Summary

The 3D Secure standardoften known by its branded names like Visa Secure, Mastercard Identity Check, or American Express SafeKeyaims to reduce fraud and provide added security to online payments.

3D Secure 2 (3DS2) introduces frictionless authentication and improves the purchase experience compared to 3D Secure 1. It is the main card authentication method used to meetStrong Customer Authentication(SCA) requirements in Europe and a key mechanism for businesses to requestexemptionsto SCA.

Stripe supports 3D Secure 2 on ourpayments APIs,mobile SDKs, andStripe Checkout.

A quick history of 3D Secure 1

Despite additional security measures, such as the Address Verification System (AVS) or theCVCverification used in some markets, credit and debit card payments can still be at a high risk of fraud. (In fact, it is because of this risk that customers have the ability todisputefraudulent payments made with their card.)

To address this problem, card networks implemented the first version of 3D Secure in 2001. If you regularly buy items online, you may be familiar with the 3D Secure flow: You enter your card details to confirm a payment and are then redirected to another page where your bank asks you for a code or password to approve the purchase. Because the authentication page is co-branded by the card network, most customers are often more familiar with branded names for 3D Secure, such as Visa Secure, Mastercard Identity Check, or American Express SafeKey.

For businesses, the benefit of 3D Secure is clear: Requesting additional information lets you build in an extra layer of fraud protection and ensure that you only accept card payments from legitimate customers. As an added incentive, authenticating a payment with 3D Secureshifts the liabilityfor chargebacks due to fraud from your business to your customers bank. This added protection is why 3D Secure is often applied to large purchases like airline tickets.

Unfortunately, the use of 3D Secure 1 also has some drawbacks: The additional step required to complete the payment adds friction to the checkout flow and can lead customers to abandon the purchase. Additionally, a number of banks still force their cardholders to create and remember their own static passwords to complete 3D Secure verification. These passwords are easy to forget, which can lead to higher rates of cart abandonment.

Whats different with 3D Secure 2

EMVCo, an organization made up of six major card networks, released a newer version of 3D Secure. 3D Secure 2 (also called EMV 3-D Secure, 3D Secure 2.0, or 3DS2) aims to address many of the shortcomings of 3D Secure 1 by introducing less disruptive authentication and a better user experience.

Frictionless authentication

3D Secure 2 allows businesses and their payment provider to send more data elements on each transaction to the cardholders bank. This includes payment-specific data like the shipping address, as well as contextual data, such as the customers device ID or previous transaction history.

The cardholders bank can use this information to assess the risk level of the transaction and select an appropriate response:

• If the data is enough for the bank to trust that the real cardholder is making the purchase, the transaction goes through the frictionless flow and the authentication is completed without any additional input from the cardholder.

• If the bank decides it needs further proof, the transaction is sent through the challenge flow and the customer is asked to provide additional input to authenticate the payment.

Although a limited form of risk-based authentication was already supported with 3D Secure 1, the ability to share more data using 3D Secure 2 aims to increase the number of transactions that can be authenticated without further customer input.

Even if a transaction follows the frictionless flow, your business will benefit from the sameliability shiftthat it does for transactions that pass through the challenge flow.

Better user experience

Unlike 3D Secure 1, 3D Secure 2 was designed after the rise of smartphones and makes it easier for banks to offer innovative authentication experiences through their mobile banking apps (sometimes referred to as out-of-band authentication). Instead of entering a password or receiving a text message, the cardholder can authenticate a payment through the banking app just by using their fingerprint or even facial recognition. We expect many banks to support these smoother authentication experiences with 3D Secure 2.

The second improvement in user experience is that 3D Secure 2 is designed to embed the challenge flow directly within web and mobile checkout flowswithout requiring full page redirects. If a customer authenticates on your site or webpage, the 3D Secure prompt now by default appears in a modal on the checkout page (browser flow).

If youre building an app, mobile SDKs built for 3D Secure 2 let you build an in-app authentication flow and avoid browser redirects altogether.

3D Secure 2 and Strong Customer Authentication

The enforcement ofStrong Customer Authentication(SCA) makes 3D Secure 2 all the more important if you are doing business in Europe. As this regulation requires you to apply more authentication on European payments, the improved user experience of 3D Secure 2 can help reduce the negative impact on conversion.

The 3D Secure 2 protocol itself also allows payment providers like Stripe to requestexemptionsto SCA and skip authentication for low-risk payments altogether. Payments that require SCA will need to go through the challenge flow, whereas transactions that can be exempted from SCA can be sent through the frictionless flow. However, its worth noting that if the payment provider requests an exemption for payments requiring SCA and the transaction passes through the frictionless flow, it doesnt benefit from the liability shift.

How does Stripe support 3D Secure 2?

Stripe supports the 3D Secure 2 browser flow on ourpayments APIsandCheckout, letting you dynamically apply 3D Secure to high-risk payments to protect your business from fraud. We will apply 3D Secure 2 when its supported by the cardholders bank and fall back on 3D Secure 1 when the new version isnt supported yet.

If youre building a mobile application, ouriOSandAndroid SDKslet you build an in-app authentication flow to offer a native authentication experience and avoid redirecting your customers outside of your application. Even if the cardholders bank doesnt yet support 3D Secure 2, our mobile SDKs will dynamically fall back to showing 3D Secure 1 in a webview embedded within your application.

Learn more about ourpayments APIs,mobile SDKs,orStripe Checkoutto get started with 3D Secure 2.