What Is 3D Secure? How 3DS Authentication Works for Card Payments

3D Secure is an extra layer of authentication on online card payments, where the bank that issued the card confirms that the buyer is the real cardholder, sometimes with a one-time code. Three parties take part in every check: your side of the payment, the card issuer, and the card network that connects the two.

Most low-risk payments pass without any prompt, while higher-risk ones ask the shopper for a code, a fingerprint or an approval in a banking app. Because a successful check can move liability for fraud disputes from you to the issuer, it also changes who pays when someone uses a stolen card.

You will often see it shortened to 3DS, and each card network sells it under its own name. Knowing how the check runs and where rules require it helps you read checkout failures, and it explains why Indian cardholders can meet a different checkout at an overseas merchant.

3D Secure, often written 3-D Secure and expanded as Three-Domain Secure, is a messaging standard that lets the card issuer check the shopper before a card-not-present payment goes ahead. Visa introduced the first version in 2001, and EMVCo, the card industry's standards body, now maintains the current version, known as EMV 3DS.

The three domains are the three parties that exchange messages during the check:

• Your side (the acquirer domain) - your payment provider or acquirer runs a 3DS server, called a merchant plug-in in the first version, which collects payment and device data and starts the request.
• The card network - the network's directory server receives the request and routes it to the issuer that holds the card account.
• The issuer domain - the bank that issued the card runs an access control server, which scores the risk and decides whether the shopper has to do anything.

The code screen a shopper sees is only one possible step inside 3DS verification, and many payments finish without one.

From the moment a shopper clicks Pay, 3DS authentication runs in five steps, with the issuer making the key decision:

1. The shopper clicks Pay - your payment provider sends data about the transaction, the payment method and the shopper's device.
2. Routing through the card network - the network's directory server passes the request to the issuer's access control server.
3. Risk scoring - the issuer reviews the data and decides what kind of authentication the payment needs.
4. Approval or a challenge - the issuer either approves in the background or asks the shopper to confirm, then returns the result.
5. Authorisation follows - your acquirer sends the normal authorisation request with the result attached, and the issuer approves or declines.

Authentication and authorisation are two separate decisions. A shopper can pass 3D Secure authentication and still be declined for low funds or a blocked card, which matters when you read your decline reports.

Low-risk flow and challenge flow, and when the customer sees a code

When the issuer judges a payment low risk, it approves it in the background. The shopper simply clicks Pay and sees nothing extra. In the challenge flow, the issuer asks for proof: a one-time passcode, knowledge-based questions, biometrics or another method it chooses.

Visa also offers a data-only mode, in which your payment provider shares payment data with the issuer without an authentication step. The issuer decides which flow a shopper gets. What you control is the data you send, because richer device and transaction data gives the issuer more to approve on.

3DS1, the first version, sent shoppers to a separate page to type a static password before the payment could go through. EMV 3DS, also called 3DS2 or 3DS 2.0, replaced it and covers versions 2.1, 2.2 and 2.3.1.

The current standard was published in October 2016. Visa switched off 3DS1 on 15 October 2022, and India was among the markets excluded from that date. Elsewhere, merchants still on the old version carried the fraud liability themselves.

What 3DS2 changed compared with the first version

The second generation changed how the check decides and how the shopper experiences it:

• Risk-based checks - the issuer scores each payment from the data your payment provider shares, instead of asking every shopper for a password.
• Phones and apps - 3D Secure 2 supports in-app and mobile checkouts, where the first version relied on browser pages and redirects.
• More ways to confirm - one-time passcodes, biometrics and other methods replaced the single static password.
• Less friction - more low-risk payments pass without interruption, for issuers and merchants alike.

Visa Secure, Mastercard Identity Check and the other network names

Every network runs 3D Secure under its own programme name. Your shoppers may see Visa Secure, which replaced the older Verified by Visa name, Mastercard Identity Check, known earlier as Mastercard SecureCode, or American Express SafeKey on the challenge screen. For RuPay, the Indian card network run by the National Payments Corporation of India (NPCI), the service is NPCI SecureNxt.

