Article
3D Secure: Balancing fraud prevention with conversion
3D Secure strengthens security, cuts down on fraud, and keeps the experience smooth for your customers.
Payment authentication has a reputation problem: too many redirects, too few authorised payments. 3D Secure 2 changes that, raising the bar on authentication while keeping the payment experience smooth for your customers.
While 3D Secure is a requirement in countries covered by PSD2, its value extends beyond compliance. Any business, anywhere, can use it to guard against fraud, improve the customer experience, and avoid the costs that come with fraudulent chargebacks.
This article looks at the wider benefits of payment authentication and how the flow actually works.
A quick reminder of what 3D Secure is
3 Domain Secure (3DS) is a security measure for online payments. The 3 domains (acquirer, scheme, and issuer) interact with each other using a 3DS protocol where they exchange information and authenticate the transaction.
3D Secure helps prevent fraud and is available for Card Not Present (CNP) transactions with all major card networks, and is mandatory in the EU, following the Revised Payment Services Directive (PSD2).
3D Secure explained
How does 3D Secure work in the UK?
In the UK, it's mandatory under the UK's Payment Services Regulations, the UK's own version of Strong Customer Authentication (SCA) requirements. Adyen supports 3DS2 across your setup and helps you manage exemptions, such as low-value transactions and secure corporate payments, so you're not trading conversion for compliance.
Benefits of 3D Secure
The benefits of 3D Secure include:
Lower fraud rates
Higher card authorization rates
Fewer lost sales compared to older authentication methods
The first version of 3D Secure was slow and forced customers onto external banking pages. 3D Secure 2 (3DS2) fixes these issues. 3DS2 is built for mobile-first commerce and runs authentication in the background to keep the checkout experience smooth.
Benefits of 3DS2:
Frictionless native authentication: Customers verify payments directly in your app or website without external redirects, which means fewer abandoned carts.
Smarter risk decisions: Over 150 data points, including device details and transaction history, are shared between merchants and banks, leading to highly accurate, instant risk assessments.
Faster verification: Customers can verify themselves using face scans, fingerprints, or SMS codes instead of remembering complex passwords.
Delegated authentication: Merchants can handle strong customer authentication directly inside their checkout via a 3D Secure API or by using delegated authentication, maintaining full control over the user experience.
With these features, 3D Secure 2 helps you protect your revenue from chargeback fraud while improving overall payment performance.
How does 3D Secure work?
3D Secure works by checking transaction data in the background and only prompting the cardholder to actively verify themselves if a transaction seems high-risk. This selective process ensures that legitimate, low-risk transactions are completed instantly, while suspicious actions are flagged for review.
The protocol routes each payment through one of two authentication paths:
The frictionless flow: The merchant and card issuer exchange data points behind the scenes. If the data looks normal, the issuer authenticates the transaction instantly without asking the customer to do anything.
The challenge flow: If the bank needs more proof, it triggers a quick verification step. The customer completes this step using biometrics (like a fingerprint) or a one-time SMS code.
The transaction is completed only after the identity is confirmed. This keeps fraud low even if a shopper's card details are compromised.
How does 3DS create a chargeback liability shift
Implementing 3D Secure also protects your business financially through a "liability shift." Normally, merchants are responsible for the costs of fraudulent card transactions. When a payment is authenticated using a 3D Secure challenge, the financial responsibility for fraudulent chargebacks shifts from your business to the card-issuing bank. This safeguards your bottom line against card abuse and friendly fraud.
3D Secure examples
3D Secure examples show how different businesses use intelligent authentication to secure checkouts, comply with local regulations, and protect their margins. Companies worldwide rely on these tools to secure their digital checkout flows while expanding their global operations.
Here are real-world examples of how major enterprises use these technologies:
HUGO BOSS: Delivering a seamless omnichannel experience
HUGO BOSS worked with Adyen and Visa to unify its global shopping experience across 450+ stores. To address the challenge of balancing seamless retail with robust security, they implemented shelf-side checkout in stores and leveraged EMV 3D Secure and Visa Network Tokens online. This combination has helped them fight fraud while enabling a smooth, frictionless authentication process. By integrating these solutions, HUGO BOSS achieved higher authorization rates, fewer declines, and a more personalized, digital-first shopping journey for their global customers.
RMS: Streamlining hospitality with embedded payments
RMS, a cloud-native PMS platform, replaced fragmented gateways with a single payment infrastructure powered by Adyen. This integration helps their properties automate reconciliation, saving roughly 60 minutes daily, and significantly reduces disputes by 93%. By utilizing embedded solutions, RMS properties realize approximately $200k in annual savings, allowing them to focus on delivering superior guest experiences.
Bolt: Optimizing security and authorization with 3D Secure
Bolt, a leading mobility super-app, implemented EMV 3DS and network tokenization to enhance its global payment strategy. By sharing transaction data with issuers, Bolt has successfully improved its transaction approval rates, achieving a 90.14% approval rate and a €38.6 million revenue uplift in a year. This innovation allows Bolt to maintain a frictionless checkout experience while ensuring compliance with strong customer authentication (SCA) requirements.
How customers can verify themselves
There are two different ways customers can verify themselves: frictionless and challenge. The frictionless flow is based on background information that doesn't require the customer to actively verify themselves. The challenge flow means the issuer has determined the transaction needs additional verification from the customer.
Frictionless
The SDK and servers exchange all necessary information without involving the user.
Challenge
The user receives a request to provide two-factor authentication. Typically through an SMS code or with a personal password. The user can also use their face or fingerprint to provide biometric authentication.
The payment is only confirmed after the customer verifies themself.
The transaction doesn’t only rely on card details for verification. This means committing fraud is much more difficult if card details are stolen or there is a data breach on the merchant’s site.
3D Secure and chargeback liability shift
Another benefit of this protocol is that it allows businesses to protect themselves from fraudulent chargebacks through a ‘’liability shift.’’ Liability refers to the party responsible for financially compensating cardholders for fraudulent purchases.
A liability shift happens when a payment goes through the 3DS2 challenge authentication flow and the liability for fraudulent chargebacks shifts from the business to the card issuer.
In some regions, card schemes may grant a liability shift after a successful frictionless flow too.
Key summary
Modern authentication is seamless: 3D Secure 2 replaces clunky redirects and static passwords with background risk evaluation and native mobile biometrics.
Liability shift secures revenue: Authenticated transactions transfer the financial responsibility for fraudulent chargebacks from the merchant to the card issuer.
Smart routing boosts authorization: Machine learning dynamically decides the best path, letting low-risk payments pass silently and challenging only suspicious actions.
Global compliance is automatic: Partnering with an advanced payment platform ensures seamless compliance with complex mandates like PSD2 SCA and future PSD3 regulations.
FAQ
3D Secure (Three-Domain Secure) is an online card payment authentication protocol that acts as an additional security layer to verify cardholder identity. It works by establishing a secure communication link between the merchant's financial institution, the card network, and the cardholder's bank during checkout.