# What is 3D Secure?

URL: https://www.paydude.io/resources/what-is-3d-secure
Type: Guide
Published: 2026-09-02 · Updated: 2026-09-02
Summary: 3D Secure authenticates the cardholder with their bank and shifts fraud liability to the issuer. What 3DS2 changed, and when to use it.

**3D Secure is an authentication step that verifies the cardholder with their issuing bank during checkout.** When it succeeds, liability for fraud-related chargebacks moves from you to the issuer. That protection is real, and it is paid for in checkout friction.

## Summary

It shifts fraud chargeback liability to the issuing bank. It does nothing for non-delivery or quality disputes. 3DS2 authenticates most transactions silently, unlike 3DS1. Effectively mandatory in Europe; optional and selective in the US.

## The liability shift

This is the entire commercial argument for 3D Secure. Normally a fraudulent card transaction is your loss: the chargeback reverses the sale and you keep neither the money nor the goods. With successful 3DS authentication, the issuer approved the cardholder''s identity — so the issuer carries that loss instead.

> **It only covers fraud disputes:** Liability shift applies to fraudulent-transaction reason codes only. If a customer claims the item never arrived, was not as described, or that a subscription was not cancelled, 3D Secure offers no protection whatsoever. For most merchants those categories make up the bulk of disputes.

## 3DS1 versus 3DS2

**What changed**

|  | 3DS1 | 3DS2 |
| --- | --- | --- |
| Customer experience | Redirect to a bank page | Usually invisible |
| Authentication | A static password | Biometric or app approval when challenged |
| Data sent to issuer | Minimal | 100+ risk signals |
| Mobile experience | Poor | Designed for it |
| Typical abandonment | High | Low |

The improvement is substantial. Because 3DS2 sends the issuer far more context — device, behaviour, transaction history — most payments are approved without any customer interaction. Only the risky ones get challenged.

## When to use it

- **Always, in Europe and the UK**, where [Strong Customer Authentication](https://www.paydude.io/resources/what-is-sca) makes it effectively mandatory.
- **Selectively, in the US** — on high-value orders, unusual patterns, or customers with prior disputes.
- **Rarely on low-risk recurring charges**, where subsequent payments are usually exempt anyway.
- **Reconsider it entirely** if your dispute mix is mostly non-delivery, since 3DS will not help.

The right approach for most merchants is risk-based: let the provider trigger 3DS only when signals justify it, rather than applying it to every transaction and paying the conversion cost across all of them.

**Risk-based authentication built in** 3DS2 applied where it helps, not indiscriminately. — [See how it works](https://www.paydude.io/pricing)

## Frequently asked questions

### Does 3D Secure prevent chargebacks?

It prevents one type. A successful 3DS authentication shifts liability for fraudulent-transaction chargebacks to the issuing bank. It does nothing for disputes about non-delivery, product quality or unrecognised charges, which are the majority for most merchants.

### Does 3D Secure hurt conversion?

Yes, though far less than it used to. 3DS1 caused substantial abandonment with its redirect and separate password. 3DS2 usually authenticates in the background with no customer interaction at all, and only challenges when risk signals warrant it.

### Is 3D Secure required?

In Europe and the UK, effectively yes for most consumer transactions under Strong Customer Authentication rules. In the US it is optional and used selectively, typically on higher-risk or higher-value transactions.

### What is the difference between 3DS1 and 3DS2?

3DS1 redirected the customer to their bank for a password, and abandonment was high. 3DS2 passes far richer data to the issuer so most transactions authenticate silently, with a challenge only when needed — often biometric in the bank's app.