What Is 3D Secure and How Does It Work?
3D Secure (3DS) is the authentication step that appears during most South African online card payments: the moment where the customer approves the payment in their banking app or enters a one-time PIN (OTP) before the transaction goes through. It exists to prove that the person entering the card details is the genuine cardholder, not someone using stolen card numbers.
The "3D" stands for three domains: the issuer domain (the cardholder's bank), the acquirer domain (the merchant's side) and the interoperability domain (the card network connecting them). You may know it under its scheme brand names, Visa Secure (previously Verified by Visa) and Mastercard Identity Check (previously Mastercard SecureCode).
How Does 3D Secure Work at Checkout?
- The customer enters their card details and confirms payment.
- The merchant's gateway sends an authentication request to the cardholder's issuing bank via the card network.
- The issuer decides whether to challenge the customer.
- If challenged, the customer proves their identity, typically by approving a prompt in their banking app or entering an OTP sent by SMS. Absa, FNB, Nedbank, Standard Bank, Capitec, TymeBank and Discovery Bank each run their own challenge experience.
- On successful authentication, the payment continues to authorisation as normal. If authentication fails or is abandoned, the payment stops and no money moves.
What Is 3D Secure 2?
The current version of the protocol, 3DS2 (EMV 3-D Secure), improved on the original in two important ways:
- Richer data – the merchant sends the issuer far more context about the transaction (device, address, transaction history), letting the issuer assess risk more accurately.
- Frictionless flow – if the issuer's risk assessment is comfortable, it can approve the authentication silently with no challenge at all. The customer sees nothing extra, but the transaction still counts as authenticated.
3DS2 also works properly inside mobile apps and supports modern challenge methods such as banking-app push approval and biometrics, rather than only static passwords.
Why Does 3D Secure Matter for Merchants?
Liability shift
The biggest commercial benefit is the fraud liability shift. On a card-not-present transaction without authentication, the merchant generally carries the loss if the payment turns out to be fraudulent. When a transaction is successfully authenticated with 3D Secure, liability for fraud-related chargebacks generally shifts to the issuing bank.
That does not make a merchant immune to all disputes. Chargebacks for non-delivery, defective goods or service disputes are unaffected by 3DS. See Card Chargebacks.
Fraud reduction
Stolen card numbers alone are not enough to complete a 3DS-challenged payment; the fraudster would also need control of the victim's phone or banking app. This blocks the bulk of basic card-testing and stolen-card fraud.
Requirement in practice
In South Africa, acquirers and payment providers require 3D Secure on e-commerce card transactions as standard. Local shoppers are accustomed to the flow, so the friction cost is lower than merchants often fear, especially with 3DS2 frictionless approvals.
What Can Go Wrong with 3D Secure?
- Abandoned challenges – the customer never receives or acts on the OTP or app prompt. This appears as a 3DS failure, not a bank decline. See Why Do Card Payments Get Declined?.
- Outdated contact details – OTPs go to an old cellphone number registered at the bank. The customer must update their details with their bank.
- OTP fraud risk – fraudsters phone victims pretending to be the bank and ask them to read out the OTP. Banks never ask for an OTP; merchants can help by reminding customers of this.
Does 3D Secure Apply to Recurring Payments?
Usually only the first payment. The initial customer-initiated transaction is authenticated with 3DS, and subsequent merchant-initiated charges on the stored card run without a challenge, under the card scheme rules for recurring payments. See Recurring Card Payments: CIT and MIT.
Related Topics
Declines and Response Codes
The most common card decline reasons and response codes, what soft and hard declines mean, and how merchants should handle each type of failure.
Tokenisation and Network Tokens
Understand how card tokenisation replaces card numbers with secure tokens, how network tokens differ from gateway tokens, and why they improve approval rates.