What is 3D Secure Authentication? (2026 guide)

Key takeaways:

• 3D Secure authentication verifies a cardholder's identity before an online payment is approved, reducing the risk of unauthorised transactions for both merchants and customers.

• EMV 3DS, the current version of the protocol, offers stronger security and a smoother checkout experience than the original 3DS1, which Visa retired in October 2022.

• irwallex helps businesses reduce fraud while keeping checkout friction low by applying 3D Secure only when additional authentication is needed.

What is 3D Secure authentication? Simply put, it's a security protocol that verifies a cardholder's identity before an online card payment is approved and processed.

Also known as 3DS, it adds an extra checkpoint between entering card details and completing a purchase.

This guide explains how 3D Secure works, how the current version (EMV 3DS) differs from the original protocol, and how to use it effectively at checkout. You'll also find the benefits, drawbacks, and practical tips for optimising 3D Secure for your business.

Understanding the differences between 3DS1 and 3DS2

3D Secure has gone through one major upgrade since it launched. Here's a quick overview of what’s changed:

The information in this table has been reviewed to be accurate as of 23 July 2026.

What is 3DS1?

3DS1 was the original version of the protocol. It relied on a static password that cardholders had to enter for every transaction, which often disrupted checkout and added friction for customers.

Visa retired support for 3DS1 in October 2022¹, encouraging merchants and issuers to complete their move to the newer standard.

What is 3DS2?

3DS2, also called EMV 3DS, replaced the password-only approach with risk-based authentication.

It shares richer transaction and device data between the merchant, card network, and issuer, so most low-risk transactions are approved without any extra step from the customer.

When a transaction looks higher-risk, the issuer can still request a challenge. This might be a one-time passcode, a biometric check, or a knowledge-based question. EMV 3DS also supports the strong customer authentication requirements under PSD2 in Europe.

Why is 3D Secure authentication important?

Card-not-present fraud is a growing risk for any business that sells online. 3D Secure authentication addresses this by confirming that the person completing a purchase is the legitimate cardholder, not someone using stolen card details.

If a fraudster attempts a transaction with stolen card information, 3D Secure still requires an additional verification step, such as a one-time passcode or biometric check. This makes it much harder for fraudulent transactions to succeed.

3D Secure also shifts liability for approved transactions from the merchant to the card issuer.

If a transaction is authenticated and later turns out to be fraudulent, the issuer carries the loss instead of the business. This protection, combined with fewer successful fraud attempts, helps build trust in online payments for both merchants and customers.

How does 3D Secure authentication work?

The 3D Secure process happens in the background and usually takes only a few seconds to complete.

When a customer enters their card details at checkout, the merchant sends transaction and device data to the card issuer to confirm the cardholder's identity. The issuer evaluates this data in real time.

For most transactions, this happens without any extra input from the customer, and the purchase goes through immediately.

For higher-risk transactions, the issuer may request a challenge. This could be a one-time passcode sent by SMS or email, a biometric check like a fingerprint or face scan, or a confirmation through the cardholder's banking app.

If the customer completes the challenge successfully, the issuer authorises the transaction and the purchase is completed. If the challenge fails or isn't completed, the transaction is declined.

5 benefits of 3D Secure authentication

3D Secure does more than block fraud at checkout. It also creates measurable advantages for how a business operates.

1. Builds customer trust

When customers see an extra layer of security at checkout, they feel more confident that their payment details are protected. This can lead to a better overall shopping experience and repeat business.

2. Shifts liability to the card issuer

3D Secure transfers responsibility for fraudulent transactions from the merchant to the card issuer. If an authenticated transaction later turns out to be fraudulent, the issuer covers the loss, not the business.

3. Reduces chargebacks

Because the extra authentication step blocks most fraud attempts before they succeed, businesses see fewer disputed transactions overall.

4. Speeds up dispute resolution

When a transaction is authenticated through 3D Secure, resolving any dispute that does arise typically takes less time and fewer resources than an unauthenticated transaction.

5. Simplifies regulatory compliance

3D Secure helps merchants meet strong customer authentication requirements under regulations like PSD2 in Europe, which requires additional verification for most online payments.

