3D Secure (3DS)

3D Secure (3DS) is an authentication step for online card payments. The cardholder's bank asks them to confirm the payment, usually in a banking app, with a one-time code, or with a fingerprint or face scan. A successful check makes the payment harder to fake and can move chargeback liability away from the merchant.

The three domains

The "3D" stands for the three parties that exchange messages during an authenticated payment:

• Acquirer domain. The merchant's bank or payment processor.
• Issuer domain. The cardholder's bank, or issuer. It decides whether to challenge the cardholder.
• Interoperability domain. The card network systems that pass messages between the other two.

3DS2, the current version, sends the issuer more transaction data. The issuer approves low-risk payments without asking the cardholder anything. It only shows a challenge when the payment looks risky.

Liability shift

When 3DS authenticates a payment, the liability shift usually applies. The card issuer, not the merchant, then pays for fraud chargebacks on that payment. If a payment skips authentication under an exemption, the liability stays with the merchant or acquirer.

3DS and SCA

In Europe, 3DS is the main way merchants meet Strong Customer Authentication (SCA) under PSD2. SCA requires two independent authentication factors for many electronic payments, and 3DS provides them. Forcing a challenge on every payment adds friction and can lower conversion, so most merchants request 3DS only when the rules or the risk call for it.