3D Secure / EMV 3DS
The cardholder authentication protocol for card-not-present transactions. 3DS2 adds frictionless, decoupled, and challenge flows while enabling SCA compliance under PSD2 and reducing CNP fraud liability.
What is 3D Secure?
3D Secure (3DS) is the global card authentication protocol for card-not-present transactions. It reduces fraud by verifying the cardholder's identity at the time of purchase and shifts liability from the merchant to the card issuer when authentication succeeds. The "3 domains" are the issuer domain, the acquirer domain, and the interoperability domain (the card scheme).
3DS 1.0 (2001)
- Browser-only redirect to issuer page
- Static password or knowledge-based challenge
- High cart abandonment rates (~50-70%)
- No device fingerprinting or risk scoring
- MPI (Merchant Plug-In) on merchant side
- Payer Authentication Request (PAReq) / Response (PARes) messages
EMV 3DS 2.x (2016+)
- Native SDK (iOS/Android) and browser iframe support
- Frictionless flow — no cardholder interaction for low-risk transactions
- 100+ data elements sent to issuer for risk-based authentication
- Challenge flow with OTP, biometric, or out-of-band methods
- Decoupled authentication (async, up to 1 hour)
- AReq/ARes/CReq/CRes/RReq/RRes message types
Spec and certification status (Sept 2026): the current EMV 3DS release is 2.3.1.1; a 2.4 draft (Protocol & Core) is with EMVCo Associates. Most US processors still run 2.2, so check which fields your ACS/3DS Server pair actually supports before relying on 2.3 features such as decoupled authentication and SPC.
PCI 3DS SDK sunset: the standalone PCI 3DS SDK Security Standard is in a formal sunset period from 1 May to 31 October 2026 and becomes a module of the PCI Secure Software Standard — new SDK evaluations should target that module. EMVCo's own 3DS approval for 2.1.0 has already been retired; the 3DSA regression-testing approach now applies to all 2.3.1 components.
Liability Shift Rules
| Scenario | Auth Result | Fraud Liability |
|---|---|---|
| Full 3DS authentication | transStatus = Y, valid CAVV | Issuer |
| 3DS attempt (issuer not participating) | transStatus = A | Shared / Issuer |
| 3DS not attempted (merchant eligible) | No 3DS | Merchant / Acquirer |
| Failed authentication | transStatus = N | Merchant / Acquirer |
🧩 Check yourself
Can you authenticate and authorize an online payment in the right order?
Next steps
Related articles
Common questions
What is 3-D Secure?
3-D Secure (EMV 3DS) is the authentication protocol for card-not-present payments: the merchant requests authentication, the issuer's ACS assesses risk, and the cardholder is authenticated frictionlessly or via a challenge before authorization.
What is the difference between frictionless and challenge flow?
In the frictionless flow the issuer authenticates from the risk data in the AReq with no cardholder interaction. A challenge flow steps the cardholder up to an OTP, app push, or biometric when risk or regulation requires it.
What is a CAVV?
The Cardholder Authentication Verification Value is the cryptographic proof that authentication happened; it travels in the authorization message so the issuer can verify the transaction was 3DS-authenticated.
Does 3DS shift chargeback liability?
Generally yes — for successfully authenticated transactions, fraud chargeback liability shifts from the merchant to the issuer, subject to scheme rules.
What is the difference between 3DS1 and 3DS2?
3DS1 redirected every cardholder to a password page in the browser. 3DS2 sends the issuer over 100 data elements so most payments are approved without a challenge (frictionless), supports mobile apps through an SDK, and asks for a challenge only when the risk calls for it. The major networks retired 3DS1 in October 2022.
What is the 3DS SDK?
An EMVCo-certified component embedded in a merchant’s mobile app. It collects device data for the issuer’s risk assessment and shows challenges natively in the app instead of a web page.
Which 3D Secure 2 versions are in use?
Version 2.2.0 is the most widely deployed and 2.3.1 is the latest EMVCo release; the major networks stopped supporting 2.1.0 in September 2024.