3D Secure

What it means

3D Secure is a protocol that adds an extra step to online card payments between the customer and the merchant: the bank that issued the card. The customer confirms the payment in the bank’s mobile app, with a fingerprint or a one-time code, and only then is the transaction authorised. The card schemes market it as Visa Secure or Mastercard Identity Check.

In the EU payment authentication is mandatory under PSD2, which requires strong customer authentication. 3D Secure is the technical way to meet it for cards. The current version, 3DS2, sends the bank more data about the purchase, so for low-risk payments the bank can approve without the customer actively confirming.

What matters to the merchant is the liability shift. If a payment was authenticated through 3D Secure and it later turns out a fraudster used the card, the loss generally falls on the card-issuing bank rather than the online store. Without authentication, the merchant would lose the money in a fraud dispute.

How it works in practice

An online store rarely sets up 3D Secure itself. The payment gateway switches it on and shows the customer the whole authentication flow. When choosing a gateway we recommend checking that it supports 3DS2, which exemptions it can use for small amounts or recurring payments and how it reports the liability shift.

With subscriptions and recurring payments the first payment is authenticated and later ones are charged without the customer as merchant-initiated transactions. If this is set up wrongly the bank may decline the later payments, and the merchant learns about it only from unpaid orders.

For the accounts, 3D Secure changes nothing about how revenue is recorded. It does change the risk: fewer successful chargebacks mean fewer correcting entries, credit notes and disputes that otherwise cost time and money.

What to watch out for

Authentication set too strictly puts customers off and lowers the conversion rate, especially on mobile where people must switch between apps. The opposite mistake is disabling authentication for larger amounts to make buying easier, but then the merchant takes on the fraud risk.

3D Secure protects against misuse of a stolen card, not against every dispute. If a customer claims goods were not delivered or were faulty, authentication does not help and the merchant must prove delivery. It is worth keeping proof of dispatch and receipt at least for the period in which the cardholder can dispute the payment.