In this article
Talk to our experts- 3D Secure
- 3D Secure (3DS) is an authentication protocol for online card payments. At checkout, the merchant sends the card issuer data about the transaction, the payment method and the device. The issuer uses it to authenticate the cardholder and approve the purchase, and for higher-risk transactions it can require a challenge such as a one-time passcode.
Also called: 3-D Secure, 3DS, EMV 3DS
How it works
3D Secure is an e-commerce fraud prevention protocol that enables consumer authentication for card-not-present (CNP) purchases. That is how EMVCo, which maintains the EMV 3DS Specifications, describes EMV 3-D Secure. It enables the exchange of data between the merchant and the payment card issuer to verify that the individual making a purchase with a payment card is the legitimate user of the card.
EMVCo describes the process for e-commerce purchases this way:
How a 3D Secure payment is authenticated
A consumer uses a payment card to make an online purchase on a mobile phone, tablet, laptop or other device.
The merchant sends the card issuer data about the transaction, payment method and device.
The issuer uses this data to authenticate the consumer and approve the transaction; for many transactions the consumer simply clicks Buy.
For higher-risk transactions, the issuer may require a challenge, such as a one-time passcode, knowledge-based questions or biometrics.
EMVCo says the specifications let merchants integrate authentication into their checkout for both app- and browser-based implementations. It collaborates with the PCI Security Standards Council on the security evaluation of EMV 3DS solutions.
3D Secure and PSD2
Shopify's help page on PSD2 says the Revised Payment Service Directive (PSD2) was introduced in all countries in the European Economic Area (EEA) and the United Kingdom, and that it introduces strict security requirements for electronic payments to reduce the risk of fraud. EMVCo notes that a European Banking Authority opinion published on 21 June 2019 recognised protocols such as EMV 3DS as a means for merchants and issuers to support strong customer authentication (SCA), and that EMV 3DS supports SCA by enabling two-factor authentication.
On versions, EMVCo says that while EMV 3DS 2.1 supports SCA, it recommends v2.2 or higher to access the optimum functionality.
3D Secure vs. PCI DSS
The two are often mentioned together, but they do different jobs:
- 3D Secure authenticates the cardholder during an online card purchase, through a data exchange between the merchant and the card issuer.
- PCI DSS is a data security standard. It sets a baseline of technical and operational requirements to protect payment account data wherever it is stored, processed, or transmitted.
Example
A distributor sells on its online store to contractors who pay with company cards.
- Order 1, $1,200: a repeat buyer checks out from a known device. The issuer reviews the transaction data and approves it, and the buyer only clicks Buy.
- Order 2, $9,800: a first order from a new device. The issuer decides the risk is higher and asks for a one-time passcode. The buyer enters it and the payment is approved.
In this example the issuer, not the distributor, chooses which order gets the extra step.
On Shopify
Shopify describes 3D Secure as an additional security layer for online credit and debit card transactions that redirects the user to the card issuer's domain and back to the store to complete payment. When a payment is authenticated with 3D Secure, the liability for fraudulent chargebacks or disputes is shifted from merchants to card issuers, though card issuers have policies that remove liability shift protection if too many chargebacks occur.
Shopify's help page on PSD2 and 3D Secure checkout says that if you're using Shopify Payments, you're automatically using a 3D Secure checkout flow, and that Shopify Payments only uses 3D Secure when required by the issuing bank in order for a transaction to be authorized successfully. Shopify's page on configuring Shopify Payments also says you can turn on 3D Secure on the Payment providers settings page in your Shopify admin. If you're not using Shopify Payments, you can use a third-party payment provider that supports 3D Secure in the checkout. If the customer fails or abandons the verification, no authorization is sent to their bank, and no charge is made.
How Uncap helps
Uncap's guide to B2B ecommerce payments explains how saved B2B cards work on Shopify: the card is tokenized and associated with the company account, and card vaulting is available only to merchants that use Shopify Payments.
Sources
Frequently asked questions
How does 3D Secure authentication work?
3D Secure authentication works through a data exchange between the merchant and the card issuer. The merchant sends details about the transaction, payment method and device; the issuer uses them to authenticate the cardholder and approve the payment, and for higher-risk transactions it may ask for a one-time passcode, knowledge-based questions or biometrics.
What does it mean when my payment method is rejected due to 3D Secure authentication?
It means the card issuer's verification step was not completed. On a Shopify checkout, common causes include closing the verification window, a timeout from a slow connection, or a banking app that didn't send the push notification for approval. When 3D Secure verification fails or is abandoned, no authorization is sent to the bank and no charge is made.
What is the difference between 3D Secure and PCI DSS?
3D Secure authenticates the cardholder during an online card payment. PCI DSS is the payment card industry's data security standard for protecting payment account data. EMVCo, which maintains the EMV 3DS Specifications, works with the PCI Security Standards Council on the security evaluation of EMV 3DS solutions.
