3D Secure (3DS)

3D Secure (3DS) is an authentication protocol designed to reduce fraud in card-not-present transactions by adding an identity verification step between the cardholder and their issuing bank during the checkout process. The "3D" refers to the three domains involved in the protocol: the merchant's domain (the acquiring bank and payment gateway), the issuer's domain (the cardholder's bank), and the interoperability domain (the card network infrastructure connecting them).

The protocol originated with Visa in 1999 under the brand "Verified by Visa" and was adopted by Mastercard as "SecureCode," American Express as "SafeKey," and other networks under their own brand names. These original implementations, now collectively called 3DS1, required cardholders to enter a password before completing a transaction, a process that introduced friction and contributed to cart abandonment without delivering proportionate fraud protection.

The modern implementation, 3DS2 / EMV 3-D Secure, replaced 3DS1 in all major markets and transformed the protocol from a clunky password step into a sophisticated, data-rich authentication flow. Rather than asking cardholders for a password, 3DS2 sends over 100 data elements about the transaction and device to the issuing bank, which uses Risk-Based Authentication (RBA) to decide whether to approve the transaction silently (Frictionless Authentication) or request additional verification (Step-Up Authentication).

3DS has two significant commercial consequences beyond fraud reduction. First, it is the technical mechanism through which merchants comply with Strong Customer Authentication (SCA) requirements under PSD2 in the European Economic Area and UK. Second, it triggers a Liability Shift for qualifying transactions: when a transaction passes 3DS authentication, liability for fraud-related chargebacks shifts from the merchant to the issuing bank.