4 disadvantages of 3D Secure authentication

3D Secure isn't without trade-offs. Weigh these drawbacks before rolling it out at checkout:

1. Delays from one-time passcodes

Authentication methods like SMS or email OTPs can be slow to arrive. If a customer has to wait too long, they may abandon their cart before completing the purchase.

2. False declines

In some cases, legitimate transactions can be declined because of errors in the authentication process, resulting in lost sales for the business.

3. Complexity of implementation

Integrating 3D Secure into an existing payment system and configuring risk rules can be technically demanding, especially for smaller merchants without in-house payments expertise.

4. Ongoing maintenance needs

As card networks update their 3D Secure specifications, merchants need to keep their systems current with the latest standards and security requirements.

How to optimise 3D Secure authentication

Getting the balance right between security and a fast checkout comes down to how well you calibrate your risk rules.

Not every transaction carries the same level of risk. Assessing each transaction individually helps you apply stronger authentication only where it's needed, rather than slowing down every checkout.

Card issuers already do this through risk-based authentication, which uses AI and real-time data to score each transaction. Risk models typically weigh factors such as device type, location, and historical spending patterns to decide whether a transaction can proceed without a challenge.

You can apply the same principle to your own checkout by setting risk rules with your payment provider. These rules determine when 3D Secure should trigger an additional authentication step, based on factors like:

• Transaction amount

• Transaction frequency

• Geographic location

• Unusual account or device behaviour

• Historical spending patterns

Well-calibrated risk rules reduce the chances of drawbacks like false declines, while still keeping high-risk transactions in check.

Your payment service provider plays a key role here, helping you fine-tune these rules while staying compliant with payment security and customer protection regulations.

Manage risk and maximise payment acceptance with Airwallex

3D Secure works best when it protects your business without creating unnecessary friction for legitimate customers. Airwallex uses intelligent, risk-based authentication to help you reduce fraud while maintaining high payment acceptance rates.

Instead of challenging every transaction, Airwallex evaluates each payment in real time, taking into account:

• Risk level

• Regulatory exemptions

• Your custom payment policies

Low-risk transactions can proceed with a frictionless checkout, while higher-risk transactions are challenged with additional verification.

You can also customise your fraud strategy by setting your own risk rules and watchlists, based on factors like email address, IP address, card fingerprint, or device ID. This gives you greater control over when 3D Secure is triggered, helping you protect your business while delivering a smoother checkout experience.

Frequently asked questions (FAQs)

What does the "3D" in 3D Secure stand for?

The "3D" refers to the three domains involved in the payment: the issuer domain (the cardholder's bank), the acquirer domain (the merchant's bank), and the interoperability domain (the network connecting them, such as Visa or Mastercard). These three domains exchange data during 3D Secure authentication to confirm the cardholder's identity before a payment is approved.

Is 3D Secure the same as an OTP (one-time passcode)?

No. An OTP is just one of several methods used to complete 3D Secure authentication. Card issuers can also request a biometric check, a knowledge-based question, or an app-based confirmation, depending on the transaction's risk level.

Does 3D Secure authentication guarantee a transaction is fraud-free?

No. 3D Secure significantly reduces the risk of fraud, but it doesn't eliminate it entirely. It can also occasionally decline legitimate transactions in error, so businesses still need to monitor their checkout performance alongside using 3D Secure.

Is 3D Secure authentication required for every online payment?

Not always. Regulations like PSD2 in Europe require strong customer authentication for most online card payments, but requirements vary by region, card issuer, and transaction type. Outside regulated markets, whether 3D Secure applies often depends on the card issuer's own risk assessment.

Do small businesses need 3D Secure authentication?

Yes. Any business that accepts online card payments can benefit from 3D Secure, regardless of size. It shifts liability for fraudulent transactions to the card issuer and can reduce chargebacks, which matters even more when margins are tight.

Can businesses control when 3D Secure authentication is triggered?

Yes, with the right payment provider. Airwallex, for example, lets you set your own risk rules so 3D Secure only applies to higher-risk transactions, keeping checkout fast for trusted customers.

Sources:

1. https://usa.visa.com/dam/VCOM/global/support-legal/documents/visa-will-discontinue-support-of-3d-secure.pdf