Also called: 3-D Secure Technology, Cardholder Authentication Programs, Consumer Authentication, American Express SafeKey, Discover ProtectBuy, Mastercard Identity Check, Mastercard SecureCode, Verified by Visa, Visa Secure
What 3-D Secure is
3-D Secure, usually shortened to 3DS, is a protocol for checking whether the person making an online card payment is the legitimate cardholder. It adds this identity check before the issuer makes the separate authorization decision to approve or decline the payment.
The protocol connects your checkout, the card issuer and, when needed, the customer. EMV 3-D Secure is the newer generation of the protocol, developed by EMVCo. Visa Secure, Mastercard Identity Check, American Express SafeKey and Discover ProtectBuy are network-branded 3DS programs.
3DS checks identity before authorization, but it does not guarantee approval or prevent every fraud dispute.
How authentication works
When your checkout requests authentication, the issuer assesses transaction details such as device, location and prior spending. A low-risk transaction can be verified in the background, called a frictionless flow. For a higher-risk payment, the issuer can ask the customer to confirm their identity with a one-time code or biometric check.
Authentication and authorization are separate. A successful 3DS check confirms identity, but the issuer still decides whether to approve the payment. A failed or abandoned challenge can interrupt checkout, while risk-based checks limit extra steps to transactions that need them.
Successful or attempted authentication can shift liability for certain fraud-related chargebacks, subject to network rules and transaction eligibility. Visa reported 11 basis points of fraud on authenticated e-commerce transactions versus 20 basis points on non-authenticated transactions in VisaNet data from Q4 2023, approximately 45% less.
What it means for your business
3DS is most relevant when you sell online or take card-not-present payments. It can reduce exposure to unauthorized transactions and some fraud disputes. It does not prevent every dispute, guarantee a higher approval rate, or replace fraud controls elsewhere in your checkout.
The research reviewed identifies no blanket US requirement for merchants to use 3DS. In the EEA and UK, Visa Secure supports authentication requirements for in-scope online transactions. A US business selling into those markets should account for their rules and customer checkout experience.
What it means for your costs
The research provides no standard 3DS fee, fee amount or statement descriptor. Authentication can affect costs indirectly: preventing a fraud dispute can avoid a dispute loss, while unnecessary customer challenges can cost you completed sales. Do not assume that a 3DS fee is a card-network fee; identify who bills it and what service it covers.
Your provider's invoice or processing statement is the place to verify any charge. Look for a line explicitly tied to 3DS, authentication or a fraud tool, then compare its billing basis and amount with your service agreement. The available research does not establish a universal line name.
What you can actually change
- Review the invoice. Find any 3DS or authentication charge and confirm whether it is billed per transaction or as a recurring service. Compare the exact charge with your agreement.
- Measure checkout friction. Compare authentication completion and payment approval before and after a checkout change. Track abandoned challenges separately from issuer declines.
- Use risk-based checks. Configure authentication to request a customer challenge when transaction risk warrants it, while allowing low-risk transactions to use a frictionless flow.
Frequently asked questions
Does 3-D Secure guarantee that a payment will be approved?
No. 3DS checks the cardholder's identity, while the issuer makes a separate authorization decision. A successfully authenticated transaction can still be declined, for example if the issuer does not approve the payment.
Does 3-D Secure shift chargeback liability to the card issuer?
Successful or attempted authentication can shift liability for certain fraud-related chargebacks. The shift depends on network rules and transaction eligibility, so authentication does not transfer liability for every dispute.
Is 3-D Secure required for US businesses?
The research reviewed identifies no blanket US requirement for merchants to use 3DS. Requirements differ by market, and Visa Secure supports authentication for in-scope online transactions in the EEA and UK.
Does 3-D Secure add a fee to my processing statement?
The research does not establish a standard 3DS fee or a universal statement line name. If you see an authentication-related charge, identify the billing party, billing basis and service in your agreement.