3-D Secure
Also known as: 3DS, 3DS2, EMV 3DS, Verified by Visa, Mastercard Identity Check, Visa Secure
3-D Secure is the security step that sometimes pops up during an online card payment, asking you to approve the purchase in your banking app or enter a one-time code.
While shoppers often see it as an annoying interruption, modern versions approve most low-risk payments invisibly in the background. For merchants, it also moves liability for fraud to the card issuer.
3-D Secure, explained at three levels
At home
Sometimes when you buy something online, your bank asks you to confirm the purchase in its app or type a code it texts you. That's 3-D Secure. It's like a store clerk asking for ID on a big purchase, except your bank is doing the checking.
At work
Online businesses can turn on 3-D Secure through their payment provider. It helps prevent fraud with stolen card numbers, and when a payment is authenticated this way, the merchant is often protected if the cardholder later claims it was fraud.
At home
Most of the time you won't see a challenge at all. The store sends your bank information like your device, location, and purchase history, and your bank decides the payment looks normal. You only get asked to confirm when something seems unusual, such as a large purchase or a new device.
At work
EMV 3DS supports a 'frictionless flow,' where the issuer approves based on risk data, and a 'challenge flow,' where the customer must confirm. Sending richer data increases frictionless approvals. Merchants should monitor challenge rates and abandonment, since a poorly integrated 3DS step can cost more in lost sales than it saves in fraud.
At home
With 3DS2, the merchant or its provider collects device and transaction data and sends it to the issuer's access control server, which scores the risk. If a challenge is needed, it runs in your banking app or an embedded window, often using biometrics. In my opinion, the shift to app-based approval was the real fix, since one-time SMS codes can be intercepted or phished.
At work
The liability shift is the economic core: an authenticated transaction typically moves fraud chargeback liability from merchant to issuer, though exceptions and network rules vary. Merchants can request exemptions (low value, transaction risk analysis, merchant-initiated transactions) where regulation allows, trading liability for lower friction. Optimizing that trade-off by segment, rather than applying 3DS to everything, is where mature fraud teams earn their keep.
Real-world examples
At home
Marcus bought a laptop online from a new store. His bank's app pinged him to approve the $1,800 purchase with his face. He approved it, and the order went through. A week later, when someone tried to use his card number at another site, the bank's challenge stopped it.
At work
Nadia runs fraud prevention for an online ticket seller. She applied 3-D Secure challenges only to high-risk orders and let low-risk ones pass through the frictionless flow. Chargebacks dropped while checkout abandonment stayed flat.
How it compares
| feature | 3-D Secure 1 | 3-D Secure 2 (EMV 3DS) |
|---|---|---|
| Customer experience | Static password pop-up for nearly every payment | Often invisible; app approval when needed |
| Mobile support | Poor | Designed for apps and phones |
| Data shared with issuer | Minimal | Rich device and transaction data |
| Status | Retired by major networks in 2022 | Current standard |
| Impact on sales | High abandonment | Much lower when well integrated |
3-D Secure 2 keeps the security of version 1 while removing most of the friction.
For analysts
Treat 3-D Secure as a dial, not a switch. I'd measure fraud losses and checkout abandonment together, by customer segment, and tune when challenges fire. Turning it on for everything is the lazy choice and usually the expensive one.
History & origin
Visa developed 3-D Secure and launched it as Verified by Visa in 2001, with Mastercard following as SecureCode. The 'three domains' are the issuer, the acquirer, and the interoperability layer between them. The first version relied on static passwords and clunky pop-ups, and it hurt checkout conversion badly enough that many merchants avoided it. EMVCo published EMV 3-D Secure (version 2) in 2016, designed for mobile apps and risk-based authentication, and the major networks retired version 1 in 2022. Europe's Strong Customer Authentication rules made 3-D Secure close to mandatory for many online payments there. In my view, version 1 was a cautionary tale: security that people hate gets bypassed.