3D Secure / EMV 3DS
The cardholder authentication protocol for card-not-present transactions. 3DS2 adds frictionless, decoupled, and challenge flows while enabling SCA compliance under PSD2 and reducing CNP fraud liability.
What is 3D Secure?
3D Secure (3DS) is the global card authentication protocol for card-not-present transactions. It reduces fraud by verifying the cardholder's identity at the time of purchase and shifts liability from the merchant to the card issuer when authentication succeeds. The "3 domains" are the issuer domain, the acquirer domain, and the interoperability domain (the card scheme).
3DS 1.0 (2001)
- Browser-only redirect to issuer page
- Static password or knowledge-based challenge
- High cart abandonment rates (~50-70%)
- No device fingerprinting or risk scoring
- MPI (Merchant Plug-In) on merchant side
- Payer Authentication Request (PAReq) / Response (PARes) messages
EMV 3DS 2.x (2016+)
- Native SDK (iOS/Android) and browser iframe support
- Frictionless flow — no cardholder interaction for low-risk transactions
- 100+ data elements sent to issuer for risk-based authentication
- Challenge flow with OTP, biometric, or out-of-band methods
- Decoupled authentication (async, up to 1 hour)
- AReq/ARes/CReq/CRes/RReq/RRes message types
Spec and certification status (Sept 2026): the current EMV 3DS release is 2.3.1.1; a 2.4 draft (Protocol & Core) is with EMVCo Associates. Most US processors still run 2.2, so check which fields your ACS/3DS Server pair actually supports before relying on 2.3 features such as decoupled authentication and SPC.
PCI 3DS SDK sunset: the standalone PCI 3DS SDK Security Standard is in a formal sunset period from 1 May to 31 October 2026 and becomes a module of the PCI Secure Software Standard — new SDK evaluations should target that module. EMVCo's own 3DS approval for 2.1.0 has already been retired; the 3DSA regression-testing approach now applies to all 2.3.1 components.
Liability Shift Rules
| Scenario | Auth Result | Fraud Liability |
|---|---|---|
| Full 3DS authentication | transStatus = Y, valid CAVV | Issuer |
| 3DS attempt (issuer not participating) | transStatus = A | Shared / Issuer |
| 3DS not attempted (merchant eligible) | No 3DS | Merchant / Acquirer |
| Failed authentication | transStatus = N | Merchant / Acquirer |