in the EMV 3DS Standard

3DS 2.0 (EMV 3DS) is the modern version of the 3-D Secure protocol, built to support mobile apps, biometrics, and risk-based authentication. Unlike the older 3DS 1.0 — which often forced a clunky redirect to the issuer’s page — 3DS 2.0 lets the issuer score each transaction and approve low-risk payments without prompting the cardholder. That “frictionless flow” improves approval rates while keeping fraud protection strong, and it’s mandatory under PSD2 Strong Customer Authentication (SCA) in the EU.

For merchants, supporting EMV 3DS 2.0 means fewer abandoned carts, better mobile UX, and a smoother path to compliance. Payneteasy’s 3DS Adapter handles the full 3DS 1.0 / 3DS 2.x lifecycle — authentication, fallback, and analytics — so you don’t have to integrate each card scheme individually.

3DS vs Other Security Methods

Unlike CVV or ZIP code checks, this technology requires real-time 3D Secure authentication. This makes it much harder for a criminal to complete a fake purchase. Compared to other methods like device tracking, 3-D Secure is direct and visible to the user, which builds trust. Scheme-branded implementations such as Mastercard SecureCode and Visa Secure are both built on the same 3-D Secure framework described above.

Frequently Asked Questions

Is 3-D Secure mandatory for all online transactions?

No. In the UK and EU, Strong Customer Authentication (SCA) requirements apply to in-scope payments, subject to exemptions. EMV 3DS is a common way to support SCA for online card payments. Card schemes and issuers may also require authentication.

Can 3DS cause payment declines?

Yes. A payment may fail if required authentication is unsuccessful, the customer abandons the challenge, or a technical error occurs. Successful 3DS authentication does not guarantee payment approval: the issuer may still decline the payment during authorisation.

How do I know if a website uses 3-D Secure?

You may see a verification screen or receive a request from your bank to confirm the payment. However, 3DS can also complete without additional customer input, so the absence of a verification screen does not mean that 3DS was not used.

What if a customer fails the 3DS authentication?

If successful authentication is required, the payment cannot proceed without it. The customer may need to retry authentication or choose another payment method.

Is 3-D Secure available for all card networks?

Not all card networks support 3DS. Major networks, including Visa and Mastercard, have 3DS programmes, but availability for a particular card depends on the issuer and the payment provider's integration.

What is 3D Secure authentication?

3D Secure authentication is the process through which the issuer checks whether the person making an online card payment is the legitimate cardholder. It may complete without additional customer input or require a code, biometric check or banking app confirmation. Authentication is separate from payment authorisation.

What is 3DS 2.0 and how is it different from 3DS 1.0?

Unlike 3DS 1.0, it supports richer data exchange, risk-based authentication, frictionless flows and mobile app integration. It can support SCA requirements, but using 3DS does not automatically ensure compliance.

What is 3D Secure 2.1 and how does it change gateway authentication?

3D Secure 2.1 added delegated authentication and decoupled authentication to the EMV 3DS 2.0 spec. A payment gateway that supports 3DS 2.1 can let a trusted wallet complete authentication on the issuer's behalf, or verify a cardholder out-of-band for merchant initiated transactions — reducing redirects while keeping the liability shift.

Does 3D Secure work on mobile apps?

Yes. EMV 3DS supports app-based authentication through a 3DS SDK. Depending on the issuer and integration, a challenge may appear within the merchant app or require switching to a banking app. Biometrics are one possible authentication method.