Answer
What is 3D Secure?
Quick answer
3D Secure is an extra security check for online card payments: the customer's card issuer confirms it is really them, often invisibly and sometimes with a code or banking-app approval. If an authenticated payment is later disputed as fraud, liability usually shifts from the business to the issuer.
Updated October 2026. Evergreen page — refreshed in place as facts change.
Most customers have met 3D Secure without knowing its name: the moment a checkout hands over to their bank's app, or asks for a one-time code, before the payment goes through. For a business it is the most direct tool against the costliest kind of chargeback, the one where the cardholder says they never made the purchase.
How does 3D Secure work?
When a customer pays online, the checkout sends the payment and details about it (the device, the browser, the amount, the shipping address) to the card issuer before asking for authorization. The issuer scores the risk. If it is confident, it authenticates the payment silently, which is called the frictionless flow. If it is not, it challenges the customer to prove it is them, usually by approving the payment in the banking app, entering a one-time code, or using a fingerprint or face check.
The name comes from the three domains involved: the issuer's (the customer's bank), the acquirer's (the business's side) and the network that connects them. The current version, often called 3DS2, shares far more data with the issuer than the original did, which is why most authenticated payments now go through without the customer seeing a challenge.
| Frictionless flow | Challenge flow | |
|---|---|---|
| What the customer sees | Nothing extra; the payment completes | A prompt from their bank: app approval, one-time code or biometric check |
| When it happens | The issuer is confident from the data it received | The issuer wants proof, often on larger, unusual or first-time payments |
| Effect on checkout | None | A few seconds, and some customers abandon at this step |
| Fraud liability if disputed | Usually shifts to the issuer once authenticated | Usually shifts to the issuer once authenticated |
What is the 3D Secure liability shift?
Normally, when a customer's bank accepts a fraud dispute on an online payment, the business loses the sale and usually pays a dispute fee. If the payment was authenticated with 3D Secure, liability for that fraud dispute usually shifts to the issuer instead, because the issuer confirmed the cardholder.
The shift is about fraud, not every dispute. A customer who says the goods never arrived, or were not as described, can still file a chargeback on an authenticated payment, and the usual evidence rules apply. Card-network rules also carve out exceptions by business type and transaction, so treat the shift as strong protection for fraud claims rather than a guarantee.
What do the card networks call it?
3D Secure is one standard, but each card network brands its version. A customer may see any of these names during checkout, depending on their card.
| Card network | Program name |
|---|---|
| Visa | Visa Secure (formerly Verified by Visa) |
| Mastercard | Mastercard Identity Check (formerly SecureCode) |
| American Express | American Express SafeKey |
| Discover | ProtectBuy |
Is 3D Secure required?
In the US, no law requires it; whether to use it is a business decision. In the European Economic Area and the UK, Strong Customer Authentication rules require two-factor authentication on many online card payments, with exemptions such as low-value payments, and 3D Secure is the main way to meet them. A US business selling to European customers will see challenges on some of those cards whatever its own settings.
Apple Pay and Google Pay payments are confirmed on the customer's device with a fingerprint, face or passcode, which is one reason wallet payments rarely need a separate 3D Secure step.
When should a business require 3D Secure?
Every challenge costs a little conversion, so the usual approach is targeted: require 3D Secure where a fraudulent order would really hurt, and let smaller, routine payments through without the extra step.
- Above an amount where one fraudulent order would wipe out the margin on many good ones
- On goods that are easy to resell, such as electronics, gift cards and luxury items
- On first orders from new customers, or cards issued in countries you rarely sell to
- Temporarily, after a spike in fraud disputes, while you work out what changed
How 3D Secure works in Anytime Capital Payments
In Settings → Risk you set an amount, and card payments above it ask the customer to confirm with their card issuer; smaller payments go through with no extra step. It sits alongside the 0–100 risk score every card payment gets before it is charged, the option to block high scores, cards from countries you choose and payments above a maximum, and pre-dispute alerts that can refund small payments automatically before they become chargebacks.
All of it is included with Anytime Capital Payments rather than sold as an add-on. Our rate is on the pricing page.
Frequently Asked Questions
Does 3D Secure stop all chargebacks?
No. It protects against fraud disputes, where the cardholder says they did not make the payment, because liability usually shifts to the issuer once a payment is authenticated. Disputes for goods not received or not as described can still be filed, and need evidence such as proof of delivery.
Does 3D Secure hurt conversion?
Only when the customer is challenged, and with 3DS2 most authenticated payments go through without a challenge. Some customers do abandon at a challenge, which is why many businesses require 3D Secure only above an amount or on riskier orders rather than on everything.
What is the difference between 3D Secure 1 and 3DS2?
The original version sent customers to a separate password page on almost every payment and lost many sales. 3DS2 shares much more data about the device and the purchase with the issuer, so most payments are approved silently, and challenges work inside banking apps and on phones.
Do recurring payments need 3D Secure every time?
Usually not. The customer typically authenticates when they first save their card or start the subscription; later payments the business starts itself, such as a monthly renewal, generally go through without a new challenge, though an issuer can still ask for one.
What happens if a customer fails 3D Secure?
The payment is not completed. The customer can try again, use a different card, or pay another way, such as Apple Pay, Google Pay or a bank payment where the business offers it.
Is 3D Secure the same as the CVV code?
No. The CVV is the three- or four-digit code printed on the card, checked during authorization. 3D Secure is a separate step in which the card issuer itself confirms the cardholder, often through their banking app.
Keep reading
Important Disclosures
- Third-party fees and product details cited on this page are each company's published US pricing, or industry-typical ranges, as of the date shown and may have changed. Check current pricing with the provider before you decide.
- Information on this page is general and educational — it is not financial, legal, or tax advice.
- Anytime Capital is a fintech company, not a bank. Payment processing, banking and payout services are provided by Anytime Capital's licensed partners. Rates shown are for US card payments; international cards, currency conversion and disputes may carry additional fees shown in your dashboard before you accept a payment.