3-D Secure 2: What It Changes for Merchants

3-D Secure 2, published by EMVCo as EMV 3DS, is the protocol that authenticates a cardholder on a card-not-present sale before the issuer authorizes it. Turning it on can shift liability for fraud-coded disputes to the issuer when authentication succeeds, or when you attempted it under brand rules. It is not a guarantee. Authorization rates, extra checkout steps, and the issuer's risk engine all move when 3DS is on. In the United States that is a tradeoff you choose with your gateway. In PSD2 markets it is often how Strong Customer Authentication is delivered.

Visa Secure, Visa's EMV 3DS program, is built to confirm the cardholder and shift liability for authenticated or attempted-authentication transactions. The rest of this article is the part that sentence does not cover.

What 3DS 2 actually is

The protocol is a three-domain handshake. You (through your acquirer and a 3DS Server) send transaction, device, and payment data. The issuer's Access Control Server (ACS) decides whether the person at checkout is the cardholder. The network sits in the middle: directory, rules, and the cryptogram that later rides on the authorization.

EMVCo maintains the specification. Visa pioneered the original protocol and now runs it as Visa Secure (formerly Verified by Visa). Other brands run their own programs on the same spec. The first generation, 3DS 1.0.2, used static passwords and full-page redirects. Visa published EMV 3DS in October 2016 and discontinued support for 3DS 1.0.2 on 15 October 2022 (Visa Business News, 4 February 2021). If a vendor is still talking about Verified by Visa pop-up passwords, they are describing a protocol Visa already sunset.

3DS 2 is a card-not-present tool. Chip or tap at a terminal already authenticates the plastic. Keyed and e-commerce sales do not. VisaNet data for U.S. credit cards in October through December 2024, cited on Visa's 3-D Secure guide, puts card-not-present fraud rates at 7.5 times card-present and at nearly 89 percent of payment fraud. Authentication is how the issuer tries to close that gap without seeing the card.

Authentication is not authorization

Authentication confirms the person is entitled to use the card. Authorization is the issuer's yes or no on funds and account status. 3DS lives in the first box. It is not a substitute for authorization, capture, and settlement, and a successful 3DS result does not move money.

On the authorization message you should see two artifacts if 3DS ran: an Electronic Commerce Indicator (ECI) and a Cardholder Authentication Verification Value (CAVV). Visa's public code list (developer.visa.com) defines the e-commerce ECI values you will actually use:

• ECI 5: secure electronic commerce transaction (fully authenticated).
• ECI 6: non-authenticated security transaction at a 3DS-capable merchant, where the merchant attempted to authenticate.
• ECI 7: non-authenticated security transaction (no 3DS, or 3DS did not land).

The CAVV is the cryptogram that proves what happened. Visa CAVV result 2 means the value passed as a full authentication and the sale is not eligible for the listed fraud chargebacks because authentication was performed. Result B is the trap: CAVV passed as authentication, information only, with no liability shift, because the ECI or the card type is excluded. Ask your gateway to show ECI and CAVV result on the transaction, not a green "3DS yes" badge.

A Visa 1A action code means additional customer authentication is required. That is a retry-with-3DS instruction, not a final decline.

Frictionless versus challenge

The issuer, not you, picks the path.

Frictionless. The ACS authenticates from the data you sent. The customer never sees a 3DS screen. Visa's UX guidelines call this risk-based authentication: you still show a processing screen, but there is no OTP field.

Challenge. The ACS does not trust the payload enough. The cardholder must complete a step: one-time passcode, out-of-band approval in a banking app, biometric, or knowledge-based questions. Visa eliminated Visa Secure-specific static passwords in October 2018 (Visa Secure EMV 3DS UX guidelines). A challenge the customer cancels is an abandoned authentication: a lost sale, not a delayed one.

Data quality is the lever you control. Thin payloads (card number, amount, and little else) push the ACS toward challenge or decline. Billing, shipping, device, account age, and prior orders give the issuer something to underwrite. You cannot force frictionless. You can starve or feed the model.

A liability shift is not a guarantee

Visa's 4 February 2021 3DS 1.0.2 sunset notice, which states that Visa Secure EMV 3DS rules did not change in that cutover, maps the liability like this:

• Fully authenticated, issuer participates: fraud liability with the issuer, ECI 05.
• Attempted authentication, issuer participates but the ACS is unavailable: fraud liability with the issuer, ECI 06.
• No authentication (ECI 07): fraud liability with the merchant.

The same notice footnotes that fraud-related disputes include Dispute Condition 10.4. That is the family. It is not every chargeback. Goods not received, not as described, cancelled recurring, and credit not processed stay with you. 3DS does not write that file.

Two more limits. Attempted is not authenticated: ECI 06 can shift fraud liability when the brand rules say it does; it is not proof the cardholder was in the session. Exemptions are not authentication: Visa's 3DS guide lists PSD2 exemption paths (acquirer TRA, issuer TRA, secure corporate) as a way to satisfy the regulation. Do not assume an exemption sale gets ECI 05 treatment. If the cryptogram is missing, you are on ECI 07 economics.

Processor 3DS fees, when they exist, are markup. They are not interchange and not a network assessment. Illustrative: a $0.03 per-3DS fee on 2,000 e-commerce auths is $60 that month. It does not buy you consumer-dispute coverage.

