Answer
What is 3D Secure?
Quick answer
3D Secure is an extra security check for online card payments: the customer's card issuer confirms it is really them, often invisibly and sometimes with a code or banking-app approval. If an authenticated payment is later disputed as fraud, liability usually shifts from the business to the issuer.
Updated October 2026. Evergreen page — refreshed in place as facts change.
- Liability shift
- To the issuer
- On authenticated fraud disputes, usually
- Current version
- 3DS2
- 3DS1 retired by Visa and Mastercard, Oct 2022
- Usual outcome
- Frictionless
- Most 3DS2 checks show the customer nothing
- If challenged
- App or code
- Banking-app approval, one-time code or biometric
- US requirement
- None
- Using it is a business decision
- EEA and UK
- Required
- Strong Customer Authentication on many payments
- Low-value exemption
- Under €30
- Until 5 in a row or €100 in total
- On Anytime Capital
- Your amount
- 3D Secure above a threshold you set
Most customers have met 3D Secure without knowing its name: the moment a checkout hands over to their bank's app, or asks for a one-time code, before the payment goes through. For a business it is the most direct tool against the costliest kind of chargeback, the one where the cardholder says they never made the purchase.
Payment methods on this page
How does 3D Secure work?
When a customer pays online, the checkout sends the payment and details about it (the device, the browser, the amount, the shipping address) to the card issuer before asking for authorization. The issuer scores the risk. If it is confident, it authenticates the payment silently, which is called the frictionless flow. If it is not, it challenges the customer to prove it is them, usually by approving the payment in the banking app, entering a one-time code, or using a fingerprint or face check.
The name comes from the three domains involved: the issuer's (the customer's bank), the acquirer's (the business's side) and the network that connects them. The current version, often called 3DS2, shares far more data with the issuer than the original did, which is why most authenticated payments now go through without the customer seeing a challenge.
| Frictionless flow | Challenge flow | |
|---|---|---|
| What the customer sees | Nothing extra; the payment completes | A prompt from their bank: app approval, one-time code or biometric check |
| When it happens | The issuer is confident from the data it received | The issuer wants proof, often on larger, unusual or first-time payments |
| Effect on checkout | None | A few seconds, and some customers abandon at this step |
| Fraud liability if disputed | Usually shifts to the issuer once authenticated | Usually shifts to the issuer once authenticated |
A 3D Secure check, step by step
- 1
Customer pays
Card details entered at an online checkout.
Checkout - 2
Data to issuer
Device, browser, amount and address go to the card's issuer.
Behind the scenes - 3
Issuer scores
It weighs the risk of this payment for this cardholder.
Risk check - 4
Pass or prove
Low risk passes silently; higher risk gets a challenge.
Frictionless or challenge - 5
Authenticated
An authentication value is attached to the payment.
Liability shift - 6
Authorized
The payment is then approved or declined as usual.
Seconds
What is the 3D Secure liability shift?
Normally, when a customer's bank accepts a fraud dispute on an online payment, the business loses the sale and usually pays a dispute fee. If the payment was authenticated with 3D Secure, liability for that fraud dispute usually shifts to the issuer instead, because the issuer confirmed the cardholder.
The shift is about fraud, not every dispute. A customer who says the goods never arrived, or were not as described, can still file a chargeback on an authenticated payment, and the usual evidence rules apply. Card-network rules also carve out exceptions by business type and transaction, so treat the shift as strong protection for fraud claims rather than a guarantee.
| Situation | Fraud dispute ('I didn't make this') | Other disputes (not received, not as described) |
|---|---|---|
| No 3D Secure | The business | The business, unless its evidence wins |
| Authenticated, frictionless | Usually the issuer | The business, unless its evidence wins |
| Authenticated after a challenge | Usually the issuer | The business, unless its evidence wins |
| SCA exemption applied instead | Usually the business's side, since the issuer did not authenticate | The business, unless its evidence wins |
What do the card networks call it?
3D Secure is one standard, but each card network brands its version. A customer may see any of these names during checkout, depending on their card.
| Card network | Program name |
|---|---|
| Visa | Visa Secure (formerly Verified by Visa) |
| Mastercard | Mastercard Identity Check (formerly SecureCode) |
| American Express | American Express SafeKey |
| Discover | ProtectBuy |
Is 3D Secure required?
In the US, no law requires it; whether to use it is a business decision. In the European Economic Area and the UK, Strong Customer Authentication rules require two-factor authentication on many online card payments, with exemptions such as low-value payments, and 3D Secure is the main way to meet them. A US business selling to European customers will see challenges on some of those cards whatever its own settings.
Apple Pay and Google Pay payments are confirmed on the customer's device with a fingerprint, face or passcode, which is one reason wallet payments rarely need a separate 3D Secure step.
What are the exemptions from Strong Customer Authentication?
Strong Customer Authentication, under the EU's second Payment Services Directive and the UK's equivalent rules, has applied to online card payments in the European Economic Area since the start of 2021 and in the UK since March 14, 2022. It comes with exemptions and exclusions, so not every European payment is challenged.
