Glossary
/
3d-secure
3D Secure adds an authentication step to online card payments. Definition, link to SCA, Shopify checkout impact, and merchant advice.
Updated on
June 4, 2026
3D Secure (often abbreviated as 3DS) is a security protocol that adds an authentication step during an online card payment. Specifically, the buyer may be prompted to confirm their identity via their banking app, an SMS code, or a fingerprint before the transaction is validated. In e-commerce, this mechanism is mainly used to reduce fraud, comply with European regulations (SCA, PSD2) and, in some cases, to shift the liability of a fraudulent chargeback to the card issuer rather than the merchant.
3D Secure stands at the intersection of security, compliance, and conversion. It protects card payments, but must be integrated carefully to avoid turning the bank validation into an obstacle for the buyer.
Summary
3D Secure Definition
The term 3D Secure refers to an authentication protocol for cardholders in remote payments. Historically developed by the Visa (Verified by Visa), Mastercard (SecureCode) and other networks, it is part of a "three-domain" model: the acquirer domain (the merchant's bank), the issuer domain (the customer's bank) and the interoperability domain (the protocol that enables communication between the two).
The most widespread version today is EMV 3-D Secure (often referred to as 3DS2), which is smoother than the older generation: it allows for authentication integrated directly into the checkout (without systematically requiring heavy redirection) and is better adapted to mobile devices. It should not be confused with SCA (Strong Customer Authentication): SCA is the regulatory obligation in Europe; 3D Secure is one of the most common technical means to satisfy it during a card payment.
Another useful nuance: 3D Secure authenticates the payer, but does not replace the merchant's anti-fraud tools (risk rules, blocklists, velocity checks). The two complement each other.
Why 3D Secure is important for e-merchants
For an online store, 3D Secure acts on three concrete levers.
For an online store, this notably includes Regulatory Compliance: in the EEA and the UK, the PSD2 directive mandates strong customer authentication for many electronic payments. Without a compatible mechanism, some transactions may be declined by the issuing bank; Fraud Reduction: by verifying that the person paying actually controls the payment method, the protocol limits purchases made with stolen or compromised cards; and Liability Shift: when a transaction is successfully authenticated via 3D Secure, the liability for a fraud-related chargeback can be transferred from the merchant to the card issuer, depending on network rules and bank policies (Shopify Help Center).
The flip side: any additional step during checkout can create friction. A customer who does not understand the authentication request, who does not receive the code, or who abandons on mobile can lower the conversion rate. The challenge is therefore not just technical: it is also a matter of shopping experience.
How does 3D Secure authentication work
Here is the typical customer journey during an online purchase.
Concretely, this notably includes: the customer enters their card details on the payment page; the issuing bank or the payment provider evaluates if strong authentication is required (amount, risk, history, possible exemptions); if a challenge is required, the customer confirms their identity (banking app, biometrics, SMS, banking password depending on the issuer); and upon success, the transaction is authorized and the order can be confirmed.
Use case: a customer in France orders a €120 product on a Shopify store. At the time of payment, her banking app prompts her to validate the purchase in one click. She confirms: the order goes through. Without this validation, the payment could have been declined, even with a valid card and sufficient funds.
Some transactions can be exempted from a challenge (low recurring amounts, recurring payments initiated by the merchant under specific frameworks, etc.). The exact rules depend on local regulations and the issuer. Do not assume that "small cart = no 3DS": check with your payment provider.
3D Secure management on Shopify
On Shopify, 3D Secure management mainly depends on your payment gateway.
Within Shopify, you will notably find Shopify Payments: the 3D Secure flow is integrated. Shopify indicates that authentication is only triggered when the issuing bank requires it to authorize the transaction, in order to limit unnecessary friction (Shopify documentation), Stripe, PayPal and other PSD2-compatible gateways: 3DS is generally managed by the provider. For EEA shops selling in euros or other relevant currencies, a SCA-compliant configuration is required and Non-SCA-optimized third-party gateways: Shopify may signal in the admin that an additional connection (such as Cardinal Commerce) is required to remain compliant in certain contexts (Shopify Blog).
In practice, most Shopify merchants do not manually activate 3D Secure: it is the payment provider that orchestrates the authentication. Your role is rather at the checkout level (clarity, mobile, error messages) and customer service when clients get stuck at the banking step.
Best practices and common mistakes
Choose an SCA-compatible gateway: prioritize recognized solutions for the EEA if you are selling in Europe. Check our article on payment gateways (Stripe, PayPal, Adyen).
Test mobile checkout: a large part of authentication is done via banking apps. A non-responsive checkout funnel or a poorly-managed redirection increases cart abandonment.
Anticipate customer support questions: "My payment is blocked", "I didn't receive the code", and "My bank declined the transaction" are common issues. Provide a clear answer in your FAQ.
Do not confuse 3DS decline with actual fraud: an authentication failure can be due to a distracted customer, an unstable mobile network, or a bank limit, not necessarily a fraudulent attempt.
Monitor checkout abandonment rate: cross-reference checkout data with your conversion rate. A spike after activating a new gateway can indicate an authentication issue.
Classic mistake: disabling or bypassing 3D Secure to "simplify" checkout in Europe. This exposes your store to bank declines, increased fraud, and, depending on the case, heavier chargeback liability.
The essentials to remember about 3D Secure
Key points to remember include: 3D Secure authenticates the buyer during an online card payment; it largely meets the SCA requirements imposed by PSD2 in the EEA and the UK; on Shopify, it is managed by the gateway (Shopify Payments, Stripe, etc.), not manually by the merchant; it protects against fraud and can shift chargeback liability, but sometimes adds friction to the checkout; and the current version (3DS2) is smoother and more mobile-friendly than the older generation.
Associated terms, FAQ, and going further
Associated terms
Notions related to this topic notably include Checkout: the step where 3D Secure authentication occurs, Payment Gateway: the service that connects the store to banking networks and manages 3DS, Shopify Payments: the native Shopify solution with integrated 3D Secure flow, and E-commerce fraud: the risk that 3D Secure helps reduce.
FAQ
Is 3D Secure mandatory for all online stores?
Not everywhere in the world, but it is virtually indispensable if you sell in Europe (EEA, United Kingdom) with locally issued cards. Outside these zones, your payment provider may apply it depending on the risk level perceived by the issuing bank.
What is the difference between 3D Secure and SCA?
SCA is the legal obligation for strong authentication (two-factor) for certain payments. 3D Secure is a technical protocol that enables this authentication to be performed during a card payment.
Does 3D Secure lower conversions?
It can add a step, especially if the user journey is poorly integrated or if the customer does not understand the request. Recent versions (3DS2) and optimized gateways limit this friction. Monitor your payment abandonments after any change of provider.
Does Shopify Payments handle 3D Secure automatically?
Yes. Shopify Payments integrates the 3D Secure flow and only triggers it when the issuer requires it to authorize the payment, according to official Shopify documentation.
Go further
Notions related to this topic notably include What is an e-commerce payment gateway?, How to customize Shopify checkout, Optimize e-commerce checkout and reduce shopping cart abandonment, and Return to the Qstomy e-commerce glossary.
Sources: Shopify Help Center (PSD2 and 3D Secure), Shopify Blog (SCA). Evolving regulation (PSD3 announced for subsequent years): check official texts before making any compliance decisions.
Enzo
June 4, 2026
