Payments
3D Secure (3DS)
Updated
3D Secure is the step where the card-issuing bank asks the buyer to confirm an online payment, for example in their banking app, before it is approved.
3D Secure adds a check by the cardholder's own bank. During checkout the issuer may approve silently using data the merchant sends, or show a challenge: a code by text, a banking app prompt or a biometric check. Visa's rules call its version Visa Secure.
It does two jobs. In Europe it is how merchants meet Strong Customer Authentication rules. Everywhere, an authenticated payment usually moves liability for fraud chargebacks to the issuer: Visa bars fraud dispute 10.4 when the payment was authenticated with Visa Secure.
Some network rules require it outright. Visa's October 2026 rules require acquirers in India to process online payments with Visa Secure, and require it for online sales under certain merchant category codes in markets such as Hong Kong, Singapore and Malaysia.
Frequently asked questions
- Is 3D Secure required?
- In the European Economic Area and UK, Strong Customer Authentication usually requires it for online card payments. Visa also requires it in some other markets and for some merchant categories. Elsewhere it is optional but shifts fraud liability.
- Does 3D Secure lower conversion?
- A challenge adds a step, so some buyers drop off. Frictionless authentication, where the bank approves without a challenge, adds no step.