Exemptions are requests, not rights: the customer's bank can still insist on a challenge. And a payment that goes through on an exemption generally does not carry the liability shift, because the issuer did not authenticate it, which is the trade a business makes for a smoother checkout.
| Exemption or exclusion | When it applies | Who asks for it |
|---|---|---|
| Low value | Payments under €30 (£25 in the UK), until five in a row or €100 (£85) since the last authentication | The business's provider |
| Transaction risk analysis | Low-risk payments from providers with low fraud rates, up to set amounts | The provider or the issuer |
| Merchant-initiated (excluded) | Renewals and other charges the business starts after an authenticated setup | The business, through its provider |
| Trusted beneficiary | The customer has added the business to an allow-list at their bank | The issuer |
| Secure corporate payments | Dedicated corporate processes, such as virtual cards in travel systems | The issuer |
| One leg out (excluded) | Cards issued outside the EEA or UK, or businesses acquired outside it | Not covered by SCA |
When should a business require 3D Secure?
Every challenge costs a little conversion, so the usual approach is targeted: require 3D Secure where a fraudulent order would really hurt, and let smaller, routine payments through without the extra step.
- Above an amount where one fraudulent order would wipe out the margin on many good ones
- On goods that are easy to resell, such as electronics, gift cards and luxury items
- On first orders from new customers, or cards issued in countries you rarely sell to
- Temporarily, after a spike in fraud disputes, while you work out what changed
Do saved cards and subscriptions need 3D Secure?
Usually only at the start. When a customer saves a card or begins a subscription, that first payment can be authenticated, and the provider keeps a reference to it. Later charges the business starts itself, such as a monthly renewal, are flagged as merchant-initiated and normally go through without a new challenge, in Europe as well as the US.
Two exceptions are worth knowing. An issuer can still ask for authentication on a renewal, for example when the amount changes sharply, and a returning customer who pays at checkout with a saved card is making a customer-initiated payment, which can be challenged like any other. For a subscription business, the practical rule is to authenticate the setup and let renewals run.
How do you tell whether 3D Secure is working for you?
Start with a threshold near your average order or a little above it, look at a month of results, then move it. Four numbers tell you whether the extra step is paying for itself:
- Challenge rate: the share of authenticated payments that got a challenge; a sudden rise means issuers see more risk
- Drop-off at the challenge: customers who left instead of approving
- Approval rate on payments above your threshold, against the same amounts before you set it
- Fraud disputes above and below the threshold, month by month
How 3D Secure works in Anytime Capital Payments
In Settings → Risk you set an amount, and card payments above it ask the customer to confirm with their card issuer; smaller payments go through with no extra step. It sits alongside the 0–100 risk score every card payment gets before it is charged, the option to block high scores, cards from countries you choose and payments above a maximum, and pre-dispute alerts that can refund small payments automatically before they become chargebacks.
All of it is included with Anytime Capital Payments rather than sold as an add-on. Our rate is on the pricing page.
Frequently Asked Questions
Does 3D Secure stop all chargebacks?
No. It protects against fraud disputes, where the cardholder says they did not make the payment, because liability usually shifts to the issuer once a payment is authenticated. Disputes for goods not received or not as described can still be filed, and need evidence such as proof of delivery.
Does 3D Secure hurt conversion?
Only when the customer is challenged, and with 3DS2 most authenticated payments go through without a challenge. Some customers do abandon at a challenge, which is why many businesses require 3D Secure only above an amount or on riskier orders rather than on everything.
What is the difference between 3D Secure 1 and 3DS2?
The original version sent customers to a separate password page on almost every payment and lost many sales. 3DS2 shares much more data about the device and the purchase with the issuer, so most payments are approved silently, and challenges work inside banking apps and on phones.
Do recurring payments need 3D Secure every time?
Usually not. The customer typically authenticates when they first save their card or start the subscription; later payments the business starts itself, such as a monthly renewal, generally go through without a new challenge, though an issuer can still ask for one.
What happens if a customer fails 3D Secure?
The payment is not completed. The customer can try again, use a different card, or pay another way, such as Apple Pay, Google Pay or a bank payment where the business offers it.
Is 3D Secure the same as the CVV code?
No. The CVV is the three- or four-digit code printed on the card, checked during authorization. 3D Secure is a separate step in which the card issuer itself confirms the cardholder, often through their banking app.
Can I turn 3D Secure off for European customers?
Not entirely. Under Strong Customer Authentication rules in the EEA and the UK, the customer's bank decides whether a payment needs authentication, so cards issued there can be challenged whatever your own settings, unless an exemption applies and the bank accepts it.
Keep reading
Important Disclosures
- Third-party fees and product details cited on this page are each company's published US pricing, or industry-typical ranges, as of the date shown and may have changed. Check current pricing with the provider before you decide.
- Information on this page is general and educational — it is not financial, legal, or tax advice.
- Anytime Capital is a fintech company, not a bank. Payment processing, banking and payout services are provided by Anytime Capital's licensed partners. Rates shown are for US card payments; international cards, currency conversion and disputes may carry additional fees shown in your dashboard before you accept a payment.