What is 3-D Secure? 3DS, the liability shift and when to use it

3-D Secure (3DS) is a check that lets the buyer's bank (the card issuer) confirm an online card payment before the merchant sends it for authorization. Usually the bank decides from the data alone and the buyer sees nothing extra. When it wants more, it asks the buyer to approve, typically with a one-time code or a tap in their banking app.

For merchants, the payoff comes after a fraud dispute. When a payment is authenticated and the right data travels with the authorization, card network rules can move the loss on an eligible fraud chargeback to the card issuer. That is the liability shift, and it has conditions.

In the US, 3DS is optional, so the real question is where it is worth the extra step. Flux supports 3-D Secure on card payments through its hosted checkout, payment links and invoices, and you choose whether it runs on every card payment or only on riskier ones (more on 3-D Secure at Flux).

How a 3DS check works

3DS runs between the buyer clicking pay and the authorization. Three parties take part: the merchant side (software called a 3DS Server), the card network's Directory Server, which routes the request, and the issuer's Access Control Server (ACS), which decides.

1. Device data. The issuer can collect browser and device details through a short step called the 3DS Method.
2. Authentication request. Transaction, card, device and buyer details go to the issuer. EMVCo says the current specification defines over a hundred data elements.
3. The issuer decides. It authenticates the buyer silently (frictionless), asks the buyer to prove who they are (a challenge), or declines.
4. The result goes into the authorization. A successful check returns an authentication value (the CAVV on Visa) and an ECI code. Both must travel in the authorization request, or the protection is lost.

Frictionless vs challenge

Most 3DS checks are invisible to the buyer. American Express says that on average 85% of transactions decisioned with SafeKey 2.0 needed no challenge (its own data, May to November 2021).

You can't restyle a browser challenge, because the issuing bank controls that screen. You can influence the data: Visa found that merchants sending more complete data saw higher frictionless rates on average, and since August 12, 2024, Cybersource reports, Visa Secure has required fields such as the cardholder's name, email and at least one phone number.

Who runs it, and what each network calls it

The protocol is written by EMVCo, which is owned by six card networks: American Express, Discover, JCB, Mastercard, UnionPay and Visa. Each network runs its own program and sets its own liability rules.

The first generation is retired: Visa ended support for 3DS 1.0.2 on October 15, 2022. EMV 3DS, often called 3DS2, replaced it, and since the networks stopped processing version 2.1 in September 2024, today's checks run on 2.2 or 2.3.1.

What 3DS results mean

Every 3DS check returns a status letter, usually from the issuer's Access Control Server and sometimes from the card network on the issuer's behalf, and your checkout acts on it. Here are the ones you will see most.

An N isn't always fraud. Visa returns N with reason code 87 for some anonymous non-reloadable prepaid cards and tells merchants to send those to authorization anyway.

ECI codes and why they matter

The ECI (electronic commerce indicator) is a two-character code that tells the network how a payment was authenticated, and the liability shift depends on it, among other conditions. The values differ by network.

The conditions matter. If the authentication value (the CAVV on Visa) doesn't make it into the authorization, a Visa 05 or 06 can be downgraded to 07 and the shift is lost, and on US domestic e-commerce, some merchant categories get no Visa fraud protection at any ECI (see below).

The liability shift: what it covers and what it doesn't

Under the card networks' rules, which vary by network, the loss on an eligible fraud dispute on an authenticated (and, on some networks, attempted) transaction can move to the issuer. In the Visa Core Rules, a card-not-present fraud dispute (condition 10.4) isn't valid on a payment that carried ECI 05 (authenticated) or 06 (attempted) with its CAVV, though the ECI 06 protection does not apply to non-reloadable prepaid cards. Mastercard likewise bars its fraud chargeback (reason code 4837) on properly authenticated payments.

The key word is fraud. If the buyer agrees they made the purchase, the shift doesn't apply.

