3-D Secure (3DS) is a card-scheme protocol that lets the issuing bank confirm the person paying online is the genuine cardholder before the payment goes to authorization. It runs as Visa Secure, Mastercard Identity Check, American Express SafeKey and JCB J/Secure on the EMV 3-D Secure specification managed by EMVCo; 3DS2 is the only version left since 3DS1 was decommissioned in October 2022. The merchant's 3DS Server sends transaction and device data, and the issuer's Access Control Server approves frictionlessly or challenges the cardholder. Under PSD2 this step applies strong customer authentication. When an authenticated payment is disputed as fraud, liability generally shifts to the issuer; non-fraud claims stay with the merchant.
What is issuer authentication
The "three domains" in the name are the acquirer domain (the merchant and its payment provider), the issuer domain, and the scheme infrastructure connecting them. The check at the centre is issuer authentication: the issuer answering "is this really the cardholder?". Authorization is a separate message about funds, limits and risk, so a fully authenticated payment can still be declined for insufficient funds. Under PSD2, the authentication step is where strong customer authentication is applied, using two of knowledge, possession and inherence.
How does 3D Secure work
The merchant's 3DS Server packages transaction and device data, the scheme's Directory Server finds the issuer for that card range, and the issuer's Access Control Server (ACS) decides. That decision is issuer authentication in 3D Secure: the ACS either approves silently through the frictionless flow or challenges the cardholder with a one-time passcode, a banking-app confirmation or a biometric check.
A successful result returns an authentication value (CAVV for Visa, AAV for Mastercard) and an ECI code that the merchant adds to the authorization request. Visa ECI 05 or Mastercard ECI 02 signal full authentication.
How does card issuer authentication work at a terminal
EMV uses the term more narrowly for chip payments. The card generates an ARQC cryptogram that the issuer verifies; the issuer replies with an ARPC cryptogram, which the card checks to confirm the answer came from the real issuer, not a tampered terminal. Only then will the card accept issuer scripts such as a PIN unblock.
3DS vs 3DS2: what is 3D Secure 2
3-D Secure 2 (3DS2) is the only version in use: Visa and Mastercard decommissioned 3DS1, with its static passwords and mobile-breaking pop-ups, in October 2022. Version 2.2 added SCA exemption indicators, decoupled authentication and 3RI messages for merchant-initiated payments such as subscription renewals.
How does 3DS2 work differently
The 3DS Server can send more than 100 data elements: device characteristics, shipping address, account age, purchase history with the merchant. A €40 shoe order from a known device, shipping to the address on file, is usually approved in about a second without customer input. Merchants that fill only mandatory fields see more challenges, and each challenge costs conversions.
3D Secure payment authentication and the liability shift
When an authenticated payment is later disputed as fraud, liability generally moves from the merchant to the issuer. A merchant selling €200,000 a month online with a 0.3% fraud chargeback rate absorbs about €600 in monthly losses without authentication; with authenticated volume, most of those disputes become the issuer's problem. The shift covers fraud reason codes only, so a "goods never arrived" claim stays with the merchant.
For a buyer assessing an acquirer or PSP, European card volume sent without 3DS or a valid exemption, and the frictionless rate by issuer, measure fraud exposure directly.