3-D Secure is a check that runs during an online card payment, usually before the bank decides whether to approve it. The shopper may get a prompt from their bank (a push notification in the bank app, a one-time code, or a face or fingerprint scan) to prove they are the genuine cardholder. This is a message leg, not a money leg: nothing is being paid in this step, the parties are just exchanging proof of identity. When 3DS is used and the cardholder is authenticated, liability for certain fraud can shift from the merchant to the card issuer, which is the main reason merchants enable it. In Europe, a rule called Strong Customer Authentication (SCA) makes this kind of step mandatory for many online payments; elsewhere it is often optional and risk-based.
In a flow
It sits inside the authorization step of a card payment, before the issuer approves or declines. The merchant or gateway routes an authentication request through the card network's 3DS service to the issuer; the issuer challenges the cardholder if needed and returns a result. Only after that does the normal authorization (and later clearing and settlement, when banks actually move money) proceed.
Common misconceptions
Myth: 3-D Secure charges the card.
Reality: It only authenticates the cardholder. No money moves during 3DS. The actual charge happens in authorization and later settlement, which are separate steps handled by the banks.
Myth: Passing 3DS guarantees the merchant can never lose a dispute.
Reality: A successful 3DS check typically shifts liability for certain fraud-type chargebacks to the issuer, but disputes over non-delivery, quality, or other reasons can still come back to the merchant.
Related terms
See it in a guide
Sources
- EMVCo 3-D Secure specifications ↗ · EMVCo (operator). Maintains the EMV 3DS specification used across card networks.
- Visa Secure (3-D Secure) ↗ · Visa (operator)
- Mastercard rules and standards ↗ · Mastercard (operator)
Educational, plain-English explainers. Not legal, compliance, tax, or financial advice. These cover fundamentals, not current fees, limits, or rates (which change). Rails and parties vary by program and country, so verify specifics against primary sources. Last reviewed June 2026.