Even on fraud disputes, conditions apply:

• A successful check is necessary but not sufficient. The network can downgrade the ECI in the authorization response (Stripe's example: a Visa 05 sent and a 07 returned), for instance when the authentication value is missing or invalid, and the shift goes with it. Your merchant category must also be eligible.
• You still have to respond. Stripe warns that ignoring an issuer's inquiry on an authenticated payment can lead to a "no-reply" chargeback that voids the shift.
• Some categories are excluded. For US domestic Visa e-commerce, 3DS gives no protection against Visa fraud disputes for these merchant category codes: 4829 (wire transfers and money orders), 5967 (adult content), 6051 (non-financial institutions such as currency sellers), 6540 (stored-value card loads), 7801 (licensed online casinos), 7802 (licensed horse and dog racing) and 7995 (betting). TabaPay reports that Discover excludes the same codes.
• Monitoring programs can override it. If a Visa monitoring program flags a transaction, the issuer can dispute it under condition 10.5, which has no 3DS carve-out. American Express's international merchant regulations remove SafeKey liability shift from merchants it places in its Fraud Full Recourse program.
• Exemptions and data-only checks don't count. Request an SCA exemption that the issuer accepts (see selling outside the US), or send data without requesting authentication (a "data-only" check), and you keep the liability.

In an excluded category? Read whether 3DS is worth it for high-risk merchants and why sports betting deposits get declined. Either way, confirm the current rules for your account with your processor.

3DS, friendly fraud and Compelling Evidence 3.0

Friendly fraud is when the real cardholder buys something and later disputes it. 3DS helps only when that dispute is filed as fraud, where the liability shift can apply to an authenticated payment.

Many aren't. A buyer who regrets a renewal may file a cancelled recurring dispute, and Visa's own Compelling Evidence 3.0 guidance notes that subscription disputes are often classified that way rather than as fraud. 3DS does nothing for those.

Compelling Evidence 3.0 (CE 3.0) is Visa's separate defense against friendly fraud filed as a fraud dispute, and it works with or without 3DS. You need two earlier transactions not reported as fraud, processed 120-365 days before the dispute, with a matching device ID, device fingerprint or IP address plus one more element such as the login or delivery address. For disputes processed since October 24, 2026, those two transactions can be on the same card or a linked credential (such as a token that stands in for the card number), at one or more merchants.

Visa announced that from October 17, 2025 it would automatically qualify US transactions for CE 3.0 using data shared through Visa Secure, including Visa Data Only, with a fee per successful qualification from April 17, 2026. Mastercard's equivalent for 4837 disputes is First-Party Trust. For the full playbook, see friendly fraud, the chargeback type nobody warns you about and gaming chargebacks and representment.

3DS and chargeback monitoring programs

Card networks track each merchant's dispute and fraud levels, and crossing their thresholds can bring fines, remediation plans and eventually the loss of your merchant account. 3DS can change who pays for an eligible fraud dispute. It doesn't erase the fraud report, and a fraud dispute that is still filed on an authenticated payment can count toward the network's numbers even when the loss shifts.

• Visa. The Visa Acquirer Monitoring Program (VAMP), effective April 1, 2025, replaced Visa's separate dispute and fraud monitoring programs. Its ratio counts fraud reports plus disputes against settled card-not-present transactions, Visa has revised the thresholds since launch, and its fact sheet doesn't list 3DS-authenticated transactions among the exclusions.
• Mastercard. Its Excessive Chargeback Program flags an Excessive Chargeback Merchant (ECM) at a ratio of 1.5% or more with at least 100 chargebacks in a month, and a High Excessive Chargeback Merchant (HECM) at 3% or more with at least 300.

Issuers still have to report fraud on authenticated payments, and Stripe tells its users that such fraud can still count toward their fraud volume. Treat 3DS as protection for your margin, not a direct way to lower your ratio, and track your numbers with the chargeback ratio calculator.

When to use 3DS: every payment or only riskier ones

With no US regulatory mandate, this is a business decision. The cost is friction: most checks are invisible, but a challenged buyer without their phone may not finish. The evidence on approvals also points both ways.

• Visa reports a 9% approval lift for Visa Secure-authenticated transactions, compared with unauthenticated traffic (so not a controlled test).
• In a small 2024 US analysis, Stripe saw approvals on frictionless 3DS transactions fall to 82% from an 87% baseline, and suggested some US issuers may read a 3DS request as a risk signal.

So 3DS can help approvals or hurt them, depending on your buyers and their banks. Where it runs matters more than whether it's on.

Run it on every card payment if

• Fraud claims are a large share of your chargebacks, or stolen cards have hit you before.
• You deliver instantly or can't get goods back, as with digital goods, software keys or event tickets.
• One fraud loss would wipe out the margin on many good orders.
• Most of your buyers are first-time customers you know little about.

Run it only on riskier payments if

• Most of your revenue comes from repeat buyers with a clean history.
• Your chargebacks are mostly non-fraud disputes, which 3DS won't cover anyway.
• Checkout speed drives your conversion, as with low-ticket or mobile-heavy sales.

