Also called: Cardholder authentication, Payer authentication
What authentication is
Authentication verifies that the person or entity initiating a payment is genuine. For an online card purchase, it checks whether the person using the card is its legitimate cardholder. It answers who is paying. Authorization is a separate step: the issuer decides whether to approve the transaction.
The most familiar online card authentication method is 3-D Secure, also called 3DS. The card issuer evaluates information such as the device, location, transaction details, and prior activity. The check can happen in the background, or the customer can be asked to complete a challenge, such as entering a one-time code or confirming in an app.
Authentication checks who is paying. Authorization decides whether the payment is approved.
How authentication works
In a frictionless flow, the issuer assesses the transaction without asking the customer to do anything. If it needs more proof, it starts a challenge. The customer completes that check before the payment continues to authorization. This extra step can interrupt checkout, while a frictionless check avoids an added customer action.
Authentication results include successful, attempted, pending, failed, or rejected. A failed result is not approval to continue: the documented 3DS guidance says not to submit the payment for authorization after authentication fails or the issuer rejects the authentication. The merchant sends relevant payment and customer details so the issuer can make its assessment.
What it means for your business
Authentication is a fraud-control step, not a card-processing fee with a standard published price in the research reviewed here. The available documentation does not identify an authentication fee amount or a standard authentication line on your merchant statement. Authentication itself does not set your interchange, network assessments, or processor markup.
For an online sale, proper authentication can help protect you against fraud-related disputes. Transactions authenticated successfully with ECI 05, or with an authentication attempt recorded as ECI 06, may qualify for fraud-dispute liability protection when the required authentication data, including a valid CAVV, is present. That protection is specific to eligible fraud disputes; it does not prevent other dispute types, such as a claim that an order was never delivered.
The US has no general requirement for every online card purchase to use strong customer authentication. In the European Union, PSD2 requires strong customer authentication, which uses two or more identity factors. A US business selling to customers in markets with that requirement may encounter it in those transactions.
Where it goes wrong
A challenge that customers cannot complete can interrupt checkout, while missing or inaccurate transaction details give the issuer less information for its risk decision. Authentication also does not guarantee approval: the issuer still makes a separate authorization decision after the authentication step.
Treat authentication as one part of your fraud and checkout controls. Track challenge rates alongside authorization approvals, abandoned checkouts, fraud reports, and chargebacks. Comparing those outcomes helps you see whether extra verification is stopping fraud or creating avoidable friction for legitimate customers.
What you can actually change
- Review checkout data. Make sure your online payment flow sends accurate customer, device, and transaction details for the issuer's risk assessment. Missing information can make authentication less effective.
- Track the outcomes. Compare challenge rates with approvals, checkout abandonment, fraud reports, and disputes. A rising challenge rate alone does not show whether your process is improving.
- Check dispute evidence. For authenticated online transactions, retain the authentication result and related data, including ECI and CAVV where applicable. Those details matter when establishing eligibility for fraud-dispute liability protection.
Frequently asked questions
What is the difference between authentication and authorization?
Authentication checks whether the person using a payment method is genuine. Authorization is the issuer's separate decision to approve or decline the transaction. A successful authentication does not guarantee approval.
Is authentication required for online card payments in the US?
There is no general US requirement that every online card payment use strong customer authentication. Requirements differ by market; for example, strong customer authentication is required in the European Union under PSD2.
Does authentication prevent chargebacks?
No. Proper authentication can provide protection against eligible fraud-related disputes when the required data is present, but it does not prevent every dispute or guarantee that a transaction will be approved.
Does authentication appear as a fee on my merchant statement?
The research reviewed here does not establish a standard authentication fee or statement line. Authentication is a security step, and its presence does not mean you are paying a specific standardized fee.