---
title: "3-D Secure"
url: "https://mahouse.world/glossary/3-d-secure"
type: "glossary term"
topic: "Payment security"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# 3-D Secure

3-D Secure is the card schemes' protocol for authenticating a cardholder during an online payment: the merchant's request passes to the issuer, which verifies the cardholder — once by a password on a pop-up, now by a banking-app prompt — and returns the result with the authorisation. Success shifts fraud liability to the issuer. The first version cost merchants a fifth of their conversions; version 2 rebuilt it.

**Also known as:** 3DS, Verified by Visa, Mastercard SecureCode, Payer authentication

## Key facts

- **Used at:** card-not-present payments — e-commerce, in-app — wherever the merchant wants liability shift or the regulation requires strong customer authentication; the three "domains" are the merchant/acquirer, the network, and the issuer
- **Binding:** the schemes' rules (Verified by Visa, Mastercard SecureCode, and their successors under EMVCo's 3DS specification); in Europe and the UK, SCA under PSD2 made authentication mandatory absent an exemption, which is what pushed the migration to version 2
- **Typical mechanics (v1):** the merchant redirects the customer to the issuer's page, the customer enters a static password, the issuer returns an authentication result, the merchant authorises with it attached; liability shifts on success and on issuers that did not participate
- **Typical problems (v1):** a redirect off the merchant's site, a forgotten password, no mobile design, no data for the issuer to risk-assess — abandonment rates of 10–25% and merchants who turned it off; the schemes retired v1 in 2022
- **Parties:** the merchant and its acquirer (the first domain), the network's directory server (the second), the issuer's access-control server (the third), and the cardholder

## How 3-D Secure works in practice

Version 1, as most merchants remember it: the customer enters card details and is redirected to a bank page asking for a password she set once and forgot. She abandons, or resets it, or gives up and uses PayPal. The merchant that enabled it saw fraud fall and conversion fall more, and many turned it on only for high-risk transactions. The liability shift — a chargeback for fraud on an authenticated transaction was the issuer's, not the merchant's — was the reason to endure it, and the reason issuers, who bore the cost, made the experience worse.

Version 2 kept the architecture and rebuilt the flow: the merchant sends the issuer a hundred data points about the transaction and the device, the issuer's risk engine decides whether to challenge at all, and if it challenges it does so in the banking app with a biometric, in a frame on the merchant's page rather than a redirect. Frictionless authentication — no challenge, liability still shifted — became the norm for low-risk transactions, and the SCA exemptions were built into the protocol. Adoption was forced by the regulation in Europe and by the schemes' retirement of v1 in October 2022.

For a merchant today "3DS" means version 2, and the questions are the challenge rate, the frictionless rate and the abandonment at challenge — the three numbers that decide whether authentication costs or saves sales.

## Example

An online retailer in 2019 runs 3DS 1 on transactions above €150: authentication rate 100% on those, abandonment 19%, fraud on the authenticated segment near zero and liability with the issuers. Below €150 it runs no authentication and absorbs 0.4% of fraud. Total cost: €2.6m of abandoned sales a year against €0.5m of fraud avoided. In 2021 it migrates to 3DS 2 ahead of the SCA deadline: authentication requested on everything, 70% frictionless, challenge abandonment 8% on the remaining 30%: total abandonment 2.4% of sales, fraud liability shifted on 95% of transactions, fraud losses down to 0.05%. The retailer's payments manager describes 3DS 1 as "the product that made us hate authentication" and 3DS 2 as "the product that made us not notice it".

## Common mistakes

- Still describing 3-D Secure by its first version's experience.
- Enabling authentication only above an amount, which fraudsters learned first.
- Reading the liability shift as fraud prevention; it is cost allocation, and the fraud still happened.
- Ignoring that issuers set the challenge experience; a merchant's data quality is what earns frictionless.
- Treating "3DS failed" as a decline rather than as a case for the exemption or retry logic.

## Related terms

- [3-D Secure 2](https://mahouse.world/glossary/3-d-secure-2.md)
- [Strong Customer Authentication](https://mahouse.world/glossary/strong-customer-authentication.md)
- [Frictionless Flow](https://mahouse.world/glossary/frictionless-flow.md)
- [SCA Exemption](https://mahouse.world/glossary/sca-exemption.md)
- [Chargeback](https://mahouse.world/glossary/chargeback.md)
- [Card-Not-Present Transaction](https://mahouse.world/glossary/card-not-present-transaction.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov