3D Secure

What 3D Secure is

3D Secure is an extra confirmation step in card payment. The customer enters the card details and is then redirected to their bank's page or receives a clearance prompt in the banking app. Only after that confirmation does the payment count as authorised. The name refers to the three parties involved: the customer's bank, the retailer's bank and the card network.

In the EU the step is mandatory for most card payments, because the payment directive requires strong customer authentication. Exceptions exist for small amounts and for trusted beneficiary lists carrying retailers considered reliable.

Why liability shifts

The decisive point is not fraud prevention but the burden of proof. If the customer gives clearance, the customer's bank carries the loss in a later fraud case. If it is missing, the retailer carries the risk, even when they acted correctly.

That explains why the step is widespread despite its disadvantages. Without it a single fraudulent case can cancel out the profit of many orders, and the retailer has little way to defend themselves. With the step that risk moves to the bank.

What it costs in abandoned orders

• Extra step: every additional hurdle lowers completion. The effect is measurable but usually smaller than feared.
• Redirect: if the switch to the bank page feels like leaving the shop, customers who do not understand the process drop out.
• Missing app: if the customer has not set up the approval app, the order fails. That hits less active cardholders more often.
• Extra work with subscriptions: for recurring payments there are reliefs, implemented differently depending on provider.

How to weigh the two

Three measures keep the effort small without giving up the protection. The first is the small amount exemption permitted in the EU. It lets orders with a small basket run without the extra step, while larger amounts stay protected.

The second is the trusted beneficiary list. Retailers with a low fraud rate can register for exemptions, which spares regular customers the extra step. The third is the design of the redirect. A note before the switch explaining why the confirmation is needed lowers the drop off considerably, because the customer can then place the process.

Measurement matters. The drop off rate at the payment step is a figure of its own and should be viewed separately from the general conversion rate, otherwise a problem at the clearance step goes unnoticed.

Frequent questions

• Is 3D Secure mandatory? For most card payments in the EU yes, with exceptions.
• Does it protect fully against fraud? No, but it shifts liability in a fraud case.
• Can I switch it off? Not for regulated payments, without carrying the risk myself.