A liability shift means that when an authenticated payment later turns out to be fraud, the card issuer, and not you, can carry the loss from the fraud dispute, because the issuer checked the buyer.

3D Secure was also designed to cut fraud and false declines, which helps you approve more genuine shoppers. Without any authentication attempt, the fraud loss on a stolen-card payment generally stays with you. For you, 3D Secure is a trade: an extra step for some shoppers, in return for protection when a stolen card is used and the real cardholder disputes the payment.

When fraud liability moves to the issuer and where it stops

Under Visa's dispute rules, the protection has firm limits:

• Fully authenticated payments - a payment the issuer fully authenticated can qualify for protection from fraud-related disputes.
• Attempted authentication - where you attempted it and the issuer did not take part, the payment can still qualify, except on non-reloadable prepaid cards.
• No authentication - a payment with no authentication attempt carries no fraud protection.
• Fraud disputes only - claims that goods never arrived or did not match the description are not covered.
• Data and monitoring conditions - the authentication data must reach the authorisation message, and merchants in a Visa fraud monitoring programme can still face fraud disputes.

Mastercard and the other networks run their own rules, and terms vary by region. Confirm yours with your acquirer. For the dispute side, see how a chargeback is raised and answered.

The drawbacks of 3DS: friction at checkout and failed codes

The main cost of 3D Secure is the extra step. A code that arrives late or a pop-up that will not load can end a purchase. The current version was built to reduce that friction by approving low-risk payments without a prompt.

The other cost is that you do not control the outcome. Each issuer sets its own risk rules and challenge methods. The same checkout can feel smooth for one card and slow for another.

Whether you must authenticate card payments depends on where you sell and where the cards your shoppers use were issued. In the EU, the second Payment Services Directive (PSD2) makes strong customer authentication the legal rule, and the UK applies its own version. Online card payments commonly meet it through 3D Secure, although the rules do not name a single method.

Some merchants take card payments without any authentication step and accept the fraud risk themselves. If you are weighing that route, read how a 2D payment gateway works and when it fits.

When an Indian-issued card pays your business abroad, the Indian issuer applies its own Reserve Bank of India (RBI) checks, whatever your own market requires. Under the RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issuers had to be ready by 1 October 2026 to validate one-off overseas online card payments when the merchant asks for it, and to risk-check all of them. As of November 2026, that means an Indian issuer can decline a payment that does not clear its check.

Issuers also had to register each card BIN (bank identification number) with the card networks. The rule grew out of a February 2025 RBI proposal to extend its Additional Factor of Authentication (AFA) to international online card payments.

A "3D Secure authentication failed" or "3DS authentication failed" message usually traces to one of the problems below, and each one is fixed by a different party.

A worked example

- a German software company sells an annual plan to a buyer paying with an Indian card. Because the card was issued outside the EEA, strong customer authentication applies only on a best-efforts basis.

If the payment provider sends an authentication request, the buyer may get a code; if not, the issuer can still decline after its own risk check.

Subscription renewals on Indian cards

These renewals follow their own RBI rule, separate from the one-off payment rule. See the RBI e-mandate guide before you set up recurring billing.

Xflow helps overseas businesses accept payments from customers in India, whether you sell software, courses, travel or subscriptions to Indian buyers. Your customers pay with methods they already use at home, and you receive settlement in two business days (T+2).

Indian buyers can pay by card, RuPay, UPI, UPI AutoPay, card mandates, e-NACH or netbanking. See how to accept international payments from India with Xflow.

3D Secure lets the card issuer confirm the buyer before an online card payment goes through. Three points matter most for your checkout:

• Most payments pass quietly - the issuer approves low-risk payments without a prompt and challenges the rest with a code or app approval.
• Liability can move - a successful check can shift fraud dispute losses to the issuer, though disputes over delivery or quality stay with you.
• Indian cards add a check - Indian issuers run their own RBI risk check on every overseas payment, whatever your market requires.