3-D Secure (3DS) is an EMVCo-standardised protocol that adds an authentication step to card-not-present payments. The merchant, the card network's directory and the issuer exchange data so the issuer can verify that the person paying is the legitimate cardholder.
Why it matters
When 3DS succeeds, liability for certain fraud-related chargebacks typically shifts from the merchant to the issuer, subject to network rules. The older version 1 always redirected the user to a bank page with a static password. Version 2 passes richer data such as device and order details, so low-risk payments can pass without any challenge ("frictionless") while risky ones trigger an OTP, biometric or app approval. Some regions, such as the EU under strong customer authentication rules, require it for many payments; others leave it optional.
Example
- A buyer enters card details at checkout.
- The gateway sends an authentication request with device and cart data.
- The issuer assesses risk and either approves silently or asks for a one-time code.
- After success, the gateway sends the authorisation with proof of authentication.
Common mistakes
- Treating 3DS as a guarantee against all chargebacks. Non-fraud disputes still occur.
- Blocking the challenge page in a webview or pop-up.
- Not handling the case where authentication fails or times out.
Rules vary by country; this entry is a definition only.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.