3D Secure

3D Secure (3DS) is a security protocol for online card payments in which the customer's bank checks that the payer really is the cardholder, for example through a confirmation in the banking app. It is the standard way to meet the strong customer authentication required by PSD2 for card payments. To see how it fits into your full payment setup, read our guide to Shopify payments.

In short

With a 3D Secure payment, your customer's bank decides whether an extra confirmation is needed.

With 3DS2 many payments go through without an extra step; a check only follows when the risk is higher.

An authenticated payment shifts liability for fraud to the bank.

How does a 3D Secure payment work?

Customer enters their card details in the Shopify checkout.

Checkout and payment provider send transaction, card and device data to the customer's bank.

Bank assesses the risk. Low risk: the payment goes through straight away (frictionless). Higher risk: the customer gets a check (challenge).

Challenge: the customer confirms in their banking app, with a one-time code or biometrics.

Authorisation: the bank approves or declines, and the order is created.

Payout: the money reaches your account according to your payout schedule.

For that check the customer is briefly sent to their bank's environment and then back to your checkout. When paying in an app, this usually happens through a notification on their smartphone.

3DS2: less friction than the first version

The first version of 3D Secure asked for a password or code on almost every payment. The current version, EMV 3-D Secure or 3DS2, shares more data about the transaction, the payment method and the device with the bank. As a result, the bank can approve many low-risk payments without an extra step. EMVCo recommends version 2.2 or higher; the European Banking Authority recognises version 2.0 and higher for strong customer authentication under PSD2.

3D Secure on Shopify

Shopify Payments uses 3D Secure automatically, though only when your customer's bank requires it to approve the payment. So you don't need to switch it on yourself, and payments without a risk signal get no extra step. If you use another provider that needs 3DS, Shopify names Cardinal as the 3DS solution.

The biggest benefit for you is the liability shift: with an authenticated payment, the customer's bank bears the cost of a chargeback for fraud. That protection has limits. If you get too many fraud chargebacks, card networks can withdraw it; at Visa that happens above USD 7,500 in fraud chargebacks per month. The 3D Secure result is also useful evidence if you do have to respond to a dispute.

What does 3D Secure do to your conversion?

Every extra step in your checkout is a moment when a customer can drop off: the banking app doesn't respond, the code arrives too late or the customer is on a different device. 3DS2 limits this by only asking for checks when needed. So if successful card payments suddenly drop, look at your payment methods too: Bancontact and iDEAL | Wero are confirmed in the banking app by default and feel more familiar than a card to many Belgian and Dutch customers. A card payment also carries different transaction fees than a local method; it's best to include that calculation in your total Shopify costs.

Frequently asked questions

What is 3D Secure?

3D Secure is an extra check on online card payments. The customer's bank checks that the payer is the cardholder, often with a confirmation in the banking app. Visa and Mastercard each use their own name for it.

What is a 3D Secure password?

With the first version of 3D Secure, you set a fixed password as a cardholder. Today you usually confirm a payment in your banking app or with a one-time code. You set this up with your bank.

Why does a 3D Secure verification fail?

Usually because the confirmation isn't completed in time, the code is wrong or the banking app isn't linked to the card. The customer is best off trying again or choosing another payment method.

Can you pay without 3D Secure?

Yes, if the bank doesn't ask for a check. For small amounts and low-risk payments the bank may skip the extra step. With Shopify Payments that decision lies with the bank.

3D Secure is how online stores meet the strong customer authentication rules of PSD2. If a payment is disputed anyway, our explanation of a chargeback covers what happens next.