How 3-D Secure works
At checkout, the merchant's 3-D Secure software sends the issuer details of the payment, the card and the buyer's device. EMVCo describes two flows. In the frictionless flow, the issuer accepts the payment on a real-time risk assessment and does not challenge the buyer.
In the challenge flow, the issuer asks the buyer to confirm, for example with a one-time passcode or an approval in the banking app. Visa's programme is Visa Secure and Mastercard's is Mastercard Identity Check.
3-D Secure and strong customer authentication
PSD2 requires strong customer authentication when a payer initiates an electronic payment (Article 97). The EU's technical standards, Delegated Regulation (EU) 2018/389, list exemptions, and an exempt payment can pass through 3-D Secure without a challenge. The UK keeps its own version of the standards in the FCA Handbook.
- Low value, EU: up to EUR 30, until EUR 100 or five payments have passed since the last authentication (Article 16).
- Transaction risk analysis, EU: up to EUR 100, EUR 250 or EUR 500, where the provider's fraud rate on remote card payments is at most 0.13%, 0.06% or 0.01% (Article 18).
- Recurring payments of the same amount to the same payee, after the first (Article 14).
Who bears a fraud loss
In EU law, where the payer's provider does not require strong customer authentication, the payer bears no loss unless the payer acted fraudulently. A payee, or its provider, that fails to accept strong customer authentication refunds the damage to the payer's provider (PSD2, Article 74).
The schemes' dispute rules add what is known as the liability shift. In the Visa Core Rules (11.7.5.3), an issuer's fraud dispute on an online payment is invalid where the issuer authenticated the cardholder through Visa Secure with EMV 3DS and the authentication value was in the authorisation request. For the Europe Region, Mastercard's Transaction Processing Rules state that the liability shift applies to EMV 3DS, and refer to its Chargeback Guide for the terms.
3-D Secure versions in 2026
EMVCo's specification bulletins of 11 August 2025 cover versions 2.2.0 to 2.3.1.1. A first draft of version 2.4.0.0 was open for comment until 1 July 2026 and was not final on 13 October 2026. EMVCo recommends version 2.2 or higher, and in Mastercard's Europe Region issuers enrol their e-commerce card ranges in EMV 3DS 2.2 (Mastercard Rules, Europe Region, 6.1).
3-D Secure, SCA or the card security code?
- Strong customer authentication
- The legal requirement: two or more independent elements from knowledge, possession and inherence (PSD2, Article 4(30)). 3-D Secure is the card protocol that carries it out online.
- Card security code
- The three or four digits printed on the card. Checking the code shows that the buyer has the card's details, not that the buyer is the cardholder.
- Liability shift
- A rule in the schemes' dispute procedures. It concerns fraud disputes on authenticated payments, not disputes about the goods or the service.
Where 3-D Secure shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
Platforms that need it
Guides that go deeper
- Crypto on-ramps: how a buy widget works and who needs the licenceHow a fiat-to-crypto buy widget works inside another company's app, who the regulated party is, and the rules on UK promotions, card fraud, the Travel Rule, MiCA and VARA.
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
- How to launch a business account with expense cards for SMEsThe account, the cards and the controls around them: what a business account with expense cards needs, from licensed partners and KYB to SCA and the interchange rules for commercial cards.
Where it is written
The laws and standards this page's facts come from.
- EMVCo, EMV 3-D Secure, with the specification bulletins
- Directive (EU) 2015/2366, PSD2, Articles 4(30), 74 and 97 (EUR-Lex)
- Delegated Regulation (EU) 2018/389, the technical standards on strong customer authentication (EUR-Lex)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: 11.7.5.3 and the glossary, Visa Secure (Visa)
- Mastercard Rules, 2 June 2026, and Transaction Processing Rules, 9 June 2026: Europe Region (Mastercard)
General information, not legal advice: what applies to you depends on your services and your market.