3D Secure and SCA Explained
What 3D Secure Does During Checkout
3D Secure is a protocol that lets the card issuer check that the person using a card online is the genuine cardholder. During checkout, the payment provider sends the transaction through the card network, which passes an authentication request to the issuing bank. The bank may then ask the customer to prove their identity before it approves the payment. The payment flow itself is described in what a payment gateway does.
Authentication can take several forms, such as a one-time code sent by text message, a confirmation in the bank's mobile app, a password, or a biometric check such as a fingerprint. In many low-risk cases the issuer approves the payment without a challenge. This is called a frictionless flow, and the customer sees no extra step.
Strong Customer Authentication and When It Applies
Strong customer authentication (SCA) is a legal requirement in the European Economic Area under the second Payment Services Directive (PSD2), and similar rules apply in other markets. It requires at least two independent factors from different categories: something the customer knows, such as a password; something they have, such as a phone; or something they are, such as a fingerprint.
SCA applies to most electronic payments where both the payer's bank and the merchant's payment provider are located in the region. There are exemptions for cases such as low-value payments, trusted beneficiaries, transactions judged low risk, and correctly set up merchant-initiated payments. Many exemption decisions rest with the issuer, so a shop should not assume one applies.
Effect on Conversion and Fraud Liability
3D Secure adds a step to checkout. If the challenge is slow, confusing, or fails on mobile, some customers will abandon the purchase. Well-built implementations keep challenges to the cases that need them and handle failures clearly. Checkout layout choices are covered in one-page and multi-step checkout.
The main benefit for a shop is liability. When a payment is properly authenticated, responsibility for many fraud chargebacks generally moves from the shop to the issuing bank. This does not stop every dispute, but it changes who bears the loss in many fraud cases.
Frequently asked questions
Do I have to use 3D Secure for every online payment?
Not always. In regions with SCA rules, most online card payments must be authenticated unless an exemption applies. Elsewhere, a shop can choose to use 3D Secure to reduce fraud, and the provider may request it based on risk. Subscriptions and repeat charges need their own setup, which should be checked with the payment provider.
What does a 3D Secure challenge mean for my customer?
A challenge means the card issuer wants to confirm that the customer is the cardholder before approving the payment. It may ask for a one-time code, an approval in a banking app, or a password. The payment is not complete until the customer passes the challenge, and if it is not completed, the payment is normally declined.