3D Secure Explained for Small Businesses (2026)

3D Secure (3DS) is an extra authentication step for online card payments in which the cardholder's bank confirms the buyer is really the cardholder, often through a banking app approval, a one-time code or biometrics. For a small business, the main benefits are fewer fraudulent payments and a liability shift: if an authenticated payment later turns out to be fraud, the card issuer, not you, usually absorbs the chargeback. The cost is a little extra friction at checkout.

You have probably seen 3D Secure branded as Visa Secure, Mastercard Identity Check or American Express SafeKey. This guide explains how it works, when it is required (UK and EU) or optional (US), what it does and does not protect, and how to set it up sensibly for online sales and invoice payment links.

How 3D Secure works

The "3D" refers to three domains: the merchant and its acquirer, the card issuer, and the card network infrastructure that connects them. A typical 3DS2 payment runs like this:

1. The customer enters card details on your checkout or invoice payment page.
2. Your processor sends an authentication request with transaction and device data (amount, shipping address, browser or app data, purchase history signals).
3. The issuer's risk engine decides. Low risk: the payment is approved without any customer action (frictionless). Higher risk: the customer gets a challenge.
4. The customer completes the challenge, for example approving in their banking app.
5. The authenticated payment then goes for normal authorization, carrying proof of authentication.

The modern standard, EMV 3-D Secure (3DS2), replaced the original version, which relied on redirects and static passwords and caused many abandoned checkouts.

The liability shift: what 3D Secure protects

When a payment is successfully authenticated, liability for fraud-type disputes (the cardholder says "I did not make this purchase") generally moves from the merchant to the issuer. That is the main financial reason to use it.

Dispute type	Covered by 3DS liability shift?	What protects you instead
Fraud: cardholder did not authorize	Usually yes, if authenticated	3DS authentication record
Product or service not received	No	Delivery proof, signed completion, timesheets
Not as described	No	Detailed invoice, contract, scope of work
Subscription cancelled	No	Clear cancellation terms and records
Duplicate or incorrect amount	No	Accurate invoicing and refund records
Payment processed under an SCA exemption	Generally no	Your own fraud screening

Because 3DS only covers fraud, it is not a substitute for good documentation. Our guide on how to handle chargebacks explains the evidence that wins non-fraud disputes, and a detailed invoice is usually exhibit one.

Is 3D Secure required? US vs UK and EU

United States

There is no legal requirement. US merchants choose whether to use 3DS. Many turn it on dynamically, for example for orders above a set amount, first-time customers, or orders flagged by the processor's fraud tools. Other US fraud defences include address verification, CVV checks and machine-learning screening, which we cover in AI fraud detection in payments.

UK and European Economic Area

Under PSD2 strong customer authentication (SCA) rules and the UK equivalent, most customer-initiated online card payments with cards issued in these regions must be authenticated with two factors, and 3DS is how merchants meet that requirement. Several exemptions exist, requested by the merchant or acquirer and accepted or rejected by the issuer:

• Low-value payments: up to EUR 30, subject to cumulative limits (Checkout.com's 3DS exemptions documentation describes triggers such as five uses or EUR 100 spent without authentication).
• Transaction risk analysis (TRA): available when the acquirer's fraud rate is below set thresholds for the payment amount.
• Trusted beneficiaries (customer whitelists the merchant with their bank).
• Merchant-initiated transactions, such as subscription renewals after an authenticated first payment.
• Secure corporate payments using certain business card processes.

If an issuer rejects an exemption, the payment may be soft-declined and must be retried with authentication. Most modern processors handle that automatically.

Pros and cons of 3D Secure for small businesses

Pros	Cons
Fraud liability shift on authenticated payments	Some customers abandon when challenged
Fewer fraudulent orders getting through	Possible per-attempt fees with some providers
Required for most European cards anyway	Does not cover non-fraud disputes
Frictionless approvals for most low-risk 3DS2 payments	Occasional technical failures with older bank systems
Helps keep dispute ratios low with acquirers	Exempted payments keep liability with you

Keeping fraud disputes down matters more than ever, because Visa's monitoring program counts fraud reports and disputes against your card-not-present volume. Merchants who exceed thresholds face fees or may need a high-risk merchant account.

