Article
3D Secure: How to minimise fraud while maximising conversion
Improve customer experience, increase security, and reduce fraud with 3D Secure.
Payment authentication is often associated with a bad experience, consisting of multiple redirects and low authorisation rates. 3D Secure 2 solves this problem by taking authentication to the next level and creating a safe and seamless payment experience for your customers.
While 3D Secure is not a mandatory requirement for businesses in Australia, it is a way for them to protect themselves against fraud. 3D Secure improves the payment experience for consumers, while saving businesses the cost of fraudulent chargebacks.
In this article, we'll dive into the other benefits of 3D Secure and how the payment and authentication flows work.
Quick recap: What is 3D Secure?
3 Domain Secure (3D Secure) is a security measure for online payments. The 3 domains (acquirer, scheme, and issuer) interact with each other using a 3DS protocol where they exchange information and authenticate the transaction.
3D Secure explained
3D Secure helps prevent fraud and is available for Card Not Present (CNP) transactions with all major card networks. Although it is not mandatory in Australia, it is a mandatory requirement in the EU, following the Revised Payment Services Directive (PSD2).
Benefits of 3D Secure
The benefits of 3D Secure include:
Lower fraud rates
Higher card authorization rates
Fewer lost sales compared to older authentication methods
The first version of 3D Secure was slow and forced customers onto external banking pages. 3D Secure 2 (3DS2) fixes these issues. 3DS2 is built for mobile-first commerce and runs authentication in the background to keep the checkout experience smooth.
Benefits of 3DS2:
Frictionless native authentication: Customers verify payments directly in your app or website without external redirects, which means fewer abandoned carts.
Smarter risk decisions: Over 150 data points, including device details and transaction history, are shared between merchants and banks, leading to highly accurate, instant risk assessments.
Faster verification: Customers can verify themselves using face scans, fingerprints, or SMS codes instead of remembering complex passwords.
Delegated authentication: Merchants can handle strong customer authentication directly inside their checkout via a 3D Secure API or by using delegated authentication, maintaining full control over the user experience.
With these features, 3D Secure 2 helps you protect your revenue from chargeback fraud while improving overall payment performance.
Evolution of 3D Secure
3D Secure 2 (3DS2) is the updated version of 3D Secure 1 (3DS1). The main difference between 3DS1 and 3DS2 is that the new security measure is optimised for more devices like smartphones, PC, and mobile app payments. The infamous pop-up windows of 3DS1 is gone, creating a more frictionless checkout flow.
Additionally, with 3DS2 authentication, businesses can now send more than 100 data elements to card issuers for more intelligent risk scoring, up from the original eight data points. The increased number of data elements improves risk-based authentication, ensuring frictionless checkouts for most low-risk transactions from trusted consumers..
Why was 3D Secure updated?
As payment technology evolves, so does fraud risks and techniques. Close to half of Australian businesses (45%) say that fraudulent transactions and chargebacks are a significant cost for them. This indicates how vital it is to keep up with ever-evolving risk trends, like with the updated 3D Secure protocol. 3DS2 is a better way to handle Strong Customer Authentication (SCA), making secure transactions easier and more seamless for both enterprises and consumers.
Benefits of 3D Secure 2
3DS2 comes with a lot of benefits, including:
No redirects
With 3DS2, native authentication happens without redirects and can also work on non-browser-based payment methods, improving the payment experience and increasing conversion rates.
Risk analysis
The combination of certified SDKs and iframes in the checkout flow, paired with data-sharing APIs, makes 3DS2 the data conduit between businesses and banks. Over 150 potential data points are shared, which means that better risk decisions are drawn from the information you and card issuers know about your mutual customers. The more information you have to support authentication cases, the higher the chances of successful transactions.
Verification options
3DS2 also has multiple options for customers to verify themselves, including biometric identifiers. More authentication flows and choices means increased security and lower drop-off rates in comparison to older solutions based on static passwords.
