Introduction
3D Secure (3DS) plays an important role in protecting online card payments. According to the Merchant Risk Council's 2026 Global eCommerce Payments and Fraud Report, payment fraud accounts for approximately 3.2% of merchants' annual eCommerce revenue globally.
For businesses accepting online payments, stolen card details can result in unauthorized purchases, financial losses, and payment disputes. Finding ways to verify cardholders without adding unnecessary steps to checkout has become an important part of payment security.
3D Secure addresses this challenge by adding cardholder authentication to online transactions. It allows issuing banks to assess transaction risks and request additional verification when necessary, while allowing many lower-risk payments to proceed without interrupting the customer.
What Is 3D Secure?
3D Secure is an authentication protocol designed to protect online credit and debit card transactions. It allows merchants and card issuers to exchange transaction information to help verify that the person making a purchase is authorized to use the card.
The name comes from the three domains involved in the authentication process:
- Acquirer Domain:Covers the merchant, acquiring bank, and related payment processing systems.
- Issuer Domain:Involves the bank or financial institution that issued the card.
- Interoperability Domain:Provides the infrastructure that connects participants and supports the exchange of authentication messages.
Major 3D Secure Authentication Services
Major card networks offer their own authentication services based on the 3DS protocol.
- Visa Secure:Visa's authentication service for online card transactions.
- Mastercard Identity Check:Mastercard's solution for verifying cardholders during online payments.
Although these services have different names, they share the same purpose: helping issuers verify cardholders and reduce unauthorized online transactions.
What Is EMV 3-D Secure 2.x?
EMV 3DS is the modern version of the protocol, developed to improve security while reducing interruptions during checkout.
Compared with earlier versions, 3DS 2.x supports the exchange of more detailed information, including:
- Transaction amounts and payment details.
- Cardholder and account information.
- Device and browser information.
- Merchant and previous transaction data.
Issuers can use these details to assess risk before deciding whether additional verification is necessary. This allows many legitimate payments to be authenticated in the background without requiring customers to enter an OTP or approve a notification.
How Does 3D Secure Work?
When a customer pays online, the merchant's payment system sends relevant transaction information through the 3DS infrastructure. The card issuer reviews the information and decides whether the transaction can be authenticated without customer interaction or requires additional verification.
The 3D Secure Authentication Process
A typical transaction involves the following steps:
- Payment Initiation:The customer enters card details and submits the purchase.
- Information Exchange:The merchant sends transaction and device information through the 3DS infrastructure.
- Risk Assessment:The issuer reviews the available information and evaluates the transaction.
- Authentication:The transaction follows either a frictionless or challenge flow.
- Authentication Result:The result is returned to the relevant payment participants.
- Payment Authorization:The transaction proceeds to authorization, where the issuer decides whether to approve or decline it.
The main difference between the two authentication flows is whether the customer needs to take additional action.
Frictionless Flow: Authentication Without Extra Steps
A frictionless flow allows the issuer to authenticate a transaction without asking the customer to complete additional verification.
For example, a customer making a routine purchase from a familiar device may not see an OTP request or banking app notification.
Behind the scenes:
- The merchant submits transaction and device information.
- The issuer evaluates the available data using its risk assessment systems.
- If the transaction meets the issuer's authentication requirements, authentication can be completed without further customer interaction.
The customer simply continues through checkout. No additional verification screen is needed.
Challenge Flow: When Additional Verification Is Required
When the issuer needs more information to verify a transaction, it may request additional authentication.
This can happen when a purchase involves an unfamiliar device, unusual transaction details, or other risk indicators.
Common verification methods include:
- One-Time Password (OTP):A temporary code sent through a supported verification channel.
- Banking App Authentication:The customer receives a notification and confirms the transaction through their banking app.
- Biometric Authentication:Supported systems may use fingerprint or facial recognition to verify the cardholder.
Once the customer completes the requested check, the issuer evaluates the authentication result.
It is important to distinguish authentication from authorization. Passing 3DS verification does not guarantee that a payment will be approved. The issuer still evaluates the authorization request, including available funds, card status, and other transaction controls.
What Are the Benefits of 3D Secure?
