3D Secure (3DS) is an authentication protocol designed to reduce fraud in card-not-present transactions, that is, online and phone payments where the physical card is not swiped or tapped. Originally introduced by Visa under the brand name “Verified by Visa,” and adopted by Mastercard as “Mastercard SecureCode,” the protocol adds an extra verification step between the cardholder and their issuing bank during checkout. The “3D” refers to the three domains involved: the merchant (acquirer domain), the card network (interoperability domain), and the issuing bank (issuer domain).
The current version, 3D Secure 2 (3DS2), represents a significant improvement over the original. Where 3DS1 typically redirected the customer to a separate bank page to enter a static password, which caused high cart abandonment, 3DS2 uses a risk-based approach. It passes over 100 data points to the issuing bank, including device fingerprint, transaction history, and shipping address. If the bank considers the transaction low-risk, the authentication happens silently in the background with no customer interaction at all. Only higher-risk transactions trigger a challenge, which now usually takes the form of a one-time passcode sent via SMS or a push notification to the customer’s banking app.
Beyond fraud prevention, 3D Secure has a critical business implication: liability shift. When a transaction is successfully authenticated via 3DS, liability for fraudulent chargebacks shifts from the merchant to the card-issuing bank. This means the merchant is protected from losses on authenticated transactions that later turn out to be fraudulent. In the European Economic Area, 3DS2 is also a primary mechanism for meeting Strong Customer Authentication (SCA) requirements under PSD2, making it not just beneficial but legally required for most online card payments in that region.
Shuttle Global supports 3D Secure for online card payments, so platforms do not have to build and maintain their own 3DS integration. When the card issuer requires authentication, the customer is shown the issuer’s challenge inside Shuttle’s checkout, or in a separate window where the gateway insists on one, and the payment completes once the challenge succeeds. The same flow runs through Embedded Payments and through the hosted checkout page behind Links Checkout. 3D Secure is enabled per gateway in its connection settings. This means platforms gain the fraud protection and liability shift benefits of 3D Secure without adding authentication logic to their own codebase.