3D Secure 2 (Visa Secure): How EMV 3DS Works

How the EMV 3DS flow works

EMVCo describes the process in three steps. A shopper pays by card on a phone, tablet or computer. The merchant uses EMV 3DS to send the issuer details about the transaction, the payment method and the device. The issuer uses that data to decide: for many transactions the payment goes through without interruption, often called frictionless, and for higher-risk transactions the issuer can ask the shopper to complete a challenge, such as a one-time passcode, knowledge-based questions or biometrics. EMVCo says the specifications support both app-based and browser-based checkouts, multiple step-up methods, and merchant-initiated account verification. The decision to challenge belongs to the issuer, not the merchant, although the data you send affects it.

3D Secure 2, EMV 3DS and Visa Secure

The names overlap. Visa says it pioneered the original 3-D Secure protocol and worked with other payment brands to develop the next generation, EMV 3-D Secure, and that Visa Secure is its global EMV 3DS program. EMVCo maintains the EMV 3DS specifications, publishes them royalty-free, and approves products and service providers against them. For a merchant, 3DS is usually switched on through a payment gateway or a 3DS server provider rather than built from scratch. Visa's page points merchants to its Visa Secure services site for the approved list of 3DS vendors. Ask your provider which EMV 3DS version it supports; EMVCo says version 2.1 supports strong customer authentication but recommends considering 2.2 or higher.

What the result means in a dispute

Visa's Core Rules list invalid disputes for condition 10.4, card-absent fraud. They include a secure e-commerce transaction sent with ECI 5 where the issuer confirmed authentication using Visa Secure with EMV 3DS and the authentication value (CAVV) was included in the authorization request. They also include an ECI 6 transaction where the issuer, or Visa on its behalf, returned an attempt response with a CAVV, unless the card is non-reloadable prepaid. In the US, Visa's rules say acquirers must tell merchants in certain categories, including wire transfer and money orders, cryptocurrency, stored value loads and betting, that their secure e-commerce transactions are not eligible for protection from condition 10.4. Authentication is about fraud: Visa's consumer dispute conditions, such as merchandise not received or not as described, are separate. Our fraud screening guide covers how 3DS fits with address and security code checks.

Where 3DS is required

Visa requires acquirers to tell e-commerce merchants that Visa Secure is available and to provide it when requested. Its table of regional requirements lists countries where e-commerce merchants, or merchants in certain categories, must process transactions using Visa Secure with EMV 3DS, including India, Hong Kong and several other Asia-Pacific markets, domestic transactions in Nigeria, other countries in its CEMEA Region, and all countries in its Europe Region. The table does not list a general requirement for the US or Canada. In Canada, Visa's rules require issuers that take part in Visa Secure to support risk-based authentication. EMVCo notes that the European Banking Authority recognised in 2019 that protocols such as EMV 3DS give merchants and issuers a way to support strong customer authentication under PSD2. If you sell to shoppers in those regions, check with your acquirer.

Rules merchants sometimes miss

Visa's rules say an acquirer may use ECI 5 or 6 in the clearing record only if the authorization request included the CAVV. In the US, an e-commerce merchant must not send authentication data from one transaction with another transaction, except for a partial advance payment or an order that cannot be shipped at once. A merchant that shows the Visa Secure badge must follow Visa's brand standards. Illustrative example only, with made-up round numbers: a store authenticates a $300 order, but the item ships in two parts. The split-shipment exception lets the same authentication data travel with the second part, while a separate new order next week needs its own authentication.

Using it without hurting conversion

EMVCo's stated goal for EMV 3DS is to prevent card-not-present fraud without unnecessary friction that often leads to abandoned purchases, and it says richer data helps issuers approve more legitimate transactions. That depends on the data you send. Pass complete device and order information through your provider, make sure challenge screens work in your app and on mobile browsers, and watch authentication and approval results by card type. Our checkout friction guide covers the form side of the same problem.