.svg)
.svg)
.svg)
.svg)
.svg)
The unified orchestration layer for wallets and alternative payments
.svg)
The secure repository for all your payment methods
.svg)
Workflow-driven payments intelligence for smarter routing and higher auth rates
.svg)
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
The unified orchestration layer for wallets and alternative payments
The secure repository for all your payment methods
Workflow-driven payments intelligence for smarter routing and higher auth rates
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
3DS2 / EMV 3-D Secure
EMV 3-D Secure, universally called 3DS2, is the modern iteration of the 3D Secure (3DS) protocol, developed by EMVCo (the global technical body comprising Visa, Mastercard, Amex, Discover, JCB, and UnionPay) to replace the aging 3DS1 standard. 3DS2 was built from the ground up to address the failures of its predecessor: instead of static passwords and disruptive redirects, it uses a rich data exchange and risk-based decisioning that allows most transactions to authenticate silently, without any customer interaction.
The core technical improvement is data volume. Where 3DS1 passed a handful of data elements to the issuing bank, 3DS2 passes over 100, device fingerprint, browser characteristics, transaction history, shipping address consistency, billing address match, and dozens of other signals that give the issuing bank's Risk-Based Authentication (RBA) engine far more context for its approval decision. This richer data set enables Frictionless Authentication for the majority of transactions, reserving Step-Up Authentication challenges for genuinely higher-risk cases.
The current version is EMV 3DS v2.3.1, which introduced additional improvements over v2.2: support for FIDO-based WebAuthn and Secure Payment Confirmation (SPC) for biometric authentication, automated Out-of-Band (OOB) transitions to simplify banking app challenges, device binding (allowing consumers to register trusted devices for faster future authentication), richer recurring transaction data to improve decisions for subscription payments, and expanded support for authentication in mobile apps, IoT devices, and voice commerce. The sunset of 3DS v2.1 began in October 2024, with the market moving toward v2.3.
For merchants, 3DS2 is the mechanism for both Strong Customer Authentication (SCA) compliance in PSD2-regulated markets and for achieving Liability Shift on fraud-related chargebacks. Implementing 3DS2 through a well-integrated authentication provider, rather than building directly to the EMVCo specification, is the most practical path for most merchants.
Frequently Asked Questions
What is the difference between 3DS1 and 3DS2?
The differences are substantial across every dimension. 3DS1 relied on static passwords, redirected cardholders to issuer-hosted pages, was incompatible with mobile apps, passed minimal data to issuers, and was so frustrating to use that many cardholders abandoned transactions rather than complete authentication. 3DS2 uses dynamic, contextual data to make silent risk decisions, supports native mobile app authentication through SDKs, passes 100+ data elements to issuers, achieves approximately 85% frictionless authentication rates, and supports biometric challenge flows when challenges are necessary.
Does every gateway support 3DS2?
Not all gateways have equal 3DS2 implementations, and not all gateways support the latest version (v2.3.1). Support for specific features, frictionless exemption requests, device binding, WebAuthn challenges, merchant-initiated transaction handling, varies across gateway implementations.
How does 3DS2 handle subscription and recurring payments?
3DS2 and the MIT (Merchant-Initiated Transaction) framework work together for recurring billing. SCA is required for the initial authenticated transaction, the first payment in a subscription, where the cardholder sets up the recurring mandate. Subsequent merchant-initiated transactions, the automatic recurring charges, are exempt from SCA under the CIT/MIT framework, as long as the initial transaction was properly authenticated and the recurring mandate was established through a valid SCA flow.
Related Terms
