3D Secure
What is 3D Secure?
3D Secure (3DS) is an authentication protocol that adds an identity-verification step to online card payments, confirming that the person entering the card details is the legitimate before the payment is approved.
The name is short for "Three-Domain Secure," after the three parties it connects: the that holds the card, the merchant's acquiring bank, and the card network that links them. During checkout, the transaction is passed to the issuer, which decides whether the payment can go through as-is or needs an extra identity check.
Key facts
- Full name: Three-Domain Secure, named after the issuer, acquirer, and interoperability domains it connects.
- Also known by scheme brand names: and are the card networks' own implementations of 3DS.
- Versions: 3DS1 (being phased out) and 3DS2, which adds risk-based, device-aware authentication.
- Verification flows: frictionless (approved in the background) and (the cardholder completes an extra step).
- Applies to: card-not-present transactions such as e-commerce and in-app payments; required to meet rules in the EEA.
How it works
- Checkout: the cardholder enters card details on the merchant's payment page.
- Authentication request: the payment is routed to the issuer with transaction data and, in 3DS2, device and behavioral signals.
- Risk assessment: the issuer evaluates the data and picks a frictionless or challenge flow.
- Challenge (if required): the cardholder confirms their identity with a one-time password, a banking-app approval, or .
- Result and authorization: the issuer returns an authentication result, the liability shift is recorded, and the transaction moves on to authorization.
Why it matters
3DS reduces on card-not-present payments by requiring proof that the person paying controls the card, not just knowledge of the card number. It blocks a common attack pattern where a stolen card number alone is enough to complete a purchase.
It also changes who pays when fraud slips through. For a payment authenticated through 3DS, the moves fraud costs from the merchant to the issuer. And in the EEA, 3DS is how card payments satisfy PSD2 , so a working 3DS setup is what keeps those transactions from being declined for missing authentication.
3DS versions
Two versions are in use. 3DS1 is the original protocol and it's being retired; it leans on static passwords and usually redirects the cardholder to a separate verification page. 3DS2 is the current standard and sends far more context, including device and transaction data, so the issuer can clear most payments through the frictionless flow without interrupting the cardholder. It also supports merchant-initiated authentication such as for recurring charges. For a full breakdown of what changed between the versions, see the .