3D Secure gives issuers more information and additional ways to verify online transactions. Its main benefits include:
Reduced Online Payment Fraud
Online card payments do not involve physically presenting a card, making it harder for merchants to verify who is making a purchase.
3DS helps address this problem by allowing issuers to assess transaction details, account information, and device data. When a payment looks unusual, additional authentication can make it harder for someone using stolen card details to complete the purchase.
It does not eliminate fraud, but it gives issuers another layer of protection when evaluating card-not-present transactions.
Stronger Cardholder Authentication
A card number and expiration date alone do not always establish that the person making a purchase is the legitimate cardholder.
3DS provides additional verification options, depending on the issuer's implementation. These may include:
- One-time passwords.
- Banking app confirmations.
- Supported biometric authentication methods.
This gives issuers more options when verifying cardholders, particularly when a transaction requires additional checks.
Chargeback Liability Shift
One important feature of qualifying 3DS transactions is the potential for a chargeback liability shift.
Under applicable card network rules, responsibility for certain eligible fraud-related chargebacks may shift from the merchant to the issuer after qualifying authentication.
However, this protection is not automatic. It depends on the card network, transaction type, authentication result, and applicable rules. Merchants should not assume that every transaction processed through 3DS qualifies for liability protection.
What Are the Disadvantages of 3D Secure?
Additional authentication can improve payment security, but it does not always make checkout easier. Businesses also need to consider the impact on legitimate customers.
Additional Checkout Friction
A customer may be ready to complete a purchase but then have to leave the checkout page, open a banking app, or enter a verification code.
These extra steps can be inconvenient, particularly on mobile devices. If the process takes too long or is difficult to understand, some customers may abandon their purchases.
Authentication Failures
Not every customer can complete an authentication request successfully. Common problems include:
- OTP messages arriving late or not arriving at all.
- Banking apps being unavailable or difficult to access.
- Incorrect verification information.
- Authentication attempts timing out.
A customer may have valid card details and sufficient funds but still fail to complete the payment because the authentication step cannot be finished.
Implementation and Integration Costs
Merchants may also need to invest in payment infrastructure, technical integration, testing, and ongoing maintenance to support 3DS.
The workload depends on the payment provider and existing checkout system. Businesses operating across multiple markets may also need to account for different card network requirements and authentication configurations.
How 3D Secure Relates to Virtual Card Payments
Do Virtual Cards Support 3D Secure?
Yes. Virtual cards can also be used for transactions that require 3D Secure authentication.
Although virtual cards do not have a physical form, they operate through card payment networks. Their online transactions may therefore be subject to the same authentication requirements as physical cards.
Whether a virtual card payment triggers 3DS depends on several factors:
- The card issuer and its authentication capabilities.
- The merchant's payment requirements.
- Transaction details and risk assessment.
- The card program's supported verification methods.
If additional authentication is required, the cardholder may need to complete an OTP check or approve the transaction through a supported verification channel.
A virtual card does not automatically bypass 3DS. It also does not guarantee that a transaction will be approved simply because the card details are valid.
How Virtual Cards Fit Into Online Payment Security
Virtual cards provide businesses with another way to organize online payments. While 3D Secure focuses on cardholder authentication, virtual card management helps businesses keep payment methods separate and control spending across different services.
BUVEI offers virtual Visa and Mastercard cards with features designed for different online payment needs:
- Multiple BIN Support:Different BIN options across issuing regions provide more flexibility for supported payment scenarios.
- Broad Payment Compatibility:Cards support payment use cases including Google Ads, Meta Ads, TikTok Ads, Microsoft Ads, ChatGPT, and Canva, subject to merchant and issuer requirements.
- Multi-Card Management:Issue multiple cards under one account, assign them to different services or projects, and set individual spending limits. Cards can also be frozen or closed when needed.
These features help businesses organize online expenses and manage individual payment methods more effectively. They complement payment security measures such as 3D Secure rather than replacing the authentication process.
Conclusion
3D Secure helps protect online card payments by giving issuers additional information to assess transactions and verify cardholders. Its frictionless and challenge flows provide different levels of authentication, depending on the circumstances of each payment.
For businesses using virtual cards across advertising platforms and SaaS services, understanding authentication requirements is only part of managing online payments. Choosing suitable cards and keeping spending organized are equally important.
