Why it is called cardholder authentication programs
Cardholder Authentication Programs is a broad label for services that check whether a person making an online card purchase is the cardholder. It does not name one separate product or a single network rule. Card networks use their own brand names for these 3-D Secure services, including Visa Secure, Mastercard Identity Check, American Express SafeKey, and Discover ProtectBuy.
You encounter these names when your checkout asks a customer for an extra step, such as confirming a purchase through their bank. The customer-facing brand can differ by card, while the underlying service belongs to the 3-D Secure family. This umbrella phrase is more common in industry or technical descriptions than as a label on a merchant statement. The rest of this page explains the primary term, 3-D Secure (3DS).
What 3-D Secure is
3-D Secure, usually shortened to 3DS, is a protocol for checking whether the person making an online card payment is the legitimate cardholder. It adds this identity check before the issuer makes the separate authorization decision to approve or decline the payment.
The protocol connects your checkout, the card issuer and, when needed, the customer. EMV 3-D Secure is the newer generation of the protocol, developed by EMVCo. Visa Secure, Mastercard Identity Check, American Express SafeKey and Discover ProtectBuy are network-branded 3DS programs.
3DS checks identity before authorization, but it does not guarantee approval or prevent every fraud dispute.
How authentication works
When your checkout requests authentication, the issuer assesses transaction details such as device, location and prior spending. A low-risk transaction can be verified in the background, called a frictionless flow. For a higher-risk payment, the issuer can ask the customer to confirm their identity with a one-time code or biometric check.
Authentication and authorization are separate. A successful 3DS check confirms identity, but the issuer still decides whether to approve the payment. A failed or abandoned challenge can interrupt checkout, while risk-based checks limit extra steps to transactions that need them.
Successful or attempted authentication can shift liability for certain fraud-related chargebacks, subject to network rules and transaction eligibility. Visa reported 11 basis points of fraud on authenticated e-commerce transactions versus 20 basis points on non-authenticated transactions in VisaNet data from Q4 2023, approximately 45% less.
What it means for your business
3DS is most relevant when you sell online or take card-not-present payments. It can reduce exposure to unauthorized transactions and some fraud disputes. It does not prevent every dispute, guarantee a higher approval rate, or replace fraud controls elsewhere in your checkout.
The research reviewed identifies no blanket US requirement for merchants to use 3DS. In the EEA and UK, Visa Secure supports authentication requirements for in-scope online transactions. A US business selling into those markets should account for their rules and customer checkout experience.
What it means for your costs
The research provides no standard 3DS fee, fee amount or statement descriptor. Authentication can affect costs indirectly: preventing a fraud dispute can avoid a dispute loss, while unnecessary customer challenges can cost you completed sales. Do not assume that a 3DS fee is a card-network fee; identify who bills it and what service it covers.
Your provider's invoice or processing statement is the place to verify any charge. Look for a line explicitly tied to 3DS, authentication or a fraud tool, then compare its billing basis and amount with your service agreement. The available research does not establish a universal line name.
What you can actually change
- Review the invoice. Find any 3DS or authentication charge and confirm whether it is billed per transaction or as a recurring service. Compare the exact charge with your agreement.
- Measure checkout friction. Compare authentication completion and payment approval before and after a checkout change. Track abandoned challenges separately from issuer declines.
- Use risk-based checks. Configure authentication to request a customer challenge when transaction risk warrants it, while allowing low-risk transactions to use a frictionless flow.
Frequently asked questions
Is Cardholder Authentication Programs the same as 3-D Secure?
Yes. It is an umbrella description for branded services that use 3-D Secure to authenticate a cardholder during an online payment.
Which services are called cardholder authentication programs?
Examples include Visa Secure, Mastercard Identity Check, American Express SafeKey, and Discover ProtectBuy. Each is a network-branded name for a 3-D Secure service.
Will you see Cardholder Authentication Programs as a fee on your statement?
This umbrella phrase is not a specific fee name. You are more likely to encounter the branded service during online checkout than as a statement line.