3-D Secure (3DS) explained: authentication and the liability shift in Visa’s rules

What 3-D Secure is

Visa’s rules define 3-D Secure as a Visa-approved authentication method that is the global authentication standard for e-commerce transactions. Visa’s own service built on it is Visa Secure, which the rules describe as a Visa-approved authentication method based on the 3-D Secure Specification. Other card networks publish their own rules; this guide quotes Visa’s documents only.

The specification itself is maintained by EMVCo. Its 3-D Secure page (opened 25 October 2026) calls the current generation EMV 3DS and recommends version 2.2 or higher. When people search for 3DS2 or 3D Secure 2, this is the version family they mean.

How an authentication works

EMVCo describes the flow in plain terms. A shopper pays by card on a website or in an app. To confirm that the person paying is the cardholder, the merchant uses EMV 3DS to send the card-issuing bank details about the transaction, the payment method and the device. The issuer uses that data to authenticate the shopper.

• Without a challenge: the issuer is satisfied by the data alone, and the shopper sees nothing extra at checkout.
• With a challenge: for higher-risk transactions the issuer may ask the shopper to confirm, for example with a one-time passcode, knowledge-based questions or biometrics.
• Attempted: Visa’s rules describe an attempt response as a message from the issuer or Visa saying that the issuer or the cardholder is not participating in Visa Secure.
• The result travels with the payment: the issuer’s answer carries a unique value, the Cardholder Authentication Verification Value (CAVV), and the acquirer may only mark a transaction with Electronic Commerce Indicator 5 or 6 if the authorization request included it (Visa rules section 5.8.4.4).

EMVCo also notes that a 3DS transaction uses consumer data to evaluate fraud risk, and that merchants and issuers using it are responsible for complying with applicable privacy laws.

The liability shift: what Visa’s dispute rules actually say

“Liability shift” is not a heading in Visa’s dispute rules. The effect comes from the list of invalid disputes under dispute condition 10.4, Other Fraud – Card-Absent Environment: the condition for a cardholder who denies authorizing or taking part in a card-absent transaction. If a transaction meets one of the listed conditions, the issuer cannot raise that dispute, so the fraud loss does not pass back to the merchant through it.

Scroll the table to see all columns.

Two limits follow from where these rows sit. They belong to dispute condition 10.4 only, so they say nothing about disputes raised under other conditions, such as a cardholder saying the goods never arrived or a subscription was not cancelled. And they depend on the data reaching the authorization request, which is a technical matter between the merchant’s checkout, its gateway and its acquirer.

US merchant categories excluded from the protection

In the US region, section 5.8.4.6 of Visa’s rules requires the acquirer to tell a merchant that its authenticated e-commerce transactions are not eligible for dispute protection from condition 10.4 if the merchant is classified under one of these merchant category codes:

• 4829 Wire Transfer Money Orders
• 5967 Adult Content and Services
• 6051 Non-Financial Institutions – Foreign Currency, Liquid and Cryptocurrency Assets (for example: Cryptocurrency), Money Orders (not Money Transfer), Travelers Cheques, and Debt Repayment
• 6540 Non-Financial Institutions: Stored Value Card Purchase/Load
• 7801 Government Licensed On-Line Casinos (On-Line Gambling)
• 7802 Government-Licensed Horse/Dog Racing
• 7995 Betting, including Lottery Tickets, Casino Gaming Chips, Off-Track Betting, and Wagers at Race Tracks

For a US merchant under one of these codes, an authenticated payment does not make a 10.4 fraud dispute invalid. Which code applies to a business is the acquirer’s decision; the guide to high-risk merchant category codes sets out how Visa’s rules assign them.

Is 3-D Secure required?

Visa’s rules (section 5.8.4.3) require every acquirer to tell its e-commerce merchants that Visa Secure is available and to provide it when a merchant asks. A regional table then sets stricter duties in some places: in the Europe region, acquirers must process secure e-commerce transactions using Visa Secure, and in several Asia-Pacific and CEMEA countries merchants must be enabled for it or use it, in some cases only for listed category codes. The table sets no such requirement for the US region.

Visa can also impose security or authentication requirements on a merchant it treats as high integrity risk (section 10.4.5.3), so a provider may make 3-D Secure a condition of an offer even where the general rules do not. In Europe, EMVCo’s page notes that the European Banking Authority’s opinion of 21 June 2019 recognised protocols such as EMV 3DS as a means for merchants and issuers to support strong customer authentication under the Second Payment Services Directive.

What to ask a provider about 3-D Secure

• Whether the gateway and acquirer behind the offer support EMV 3DS, and which version.
• Whether 3-D Secure is required on all transactions, on some, or left to the merchant, and where the offer says so in writing.
• Whether the authentication value is passed into the authorization request, so that the indicator 5 or 6 rows can apply.
• Which merchant category code the provider expects to assign, and whether that code is one of the US codes excluded from the dispute protection.
• How disputes that 3-D Secure does not address, such as non-receipt or cancellation claims, count toward the monitoring thresholds in the offer.

Zolution is a free marketplace (Zolution Standard membership costs nothing) where a merchant publishes one request and compares offers from payment providers whose declared coverage includes the merchant’s industry. The terms in an offer are provider-declared, and the provider decides on approval and on what authentication it requires.

Questions, answered