Across the industry, selective 3DS is commonly triggered by order amount, for new cards, or by the country that issued the card. Review approval rate, abandoned checkouts and fraud disputes after a month or two, then adjust. See also how to reduce fraud on high-risk transactions and card-not-present fraud on high-risk sites.

Payment links, B2B invoices and subscriptions

Payment links and invoices

A payment link or emailed invoice is a card-not-present payment like any checkout, often a larger one, and the link may have been forwarded. For a new client or a large first invoice paid by card, 3DS gets the issuer's confirmation before money moves.

B2B adds a wrinkle. A challenge usually goes to the phone or banking app tied to the card, and for a company card that may belong to someone other than the person in accounts payable, so the payment can stall. Running it only on riskier payments means fewer card payments get a check at all, and large invoices can go by ACH, where 3DS doesn't apply. More on invoicing and payment links.

Subscriptions and recurring billing

The usual industry pattern is to authenticate at signup, while the customer is present, and charge renewals as merchant-initiated transactions with no challenge. European and UK rules require authentication when a customer sets up a series of same-amount recurring payments, and later payments in that series may skip it.

Don't assume that first authentication protects every renewal. For a merchant-initiated payment linked to an authenticated one, Mastercard steers issuers toward a non-fraud recurring-transaction dispute, which 3DS doesn't cover, and vendors such as GPayments warn that later recurring charges may not qualify for the shift. Cancellation disputes sit outside 3DS entirely, so Visa's free-trial rules (a reminder at least 7 days before the first paid charge, easy online cancellation) matter more there.

Selling outside the US: SCA and other mandates

Cards issued in the European Economic Area (EEA) and the UK fall under strong customer authentication (SCA), a requirement of PSD2 (the EU's second Payment Services Directive). SCA applied from September 14, 2019, with e-commerce deadlines of December 31, 2020 in the EU and March 14, 2022 in the UK. 3DS is the usual way online card payments meet SCA.

If your acquirer (the bank that processes your card payments) is in the US, the European Banking Authority (EBA) treats SCA on EEA-issued cards as best effort. If the buyer's bank can't apply SCA, it decides whether to block the payment or accept liability to its own cardholder under PSD2, and network chargeback rules still apply to you. Exemptions such as low-value payments (EUR 30 or less, within cumulative limits) exist, but the issuer decides, and if your side requests one and the issuer accepts, liability stays with you.

One quirk: Visa's 2023 European SCA guide says that for acquirers outside the EEA and UK that haven't opted in to receive it, Visa converts its "authentication required" decline code (1A) into a generic "do not honor" decline (code 05, a decline code, not the ECI value above). So a European bank asking for 3DS can look like an ordinary decline. Elsewhere, Japan's industry card security guidelines required online merchants there to enable 3DS by the end of March 2025, and India's 2026 e-mandate rules require extra authentication to register a recurring mandate, for the first charge, and on later charges above INR 15,000 (INR 100,000 for insurance premiums, mutual fund subscriptions and credit card bills), cross-border ones included.

Common myths about 3-D Secure

• "3DS means no more chargebacks." It can move the loss on eligible fraud disputes, and nothing else. Every other dispute type works as before.
• "3DS always adds a password screen." Most checks show the buyer nothing. The issuer usually challenges when it sees risk, when local rules require it, or when the merchant asks for a challenge.
• "3DS replaces fraud screening." The issuer checks whether this looks like its cardholder, not whether a real cardholder is gaming your refund policy. It is one layer among several.

Several of the rules above changed in 2026 alone. This guide is general information, not legal advice, and card network rules change, so confirm the current rules that apply to your business with your processor.

3-D Secure at Flux

Flux supports 3-D Secure on card payments. You choose whether it runs on every card payment or only on riskier ones, and it works on Flux's hosted checkout and on Flux payment links and invoices.

On hosted checkout, card details are typed into Flux's isolated hosted payment fields on payments.fluxpayments.com, so card numbers never touch your servers (see how to reduce PCI scope with hosted fields). Payment links and invoices let customers pay by card, ACH or stablecoins with no login, and 3-D Secure can run on the card payments. For details such as which payments count as riskier, talk to the Flux team about how it's set up for your account.

Every business gets its own merchant account and a real underwriting review by people. Flux works with high-risk businesses deliberately, though not every business qualifies. To get started, apply here or email sales@fluxpayments.com.