Merchant guide

13 Oct 2026 · @AVP

3D Secure: what it is and how it protects your online payments

Card authentication for online payments: less fraud, fewer fraud chargebacks, and—when set up well—an experience buyers barely notice.

Whenever a customer pays by card without being in front of you, merchants face an uncomfortable question: is the payer really the cardholder? 3D Secure is the payments industry’s answer. Implemented properly, it reduces fraud, shifts liability for many chargebacks to the issuing bank, and in most cases the buyer never notices it is there.

This guide explains what it is, how it works in practice, and what it means for your business—without unnecessary jargon.

What is 3D Secure

3D Secure (3DS) is an authentication protocol for online card payments. Its job is simple: before approving a charge, the bank that issued the card checks that the payer is the legitimate cardholder.

The three domains of a payment

The name comes from the three “domains” involved in every payment:

  • The merchant and its payment gateway, which initiate the charge.
  • The card-issuing bank, which verifies the buyer’s identity.
  • The card network infrastructure (Visa, Mastercard, American Express, etc.) that connects both sides.

Each brand uses its own commercial name: Visa Secure, Mastercard Identity Check, or American Express SafeKey. They all follow the same standard.

Think of 3DS as the digital equivalent of asking for ID at the counter: the merchant does not do it—the customer’s bank does, because it knows them best.

How it works, step by step

It all happens in a few seconds, between the buyer clicking “Pay” and seeing confirmation:

  1. 1

    Enter card details

    The buyer enters their card on your website, on a payment link, or in your virtual terminal.

  2. 2

    The gateway sends the transaction

    The payment gateway sends transaction data to the issuing bank: amount, device, address, purchase history, and other signals.

  3. 3

    Risk analysis

    The bank analyses risk in real time.

  4. 4

    Low risk: frictionless

    If risk is low, it approves without asking for anything else. The buyer sees no extra step.

  5. 5

    Higher risk: verification

    If something does not add up, the bank asks for verification: an app notification, fingerprint, face recognition, or an SMS code.

  6. 6

    Authorisation

    Once identity is confirmed, the payment is authorised and marked as authenticated. If verification fails, the payment is declined and nothing is charged.

On both paths to authorisation, the payment is authenticated and the merchant gets the same protection.

3DS2, PSD2, and strong customer authentication

The first version of 3D Secure asked for a password on almost every payment, opened pop-ups, and worked poorly on mobile. Many buyers abandoned checkout. The current version, 3DS2, was built to fix that.

What changes with 3DS2

  • Decisions based on data. The bank receives much more payment context (device, history, amount, address) and assesses risk in milliseconds.
  • Two possible paths. If risk is low, it approves without asking the buyer anything—the frictionless flow. If something looks unusual, it asks for verification—the challenge flow.
  • Modern verification. The challenge is completed in the bank’s app, with fingerprint, face recognition, or an SMS code, without leaving the checkout page.

Why it is mandatory in Europe

The European PSD2 directive requires strong customer authentication (SCA) for online payments. The buyer must confirm their identity using two of these three factors:

  1. Something they know: a PIN or password.
  2. Something they have: their phone or card.
  3. Something they are: fingerprint or face.

3D Secure is how that requirement is met for card payments. If a payment that requires SCA does not go through 3DS, the buyer’s bank may decline it outright.

When authentication is not required

Regulation allows exemptions so low-risk payments are not blocked. The most common ones:

Exemption What it means
Low value Payments under €30, subject to cumulative amount and transaction limits
Low risk (TRA) The gateway assesses transaction risk and requests an exemption when it is low
Recurring payments Fixed instalments to the same merchant: the first is authenticated, later ones may not be
Merchant-initiated (MIT) Charges on a stored card that the merchant triggers as agreed with the customer
Trusted merchant The buyer whitelists the merchant with their bank
Out of scope Cards issued outside the European Economic Area and mail order / telephone (MOTO) payments

Important: requesting an exemption does not guarantee it. The issuing bank always has the final say and may still require authentication.

What your business gains with 3D Secure

  • Fewer fraud chargebacks—and you are not left holding the bill. When a payment is authenticated with 3DS, liability for a fraud chargeback (“I did not make this purchase”) shifts from the merchant to the issuing bank. That is liability shift. If the cardholder disputes fraud, the bank cannot charge the amount back to you.
  • Fewer declines. Under PSD2, many banks reject European payments that arrive without authentication. Using 3DS helps you avoid losing legitimate sales to an automatic “no”.
  • More buyer confidence. Seeing verification from their own bank reassures customers, especially on first purchase or high-value payments.
  • A checkout that stays almost invisible. With 3DS2, most low-risk transactions are approved without the buyer doing anything. Friction is reserved for payments that genuinely need it.
  • Less internal overhead. Every chargeback avoided is time you do not spend gathering evidence, responding to disputes, and reconciling refunds.

Note: liability shift covers fraud chargebacks. It does not cover disputes for other reasons—such as “product not received”, “service not as described”, or duplicate charges. For those, clear cancellation policies and proof of each sale still matter.

Frequently asked questions

Does 3D Secure make me lose sales?

With the old version, sometimes yes. With 3DS2, most payments are approved frictionlessly and challenges finish in seconds on mobile. Today you are more likely to lose a sale by not using 3DS (and having the bank decline it) than by using it.

Do I need to do something technical to turn it on?

No. Authentication is handled by the payment gateway. Your site, payment link, or virtual terminal only shows verification when the bank asks for it.

What if the buyer fails verification?

The payment does not complete and nothing is charged. The buyer can try again or use another card.

Does it apply to all cards?

Major brands: Visa, Mastercard, American Express, and other compatible schemes. It is not mandatory for non-European cards, but using it still adds protection.

What about Apple Pay or Google Pay?

These methods already include their own authentication (fingerprint, face, or device PIN), so they meet strong authentication without an extra step.

Can an authenticated payment still become a chargeback?

Yes—but if the reason is fraud, liability sits with the issuing bank, not your business. For other reasons (product not received, service not provided), the dispute follows the usual process.

3D Secure at Avirato Payments

At Avirato Payments, 3D Secure 2 is built into all online payments: website, payment links, and virtual terminal. Nothing to configure on your side.

  • Authentication when it is needed. Our platform sends the bank the data required so most transactions are approved frictionlessly.
  • Exemptions handled for you. We request applicable exemptions (low value, low risk, recurring) so customers take as few steps as possible.
  • Protection against fraud chargebacks. Authenticated payments benefit from liability shift to the issuing bank.
  • Real support. If you receive a dispute, our team helps you prepare your response.

Want to know how 3D Secure affects your payments or review your current setup? Get in touch and we will go through it with you.

Contact us