What are 3DS and SCA? 3-D Secure and strong authentication

3-D Secure (3DS) is a card-industry protocol that lets the card issuer authenticate the shopper during an online payment. Strong Customer Authentication (SCA) is the EU legal requirement, under the second Payment Services Directive (PSD2), that many electronic payments be confirmed with two independent factors. For online card payments, 3DS is the usual way to meet SCA.

What SCA requires

PSD2 defines strong customer authentication as authentication based on two or more elements from different categories: knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is), independent so that a breach of one does not compromise the others. Payment service providers must apply it when a payer accesses their account online, initiates an electronic payment, or does anything through a remote channel that may imply a risk of fraud. The regulatory technical standards that set the details apply from 14 September 2019.

How 3DS works

EMVCo, which maintains the EMV 3-D Secure specifications, describes it as an exchange of data between the merchant and the issuer, covering the transaction, the payment method and the device, so the issuer can authenticate the shopper. If the issuer is satisfied, the payment goes through without the shopper doing anything (a frictionless flow). Otherwise, the shopper completes a challenge, such as a one-time code, a banking-app approval or a biometric check.

Exemptions

The EU standards allow payment service providers not to apply SCA in defined cases, including:

  • Low-value payments: a remote payment of no more than EUR 30, provided the payments since the last SCA total no more than EUR 100, or number no more than five in a row.
  • Transaction risk analysis: low-risk payments, when the provider's fraud rate for remote card payments stays at or below 0.13 percent for amounts up to EUR 100, 0.06 percent up to EUR 250, or 0.01 percent up to EUR 500.

In a hypothetical case, a shopper who has spent EUR 20 and EUR 45 since last authenticating makes a EUR 25 purchase. That fits the low-value exemption, but the issuer can still ask for authentication.

Why it matters for an online store

Authentication adds a step at checkout, and a clumsy challenge can cost sales (see cart abandonment). In return, fraud chargebacks on successfully authenticated payments typically shift liability from the merchant to the issuer. Stripe's documentation stresses that this liability shift is expected but never guaranteed for a given payment.

Common mistakes

  • Assuming 3DS always means a pop-up; many authentications are frictionless.
  • Treating exemptions as the merchant's right. They are applied by payment service providers, and the issuer has the final say.
  • Keeping an old integration: major card brands no longer support 3D Secure 1.

Your payment gateway usually runs 3DS for you.

Sources