3D Secure & 3D Secure 2.0 (3DS2): What You Must Know 2026

3D Secure (3DS) is an authentication step that asks the card issuer to confirm a shopper's identity before an online card payment goes through. 3D Secure 2.0 (3DS2) is the newer version: it shares far more data with the issuer, so most payments are approved in the background without any extra step for the shopper.

As ecommerce grows and shoppers pay from more devices, fraud is growing too. Keeping online transactions safe matters to consumers and businesses alike. At the same time, shoppers don't want a fast checkout to become slow and clunky.

The challenge is to offer a secure checkout without giving up speed. This article explains how 3D Secure and 3DS2 work and why they matter for your ecommerce business.

What is 3D Secure?

If you've ever been redirected to your bank's website and asked for a password or one-time code while shopping online, you've used 3D Secure. It adds an extra layer of security by asking the issuing bank to verify the cardholder's identity.

3D Secure also shifts liability for fraudulent chargebacks from the merchant to the bank, protecting merchants from unnecessary losses.

The problem with the original protocol was its often-confusing authentication step. Many shoppers simply gave up and abandoned their carts, and businesses lost sales.

How does 3D Secure authentication work?

For the shopper, 3D Secure means entering a personal code during checkout. If they aren't enrolled in their bank's 3D Secure program yet, they're redirected to the bank's site and offered the chance to sign up.

Behind the scenes, the protocol uses a three-domain model (hence the name 3D). It adds a security layer between the bank's authorisation and the merchant's online authentication. The three domains are:

• Acquirer domain: the bank and the merchant receiving the payment.
• Issuer domain: the bank that issued the card used for the transaction.
• Interoperability domain: the infrastructure that supports the 3D Secure protocol used by the card.

In short, the customer enters their card details and then proves who they are with a code only they should know. The issuing bank verifies the code and takes on responsibility if the charge turns out to be fraudulent.

What is 3D Secure 2.0?

3DS2 was introduced to fix the problems of the original 3D Secure. It's more user-friendly and better at detecting and preventing fraud.

It shares information in real time between merchants, payment networks and banks. That lets transactions be authenticated more accurately without hurting the checkout experience.

Merchants using 3DS2 share about 10 times as much data, which speeds up authentication and improves security. With that extra context, issuers can often verify the cardholder without asking them to type a password.

What is 3DS1?

3DS1 was the original 3D Secure protocol, which required high-risk transactions to be authenticated. Merchants could choose whether to use it and for which transactions.

Its big downside was the added friction for customers. It also wasn't mobile-friendly, a serious problem when so many purchases happen on mobile devices.

What is 3DS2?

3DS2 was built to improve on 3DS1 and fix its weaknesses. It improves the user experience in three ways:

• More data: over 100 data points go from the merchant to the card issuer, so the issuer can better judge how risky a transaction is. Most transactions are authenticated automatically, with no action from the customer.
• Less friction: when a check is needed, it can happen on the checkout page itself, using biometrics or one-time passwords. A smoother checkout means more sales.
• Mobile optimisation: iOS and Android both have native payment options that make the mobile experience smoother.

The value of 3DS2 is that it puts the customer experience first. Merchants keep customers while still protecting themselves from fraud and chargebacks.

How do 3DS2 payments work?

A 3DS2 payment follows these steps:

1. The cardholder enters their card details to pay.
2. The merchant's 3D Secure provider sends the transaction data and an authentication request to the card issuer.
3. The issuer's 3D Secure provider assesses the risk of the transaction:
   • If it's high risk, the customer is asked for extra verification (fewer than 5% of transactions).
   • If it's low risk, no action is needed from the customer (about 95% of transactions).
4. The issuer sends the authentication result back to the merchant.
5. The merchant submits the transaction for authorisation, including the authentication result.

When a cardholder does need to verify their identity, they provide one of three things:

• Something they have: confirmed by data from the device they're using.
• Something they know: such as their bank login or a one-time password.
• Something they are: confirmed with biometrics.

Device data is collected without the shopper noticing, and in most cases that alone is enough to authenticate the payment. Even when more is needed, it can stay frictionless: a fingerprint or an approved saved password is often all it takes.

Is 3DS2 mandatory everywhere?

No. 3DS2 is recommended but not yet mandatory worldwide.

In Europe, the Payment Services Directive (PSD2) sets rules for accepting payments. One of its main requirements is Strong Customer Authentication (SCA), and 3DS2 makes SCA compliance easy.

Brazil and Australia have also adopted SCA mandates, making 3DS2 more popular there. Other countries are likely to follow as the need for secure online payments grows.

How to activate 3DS2

To use 3DS2, merchants need to work with a 3DS2 service provider that integrates the protocol into their payment infrastructure.

Are there limitations to 3D Secure and 3DS2?

The original 3D Secure had two main limitations. The first was the difficult checkout experience described above. The second was that card issuers were often overly cautious and declined legitimate transactions as potential fraud.

3DS2 addresses both, and it's a good solution for merchants in Europe and other regions where it's mandatory. If you're not required to use it, consider a few limitations first:

• Adaptability: many card issuers haven't updated their fraud detection technology in years. Having access to 3DS2 doesn't mean they use it well, so expect some glitches.
• Proof: 3DS2 is still relatively new, so there's limited hard data on whether it increases sales and conversion rates.
• Providers: not all 3DS2 providers are equal. Some have more experience than others. Make sure you get access to all the data points collected, which can give you useful insight into customer behaviour.

Benefits of 3D Secure and 3DS2

3DS2 also brings clear benefits:

• Higher authorisation rates: with more data, issuers assess risk better, approve more legitimate transactions and block only the fraudulent ones.
• Better customer experience: in most cases, authentication happens in the background. When an extra check is needed, an SMS code, password, fingerprint or face scan keeps it quick.
• Faster transactions: checkout is up to 85% faster than with 3DS1.
• Fewer abandoned carts: shoppers are far more likely to finish a purchase when authentication isn't a burden.
• Liability shift: if a fraudulent charge is mistakenly approved, liability moves from the merchant to the issuing bank.
• Regulatory compliance: 3DS2 makes it easy to meet SCA rules, especially in countries covered by PSD2.

What Pay.com offers

Pay.com makes it easy to add 3DS2 to your payment infrastructure. Your customers get the smooth checkout they expect, and every transaction stays secure and protected from fraud.

With Pay.com, you don't have to track changing regulations. We keep the system up to date and make sure you stay compliant, so you can focus on bringing in customers while we handle what happens behind the scenes.