Quick answer
3-D Secure (3DS) is a card industry standard, now managed by EMVCo as EMV 3-D Secure, that lets the merchant and the card issuer exchange data during an online purchase so the issuer can authenticate the cardholder and approve the transaction[2]. It helps prevent card-not-present fraud.
Key points
- 3-D Secure lets your bank check it is really you when you buy online, before the payment is approved.
- Many checks are 'frictionless': the bank decides from the shared data that no extra step is needed.
- EMV 3DS supports Europe's strong customer authentication rules by enabling two-factor authentication.
On this page
#What does the '3-D' stand for?
The 'three domains' are the merchant and acquirer domain (the shop and its payment provider), the issuer domain (your bank) and the interoperability domain that connects them, such as the card payment systems[1]. EMVCo, the body that manages the EMV payment specifications, explains that EMV 3DS enables the exchange of data between the merchant and the issuer, including information about the transaction, the payment method and the device, to authenticate the consumer[2].
#What will you see when 3-D Secure runs?
Often nothing. EMVCo describes a frictionless flow, where the consumer simply clicks 'Buy' and the payment is approved, and a challenge flow, where the issuer asks for more proof, such as a one-time passcode, knowledge-based questions or biometrics[2]. The specification supports both app-based and browser-based checkouts[2]. EMVCo also says EMV 3DS supports Europe's strong customer authentication by enabling two-factor authentication, and lets merchants signal that an exemption, such as for low-value payments, may apply[3].
Worked example
Example: one frictionless and one challenged purchase
Leo buys a €15 phone case from a shop he uses often, on his usual phone. The shop sends the purchase and device data to his bank through 3DS, the bank judges the risk low and approves it without asking him anything. That evening he tries a €400 purchase from a new laptop; the bank's app on his phone asks him to confirm with his fingerprint before it approves.
- €15, familiar shop and device
- Frictionless: approved without a prompt
- €400, new device
- Challenge: fingerprint in the banking app
#Why does 3-D Secure matter so much in Europe?
Because European law began requiring strong customer authentication for online payments. The European Banking Authority set 31 December 2020 as the deadline for completing the migration to SCA for e-commerce card payments in the EU[4]. Learn more in strong customer authentication explained and see where 3DS fits in how card payments work.
Frequently asked questions
Does 3-D Secure work inside shopping apps, not just websites?
Yes. EMVCo says the current specifications support app-based purchases on mobile and other devices as well as browser checkouts[2].
Does 3-D Secure always ask me for a code?
No. In a frictionless flow the issuer approves from the shared data alone; it only challenges you when it wants more proof[2].
Sources
- PCI 3DS Core Security Standard — Frequently Asked Questions (v1.1) — PCI Security Standards Council, 2019 Primary
- EMV 3-D Secure — EMVCo, 2026 Primary
- How Does EMV 3-D Secure Help to Meet European Regulation While Supporting the Global Fight Against CNP Fraud? — EMVCo, 2020 Primary
- EBA publishes Opinion on the deadline and process for completing the migration to SCA for e-commerce card-based payment transactions — European Banking Authority, 2019 Primary
.jpg){kind=link}
