Understanding 3-D Secure
The name 3-D Secure refers to three domains: the acquirer domain, which includes the merchant; the issuer domain; and the interoperability domain, which connects them through the card network’s infrastructure.
EMV 3DS is widely used for online card payments and can support Strong Customer Authentication (SCA) requirements in the UK and EU.
How 3-D Secure Works
When 3DS is used for an online card payment, the merchant’s
payment gateway or authentication provider sends relevant transaction and device information to the issuer. The issuer may complete authentication without additional customer input or request a challenge, such as a code or banking app confirmation. Authentication is separate from payment authorisation: even after successful 3DS authentication, the issuer may decline the payment.
The standard payment flow with 3-D Secure
A customer enters or selects their card details at checkout. The merchant’s payment provider initiates 3DS authentication. The issuer completes authentication without a challenge or asks the customer for additional verification. If the authentication outcome permits the payment to proceed, it is submitted for authorisation, and the issuer approves or declines it.
Who are the key participants in a 3DS transaction?
Key participants include the cardholder, merchant, issuer, acquirer and card network, supported by the technology providers that manage the 3DS authentication flow.
3DS Checkout: What the Customer Sees and What the Merchant Controls
A 3DS checkout is a card payment in which the issuer authenticates the cardholder with 3-D Secure before the payment goes to authorisation. For most customers the extra step is either invisible (a frictionless flow) or a short challenge, such as a banking app confirmation or biometric verification on the phone.
Frictionless flow and challenge flow
With EMV 3DS, the merchant sends transaction details and device data to the issuer's access control server. Using risk-based authentication, the issuer can approve low-risk transactions without interrupting the customer. Higher-risk payments trigger a challenge. Static passwords and one-off codes are being replaced by biometric authentication in many banking apps.
What merchants can control
Merchants can decide when to request 3DS, supply richer transaction data to help the issuer make a decision, and apply available exemptions for low-risk transactions where SCA rules allow them. Merchant-initiated transactions, such as recurring charges after the first authenticated payment, follow separate rules. Depending on card scheme rules, an authenticated payment can also change who bears the cost of fraud-related chargebacks (liability shift), which is one reason merchants use 3DS to reduce fraud exposure. Payneteasy's 3DS Adapter manages this flow for merchants on its payment gateway without adding extra steps for legitimate customers.
Potential Drawbacks and Limitations of 3DS
While 3-D Secure helps prevent fraud, it can sometimes make payments harder. If customers don’t get the code or their bank’s system is slow, they may leave the site without finishing the purchase. That’s why businesses need to update to EMV 3DS 2.x, which works better with phones and apps. EMV 3DS 2.x supports mobile app integration and frictionless authentication, but challenges and technical failures can still occur.
3DS 2.0: What’s New in the EMV 3DS Standard
3DS 2.0 (EMV 3DS) is the modern version of the 3-D Secure protocol, built to support mobile apps, biometrics, and risk-based authentication. Unlike the older 3DS 1.0, EMV 3DS supports richer data exchange and a frictionless flow, allowing the issuer to authenticate the cardholder without additional customer input when appropriate. This can reduce checkout friction and support SCA requirements, but it does not guarantee higher payment approval rates or automatically ensure compliance.
EMV 3DS can help merchants reduce unnecessary authentication steps and improve the mobile checkout experience. Payneteasy’s 3DS Adapter supports EMV 3DS 2.x and manages authentication flows as part of its white-label payment gateway.
3DS vs Other Security Methods
Unlike CVV or ZIP code checks, this technology requires real-time 3D Secure authentication. This makes it much harder for a criminal to complete a fake purchase. 3-D Secure is not always visible to the customer: frictionless authentication can complete without an additional verification screen. Current scheme programmes include Visa Secure and Mastercard Identity Check, which succeeded the earlier Mastercard SecureCode programme.
