How Does 3D Secure Help Prevent Fraud?

3D Secure (3DS) is the card industry's authentication protocol for online payments. When a customer pays online, 3DS lets their issuing bank verify that the person entering the card details is actually the cardholder — typically through the banking app, a one-time PIN or a biometric prompt. Visa markets it as Visa Secure and Mastercard as Identity Check.

For fraud prevention, 3DS does two things at once: it stops many fraudulent transactions from completing at all, and for transactions that are successfully authenticated, it generally moves fraud chargeback liability from the merchant to the issuing bank.

How does 3D Secure stop fraud?

Stolen card details alone are not enough to complete a 3DS-authenticated payment. The fraudster would also need access to the cardholder's banking app or phone. When the issuer challenges a suspicious transaction, the genuine cardholder receives an authentication prompt for a purchase they did not make — and declines it. The fraud fails before any money moves and before any chargeback can occur.

Modern 3DS (version 2) also works silently in the background. The merchant's checkout sends the issuer contextual data — device information, transaction details and history — and the issuer can approve low-risk transactions with a frictionless flow that the customer never sees, reserving the visible challenge flow for riskier transactions. This keeps checkout smooth for most genuine customers while still screening every payment.

What is the liability shift?

The liability shift is the commercial reason merchants use 3DS. Under card scheme rules:

• If a transaction is successfully authenticated with 3DS and later disputed as fraud ("I did not authorise this"), the chargeback liability generally sits with the issuing bank, not the merchant.
• If the merchant processes without 3DS and the transaction turns out to be fraudulent, the merchant absorbs the chargeback.

The shift applies to fraud-type disputes. It does not protect against service disputes — a customer claiming goods were not delivered or not as described can still charge back an authenticated transaction. For those, you still need chargeback evidence.

What are the limits of 3D Secure?

3DS is powerful but not a complete fraud strategy:

• Friendly fraud is largely unaffected — the genuine cardholder authenticated the payment and disputes it anyway, usually on non-fraud grounds.
• Social engineering can defeat it: a fraudster who talks the victim into approving the authentication prompt gets a fully authenticated fraudulent payment. See account takeover and social engineering.
• Checkout friction is a real cost. Challenge flows add a step, and failed or abandoned authentications lose genuine sales. Poorly configured 3DS can cost more in lost conversions than it saves in fraud.
• Not everything supports it. Merchant-initiated recurring charges, for example, are handled under separate rules, with the initial customer-initiated transaction authenticated instead.

How should you use 3DS in practice?

• Enable 3DS on customer-initiated online payments, and keep the authentication results with your transaction records — they are your primary chargeback evidence.
• Pass rich, accurate data in the 3DS request; better data means more frictionless approvals for genuine customers.
• Combine 3DS with velocity checks and bot controls — authentication stops stolen-card fraud, while velocity rules stop automated attacks from hammering the checkout in the first place.
• For recurring billing, authenticate the first transaction and tokenise the card for subsequent merchant-initiated charges. See recurring card payments, CIT and MIT.

Used this way, 3DS removes most of the stolen-card chargeback risk from online trading while keeping the checkout experience acceptable for genuine customers.

Related topics

• What Is 3D Secure?
• What Is a Card Chargeback and How Does It Work?
• What Evidence Do You Need to Fight a Chargeback?
• What Is Card Testing and How Do Velocity Checks Stop It?

Back to Refunds, Disputes, Fraud and Compliance.