3-D Secure
Also known as: 3DS, 3DS2
3-D Secure is the protocol that lets a card issuer check the payer during an online card payment. EMV 3-D Secure shares transaction and device data so low-risk payments pass quietly, while higher-risk ones trigger a challenge such as a one-time passcode or biometrics.
Last reviewed
Example
After you click pay in a web shop, your banking app asks you to confirm with your fingerprint.
Online, nobody can see the card. 3-D Secure is how the bank checks that the person holding it is the person it was issued to.
How it works
EMVCo describes EMV 3-D Secure as a protocol that "helps payment card issuers and merchants around the world prevent card-not-present (CNP) fraud". The merchant sends data about the transaction and the device. The issuer weighs it.
If the payment looks ordinary, it goes through without a visible step. That is the frictionless flow. If it looks unusual, the issuer asks for more. EMVCo says that for higher-risk transactions "issuers may choose to require further authentication", and the customer "must authenticate themselves using a challenge, such as a one-time passcode". Biometrics and knowledge questions are other options it lists.
"3DS2" refers to the 2.x versions of the protocol. EMVCo recommends 2.2 or higher for the best functionality.
How it relates to SCA
3-D Secure is the carrier. Strong customer authentication is the rule. In Europe, the rule requires two independent factors unless an exemption applies, and the issuer uses 3-D Secure to run the check. On one detail, in its 2019 opinion the EBA said EMV 3-D Secure 2.0 and newer did not currently appear to constitute an inherence element. The factors come from what the customer does, not from the messaging.
What a merchant sees
A challenge is a moment when the customer can drop out. A well-set-up checkout sends the issuer plenty of data so that most payments pass without one. The payment can still fail if the customer abandons the challenge, and that is a conversion problem, not a fraud one.