3DS off

• No issuer challenge at checkout
• Fraud liability stays with you on card-not-present sales
• Authorization runs without an ECI 05 or 06 CAVV
• Issuer decides with less authentication data

3DS on

• Frictionless for many sales; OTP or biometric challenge for higher risk
• Fraud liability can shift on authenticated or attempted sales (Visa ECI 05 or 06)
• Issuer ACS sees device and transaction data before auth
• Challenge abandon is a lost sale; consumer disputes still sit with you

The on versus off tradeoff

In the U.S., 3DS 2 is optional. You are trading checkout friction and a possible per-auth fee against fraud liability and, on some books, better authorization.

VisaNet data for authenticated e-commerce in Q4 2023, cited on Visa's 3-D Secure guide, shows a 9 percent lift in authorization approval rates on transactions authenticated through Visa Secure. That is the issuer saying yes more often because it has an authentication result. It is not a 9 percent lift in completed checkouts. A challenge that the customer fails or cancels never reaches authorization, so it never appears in that approval statistic.

Work the two clocks on your own mix. Illustrative, one $120 e-commerce sale:

• 3DS off, fraud chargeback: you lose the $120, the goods if they shipped, and the processor's per-case fee. Liability did not shift.
• 3DS on, frictionless, later 10.4: if ECI 05 (or a qualifying ECI 06) and a valid shifting CAVV are on the record, fraud liability can sit with the issuer. You still answer consumer-reason cases.
• 3DS on, challenge abandoned: there is no sale, no CAVV, and no dispute. The cart is gone.

Neither column is free. High-fraud MCCs, large tickets, cross-border cards, and first-time customers are where the off column gets expensive. Repeat buyers on a stored credential, with low historical fraud, are where an always-on challenge burns conversion for little shift. The protocol does not pick. Your challenge rate does.

If you sell into the EU or UK, the choice narrows. EMVCo states that EMV 3DS 2.0 and newer support Strong Customer Authentication, and it recommends v2.2 or higher for that use. A U.S. gateway that only offers 1.0, or that cannot return a cryptogram, is the wrong tool for those cards.

What to demand from the gateway

Ask for the waterfall in writing before you flip the switch.

• Version. EMV 3DS, not 1.0.2 (Visa sunset that on 15 October 2022). Confirm 2.2 or higher if you have European volume.
• Who runs the 3DS Server, and that you receive ECI, CAVV, CAVV result, plus whether the sale was frictionless, challenged, attempted, failed, or abandoned. A binary "3DS on" flag will not defend a 10.4.
• Exemptions and data-only. If the gateway offers a no-challenge data share, ask whether you get a liability-shifting ECI. If the answer is no, you are buying issuer visibility, not a shift.
• Follow-on captures. A 3DS result on the first sale does not automatically cover a delayed or split shipment. Ask how the cryptogram is refreshed when the cardholder is no longer in the browser.

Measure your book for 30 days: challenge rate, authentication success, abandon rate, authorization rate with and without 3DS, and fraud chargebacks versus consumer chargebacks. Those ratios tell you whether 3DS is paying for itself. A vendor's case study does not. If 3DS fees are buried in a blended discount, run the statement through the analyzer once so the line is visible.

Turn 3DS on when the fraud you actually see is card-not-present and issuer-liable, and when your gateway can prove ECI 05 or 06 with a shifting CAVV. Leave it off, or use it only on step-up rules, when your losses are consumer disputes and your checkout already leaks. A liability shift you cannot document is the same as no shift. Ask for the cryptogram, not the badge.

FAQ

What is 3D Secure 2 for merchants? EMV 3-D Secure (3DS 2) is the current protocol for authenticating the cardholder on a card-not-present sale before authorization. Your gateway sends transaction, device, and payment data to the issuer. The issuer either authenticates in the background or challenges the customer.

Does 3D Secure 2 shift chargeback liability to the issuer? On Visa, fraud liability can shift for fully authenticated sales (ECI 05) and for attempted authentication at a 3DS-capable merchant (ECI 06). It covers fraud-coded disputes such as condition 10.4, not goods-not-received or not-as-described. A CAVV that passes can still carry no shift if the ECI or card type is excluded.

What is the difference between frictionless and challenge 3DS? Frictionless means the issuer authenticates from the data you sent, with no extra step for the customer. Challenge means the issuer asks for a one-time passcode, biometric, out-of-band approval, or knowledge question. Both are 3DS. Only the challenge is visible at checkout.

Do U.S. merchants have to use 3DS 2? No. In the United States it is optional. You choose it with your gateway as a fraud and liability tradeoff. In the EU and UK, Strong Customer Authentication under PSD2 is often delivered through EMV 3DS 2.2 or higher. A Visa 1A response means retry with authentication, not a final no.

Does 3DS 2 stop all chargebacks? No. It can move fraud liability when authentication succeeds or is attempted under brand rules. Consumer disputes, cancelled recurring, and credit-not-processed still sit with you. A challenge the customer abandons is a lost sale with no dispute file at all.

How do I turn on 3-D Secure 2? Ask your gateway for EMV 3DS (not 1.0), which 3DS Server they use, and whether you receive ECI and CAVV on the authorization. Send the full data set. Then measure challenge rate, abandon rate, ECI mix, and fraud chargebacks on your own book, not on a vendor slide.

Sources

• EMVCo, EMV 3-D Secure
• Visa, 3D Secure: your guide to safer transactions
• Visa, Visa Secure with EMV 3-D Secure (merchant)
• Visa Business News, "Visa Will Discontinue Support of 3-D Secure 1.0.2," 4 February 2021
• Visa, Visa Secure using EMV 3DS User Experience Guidelines
• Visa Developer, Request and Response Codes (ECI and CAVV results)