3-D Secure
The card-network authentication step that shifts fraud liability from the merchant to the issuer — at a measurable cost in completed checkouts.
Industry & Domain3-D Secure asks the cardholder's bank to authenticate them during checkout. Its commercial purpose is liability: an authenticated transaction that turns out to be fraudulent is generally the issuer's loss rather than the merchant's. 3DS2 improved on the original by passing device and context data so that low-risk transactions can be approved without any challenge — frictionless flow — and only riskier ones interrupt the user.
The design consequence is that the challenge is rendered by the bank, inside your checkout, and you control almost none of it. Some are modern, some are an SMS code in a 2007 iframe. What you can control is the framing around it: telling the user their bank is about to ask something, keeping the cart intact if they fail, and making clear whether a failure means “try again” or “use another card”.
Exemptions are a product lever
Under SCA, low-value payments, recurring charges and merchant-initiated transactions can be exempt. Requesting the right exemptions removes challenges from a large share of traffic — a payments configuration decision that shows up directly in conversion.
In practice
A subscription business applied 3DS to every transaction including renewals. Involuntary churn ran at 2.4% a month, concentrated on renewals where nobody was present to answer a challenge. Flagging renewals as merchant-initiated and exempt cut that to 0.9% within two billing cycles.
Where teams get it wrong
- Applying 3DS to every transaction instead of requesting available exemptions.
- No warning before the bank's challenge appears, so it reads as a hijack.
- Losing the cart when authentication fails.
- Assuming the challenge screen is usable on mobile — many are not, and it is the bank's markup.
- Challenging recurring payments where no customer is present to respond.
Learn more
You may ask
Frequently Asked Questions
What is 3-D Secure?
A card-network protocol that authenticates the cardholder with their issuing bank during checkout. It shifts fraud liability to the issuer, at the cost of an extra step for the customer.
Does 3-D Secure reduce conversion?
A challenge does. 3DS2's frictionless flow authenticates most low-risk transactions invisibly, so the practical question is what share of traffic gets challenged — which exemptions and risk data can materially change.
Related terms
All terms- Strong Customer Authentication (SCA)The EU requirement that electronic payments be authenticated with two independent factors — with a defined set of exemptions.
- Payment GatewayThe service that takes payment details from a checkout, passes them for authorisation, and returns the result.
- PSD2The EU payment services directive that mandated strong customer authentication and forced banks to open account access to licensed third parties.
- ChargebackA forced reversal of a card payment initiated by the cardholder's bank — the customer's escape hatch when the merchant's own one is worse.
Defined by Mara Last reviewed .
Let's talk about your product.
Happy to look at what you're building and say where design would move the needle.
Contact Us