How to set up 3D Secure (step by step)

1. Check your processor's settings. Stripe, Adyen, Checkout.com, Square and most gateways support 3DS2; many trigger it automatically where SCA applies.
2. Use the processor's hosted checkout or SDK so the challenge window works on mobile and in apps. Hosted pages also reduce your PCI compliance scope.
3. Choose rules for US cards, such as "request 3DS on payments over $500" or "when the risk score is elevated".
4. Send good data: customer email, billing and shipping address, and phone. Richer data means more frictionless approvals.
5. Save authenticated cards properly for future merchant-initiated charges like subscriptions or installment invoices.
6. Monitor results monthly: challenge rate, authentication success rate, declines and chargebacks.

Worked example: is 3D Secure worth it?

Illustrative figures for an online business selling $150 average orders, 1,000 orders a month, with 0.6% of orders resulting in fraud chargebacks without 3DS.

Item	Without 3DS	With risk-based 3DS
Fraud chargebacks per month	6	1 (on non-authenticated or exempt payments)
Lost revenue and goods (6 x $150, plus cost)	$900 + goods	$150 + goods
Dispute fees at $15 each	$90	$15
Lost sales from abandoned challenges (assume 5 orders)	$0	$750 revenue, but only lost margin matters

If margins are 40%, the abandoned orders cost about $300 in profit, while the fraud savings are about $825 plus the goods not lost. Results depend on your fraud rate; a business with almost no fraud may prefer 3DS only on large or flagged orders.

3D Secure on invoice payment links

Service businesses and freelancers mostly encounter 3DS when clients pay invoices by card through a payment link. A few practical points:

• European clients will usually be asked to approve in their banking app; warn them in the invoice email so the step is expected.
• For new clients paying large invoices by card, request 3DS to secure the liability shift.
• For large B2B amounts, offer bank transfer or ACH as the default; see our guide to the best payment methods for small business.
• Watch for invoice scams that spoof your payment links; tell clients which domain your payment page uses.

Whether your processor is a payment facilitator like Stripe or a dedicated merchant account, the 3DS settings sit in the same place: the fraud or risk section of the dashboard.

3D Secure for subscriptions and recurring invoices

If you bill clients monthly, authenticate the first payment and save the card properly as a merchant-initiated agreement. Later charges can then usually go through without the customer being present, because they are initiated by you under the original authenticated mandate. If an issuer still requests authentication on a renewal, your processor will typically email the customer a link to approve it. Make sure your recurring invoices and subscription terms state the amount, frequency and how to cancel, which also reduces "cancelled recurring" disputes that 3DS does not cover.

3D Secure metrics to watch

Metric	What it tells you	Action if it looks wrong
Challenge rate	Share of authentications that required customer action	Send richer customer data; review rules forcing challenges
Authentication success rate	Share of challenged customers who completed it	Test the mobile flow; warn customers in invoice emails
Frictionless rate	Payments approved without a challenge	Higher is better; improve data quality
Fraud dispute rate	Fraud chargebacks per transaction	Tighten rules or extend 3DS to more payments
Soft declines	Exemptions rejected by issuers	Check automatic retry with authentication is on

What to do if a customer cannot complete 3D Secure

Customers sometimes fail authentication because their bank app is not set up, the code goes to an old phone number, or a browser blocks the pop-up window. Ask them to contact their card issuer to update contact details, try a different browser or device, or pay by another card. For invoice clients, offering bank transfer or ACH as an alternative avoids losing the payment altogether. Never offer to bypass authentication by taking card details over email, which creates PCI compliance problems and leaves you liable for any fraud.

Common 3D Secure mistakes

• Forcing a challenge on every payment, which hurts conversion without adding much protection for low-risk orders.
• Assuming exempt payments are protected. If you request an exemption, fraud liability usually stays with you.
• Building a custom checkout without testing 3DS on mobile. Challenge windows that break on phones lose sales.
• Ignoring non-fraud disputes. Keep invoices, delivery proof and clear refund terms.

Summary

3D Secure verifies the cardholder with their bank, shifts liability for authenticated fraud disputes to the issuer, and is effectively mandatory for most UK and EU card payments. Use risk-based rules to limit friction, and keep strong invoices and contracts for the disputes 3DS does not cover. Create clear, numbered invoices with payment links in our free invoice generator, no sign-up required, and download them as PDFs to send to clients.