What is 3D Secure?

3D Secure (3DS) is an authentication protocol designed to reduce fraud in online card payments. It adds a verification step during checkout where the cardholder's bank confirms the identity of the person making the purchase — similar to how a PIN works at a physical terminal, but for e-commerce.

The "3D" refers to the three domains involved in every online card transaction:

1. The merchant (seller) who initiates the payment
2. The card network (Visa, Mastercard, etc.) that routes the transaction
3. The issuing bank (the cardholder's bank) that approves or declines it

Why 3D Secure matters

Fraud prevention

Online card fraud is the most common type of payment fraud. Without 3DS, the only verification available is the card number, expiry date, and CVV — all of which can be stolen. 3DS adds a layer of authentication directly with the cardholder's bank, making it significantly harder for fraudsters to use stolen card details.

Liability shift

One of the most important business benefits of 3DS is the liability shift. When a transaction is successfully authenticated with 3DS, the responsibility for fraud-related chargebacks shifts from the merchant to the card-issuing bank. This means that if a customer disputes a 3DS-authenticated transaction as fraudulent, the merchant is generally protected from financial loss.

Without 3DS, the merchant bears the full cost of fraudulent chargebacks.

Regulatory compliance

In certain regions, 3DS is mandatory:

• European Union / EEA — Strong Customer Authentication (SCA) under PSD2 regulations requires 3DS for most online card payments
• United Kingdom — follows similar SCA requirements post-Brexit
• India — mandates two-factor authentication for online card payments

In other regions (North America, Asia-Pacific, Latin America), 3DS is optional but increasingly recommended. Merchants operating in these regions can choose to apply 3DS based on their own risk assessment.

The customer experience

Modern 3DS (version 2) is designed to minimize friction for the customer. There are two possible experiences:

Frictionless authentication

In most cases, the cardholder's bank can verify the customer's identity using background data — such as device information, transaction history, and behavioral patterns — without requiring any action from the customer. The authentication happens silently in the background, and the customer sees no additional steps during checkout.

Frictionless authentication is the most common outcome with 3DS2 and typically applies to low-risk transactions.

Challenge authentication

When the issuing bank requires additional verification, the customer is presented with a challenge — usually an SMS code, a push notification in their banking app, or a biometric confirmation. This adds a few seconds to the checkout process but provides stronger assurance of the cardholder's identity.

Challenge authentication is typically triggered for higher-risk transactions, unusual purchase patterns, or when the bank does not have enough data for a frictionless decision.

3DS versions

	3DS 1.0 (legacy)	3DS 2.x (current)
Customer experience	Always shows a challenge page	Mostly frictionless, challenges only when needed
Mobile support	Poor (pop-ups, redirects)	Native mobile SDK support
Data shared with issuer	Minimal	Rich data (device, browser, transaction history)
Approval rates	Lower (more friction = more abandonment)	Higher (smarter risk decisions)

note

NetValve supports 3DS 2.x only. 3DS 1.0 has been deprecated by the card networks and is no longer supported.

3DS with NetValve

NetValve supports two approaches to 3D Secure:

Option 1: NetValve-managed 3DS

NetValve provides a built-in 3DS service. The merchant calls NetValve's 3DS APIs to handle the full authentication flow — initialization, challenge handling, and result retrieval — before submitting the payment. This is the simplest option as NetValve manages the 3DS provider relationship.

See the NetValve 3DS integration guide for the full technical walkthrough.

Option 2: External 3DS provider

Merchants who already use their own 3DS provider (or a third-party 3DS service) can authenticate the cardholder independently and then pass the authentication results to NetValve as part of the payment request. NetValve accepts the standard 3DS authentication values and forwards them to the processor.

See the External 3DS integration guide for details and examples.

Key terms

Term	Meaning
ECI (Electronic Commerce Indicator)	A value returned by the card network indicating the outcome of 3DS authentication. For example, 05 (Visa) or 02 (Mastercard) means successful authentication.
CAVV (Cardholder Authentication Verification Value)	A cryptographic value generated during 3DS authentication that proves the cardholder was verified.
dsTransactionId	A unique identifier for the 3DS authentication transaction, assigned by the Directory Server (card network).
Liability shift	The transfer of chargeback responsibility from the merchant to the issuing bank when a transaction is successfully 3DS-authenticated.
Frictionless flow	A 3DS authentication that completes without requiring any input from the cardholder.
Challenge flow	A 3DS authentication that requires the cardholder to complete an additional verification step (e.g., SMS code, biometric).