3D Secure examples
3D Secure examples show how different businesses use intelligent authentication to secure checkouts, comply with local regulations, and protect their margins. Companies worldwide rely on these tools to secure their digital checkout flows while expanding their global operations.
Here are real-world examples of how major enterprises use these technologies:
HUGO BOSS: Delivering a seamless omnichannel experience
HUGO BOSS worked with Adyen and Visa to unify its global shopping experience across 450+ stores. To address the challenge of balancing seamless retail with robust security, they implemented shelf-side checkout in stores and leveraged EMV 3D Secure and Visa Network Tokens online. This combination has helped them fight fraud while enabling a smooth, frictionless authentication process. By integrating these solutions, HUGO BOSS achieved higher authorization rates, fewer declines, and a more personalized, digital-first shopping journey for their global customers.
RMS: Streamlining hospitality with embedded payments
RMS, a cloud-native PMS platform, replaced fragmented gateways with a single payment infrastructure powered by Adyen. This integration helps their properties automate reconciliation, saving roughly 60 minutes daily, and significantly reduces disputes by 93%. By utilizing embedded solutions, RMS properties realize approximately $200k in annual savings, allowing them to focus on delivering superior guest experiences.
Bolt: Optimizing security and authorization with 3D Secure
Bolt, a leading mobility super-app, implemented EMV 3DS and network tokenization to enhance its global payment strategy. By sharing transaction data with issuers, Bolt has successfully improved its transaction approval rates, achieving a 90.14% approval rate and a €38.6 million revenue uplift in a year. This innovation allows Bolt to maintain a frictionless checkout experience while ensuring compliance with strong customer authentication (SCA) requirements.
How does 3D Secure work?
There are two different ways customers can verify themselves using 3D Secure: frictionless and challenge. The frictionless flow is based on background information that doesn't require the customer to actively verify themselves. The challenge flow means the issuer has determined the transaction needs additional verification from the customer.
Frictionless
The SDK and servers exchange all necessary information without involving the user.
Challenge
The user receives a request to provide two-factor authentication. Typically through an SMS code or with a personal password. The user can also use their face or fingerprint to provide biometric authentication.
The payment is only confirmed after the customer verifies themself.
The transaction doesn’t only rely on card details for verification. This means committing fraud is much more difficult if card details are stolen or there is a data breach on the merchant’s site.
3D Secure and chargeback liability shift
Another benefit with 3D Secure is that it allows businesses to protect themselves from fraudulent chargebacks through a "liability shift". Liability refers to the party responsible for financially compensating cardholders for fraudulent purchases.
A liability shift happens when a payment goes through the 3D Secure 2 challenge authentication flow and the liability for fraudulent chargebacks shifts from the business to the card issuer.
In some regions, card schemes may grant a liability shift after a successful frictionless flow too.
Frequently asked questions
1. Which card networks support 3D Secure?
3D Secure is supported by most major card networks. Consumers can recognise it with branded names like Visa Secure, Mastercard Identity Check, American Express SafeKey, J/Secure (JCB), or ProtectBuy (Diners Club International/Discover).
2. Is 3D Secure mandatory in Australia?
3D Secure is not mandatory in Australia. However, AusPayNet requires businesses above the fraud thresholds to implement 3DS2. The fraud thresholds are:
Above AUD 50,000 in fraud losses and,
Fraud-to-sales ratio of 0.2% and above for two consecutive quarters
Find out more here.
3. What is the equivalent of PSD2 in Australia?
PSD2 is the EU regulation for electronic payment services. It mandates strict security standards and protocols that banks and other financial service providers have to follow to participate in open banking.
Consumer Data Right (CDR) is Australia's answer to PSD2. CDR enables Australian consumers to safely share their data via bank data APIs that passes the Australian Competition and Consumer Commission's stringent accreditation process.
FAQ
3D Secure (Three-Domain Secure) is an online card payment authentication protocol that acts as an additional security layer to verify cardholder identity. It works by establishing a secure communication link between the merchant's financial institution, the card network, and the cardholder's bank during checkout.