The old version of 3D Secure stopped fraud by punishing everyone. It threw a clunky password pop-up at every shopper, forgotten passwords and all, and sent a large share of them fleeing the checkout. 3D Secure 2 fixes that by challenging only the risky payments and letting the rest through silently. As the FinTech Engineering Lead at Acquaint Softtech, a software product development partner, I integrate 3DS2 so it blocks fraud without bleeding conversion.
3D Secure 2 authenticates most low-risk payments invisibly in the background and only interrupts the risky ones. It sends far more data to the bank than the old version, so the bank can approve good customers silently, which is what lets 3DS2 cut both fraud and cart abandonment at the same time.
The figures here are attributed to their sources. This guide draws on secure checkout platforms Acquaint Softtech has built as an Official Laravel Partner, with 1,300+ projects, 70+ in-house engineers, and clients across the USA, UK, Europe, and Australia who deploy dedicated teams within 48 hours of a brief.
| Quick answer: what is 3D Secure 2?3D Secure 2 (3DS2, or EMV 3-D Secure) is an authentication protocol that verifies a cardholder during online checkout using risk-based analysis of more than 100 data points. Most low-risk payments authenticate silently in the background, and only riskier ones get a challenge, so it prevents fraud without the cart abandonment of the old password-based 3D Secure. |
What 3D Secure 2 is
3D Secure 2 adds an issuer-side authentication step between checkout and payment authorization, so the cardholder’s bank can confirm the real customer is present before approving. You see it branded as Visa Secure and Mastercard Identity Check, and it is maintained by EMVCo, the body owned by the major card networks.
The defining feature is that authentication is risk-based. Instead of challenging everyone, the bank uses data to approve low-risk payments silently and reserves a visible check for transactions that actually look risky, which is the whole reason 3DS2 protects sales the old version lost.
3DS1 vs 3DS2: why the old version hurt sales
3D Secure 1 challenged every shopper with a static password on a separate bank page, while 3D Secure 2 authenticates most transactions silently using data. The difference in conversion is dramatic, which is why the card networks retired the old version.
| Dimension | 3D Secure 1 | 3D Secure 2 |
| Authentication | Static password for everyone | Risk-based, mostly silent |
| Experience | Redirect to a bank page | Embedded in your checkout |
| Data sent | A handful of fields | 100+ data elements |
| Cart abandonment | Roughly 15 to 25% | Roughly 2 to 5% |
| Status | Sunset in October 2022 | Current standard (EMV 3DS 2.x) |
Frictionless vs challenge flow
3DS2 has two paths, and your goal is to keep as many payments as possible on the first one. In the frictionless flow, the issuer approves the payment silently from the data alone, with no cardholder interaction at all.
The challenge flow activates only when the issuer’s risk engine wants more proof, presenting a one-time code, a push notification in the banking app, or a biometric prompt inside the checkout. Well-optimized merchants keep 85 to 95% of transactions frictionless, so the challenge becomes the exception rather than the rule.
Rich data: the merchant’s biggest lever
The single biggest thing a merchant controls in 3DS2 is the quality of the data it sends. 3DS2 passes more than 100 data elements to the bank, compared with a handful in the old version, and more good data means more payments the bank can approve without a challenge.
- Device and browser signals: fingerprint, screen, language, and IP address.
- Transaction context: billing and shipping details, amount, and merchant category.
- Customer history: prior purchases and account age that show a familiar, trusted buyer.
Send this payload complete and accurate and your frictionless rate climbs. Send it thin or malformed and the bank, starved of signal, falls back on challenges that cost you conversion.
SCA, liability shift, and exemptions
In Europe, PSD2 requires Strong Customer Authentication (SCA) on most online card payments, and 3DS2 is how you satisfy it. SCA means proving identity with two of three factors: something the customer knows, has, or is.
- Liability shift: when a payment is authenticated with 3DS2, fraud-related chargeback liability moves from you to the card issuer.
- Exemptions keep friction low: low-value payments under 30 euros, transaction risk analysis, merchant-initiated transactions, and recurring charges after the first can skip the challenge.
Used well, exemptions and frictionless flow do the same job: they keep genuine customers moving while the protocol still carries the fraud liability off your books.
How 3DS2 integration works
A 3DS2 transaction runs across four components in real time: the 3DS Server on the merchant side, the Directory Server run by the card network, the Access Control Server at the issuer, and a browser or mobile SDK that renders any challenge. Most merchants reach all of this through their payment provider rather than building it from scratch.
The integration itself is API and event work: gather the data payload, invoke authentication, branch cleanly between frictionless and challenge, and complete the flow before authorization. Teams that hire API developers with payments experience handle the edge cases, timeouts, and challenge callbacks that decide whether real customers make it through.
Reducing cart abandonment at the checkout
The difference between a 3DS2 that lifts conversion and one that sinks it is checkout experience, not the protocol. A challenge rendered smoothly inside your own flow keeps buyers moving; a jarring redirect or a needless pop-up still loses them, exactly as the old version did.
This is where careful frontend development pays for itself: embed the challenge in the checkout instead of redirecting, use the native mobile SDKs on apps, and never trigger a challenge you could have avoided with good data or an exemption. Visa data shows 3DS2 can cut cart abandonment at the authentication step by up to 66% versus the old version, but only when the experience is built with care.
Short answers to common questions
Does 3D Secure 2 reduce cart abandonment?
A: Yes. Because most low-risk payments authenticate silently, shoppers are no longer interrupted by a password pop-up. Visa data shows 3DS2 can cut authentication-step abandonment by up to 66% versus 3DS1, provided the checkout experience is built well.
What is the difference between the frictionless and challenge flow?
A: In the frictionless flow the bank approves the payment silently from the data, with no customer action. The challenge flow appears only for riskier payments and asks for a one-time code, biometric, or app approval.
Is 3D Secure 2 mandatory?
A: In Europe, PSD2 requires Strong Customer Authentication on most online card payments, and 3DS2 satisfies it. Elsewhere it is not legally required, but it still reduces fraud and shifts chargeback liability, so most merchants use it.
How does 3DS2 shift fraud liability?
A: When a transaction is authenticated with 3DS2, liability for fraud-related chargebacks moves from the merchant to the card issuer. That protection is a major reason merchants adopt it, even where it is not legally mandated.
Why did 3D Secure 1 cause so much abandonment?
A: It challenged every shopper with a static password on a separate bank page. The redirect was jarring and the password was often forgotten, so abandonment routinely ran high. The card networks sunset 3DS1 in October 2022.
What data does 3DS2 send to the bank?
A: More than 100 data elements, including device and browser signals, billing and shipping details, and customer history. Richer, accurate data lets the bank approve more payments silently, raising the frictionless rate and protecting conversion.
