3D Secure explained: EMV 3DS 2, SCA and exemptions

3D Secure (3DS) is the card industry's protocol for confirming that the person paying online is the genuine cardholder: the merchant sends transaction, payment and device data to the card issuer, which either approves without bothering the shopper (the frictionless flow) or asks for extra proof such as a one-time passcode or a banking-app approval (the challenge flow). The current version, EMV 3-D Secure, is maintained by EMVCo, and in the EU it is the usual way issuers apply the strong customer authentication (SCA) that payment law requires.

The card schemes brand it differently: Visa calls its programme Visa Secure, and Mastercard's is Identity Check. The underlying protocol is the same.

The parties in an EMV 3DS authentication

Source: EMVCo 3-D Secure White Paper v2, checked 3 November 2026.

Authentication is separate from authorisation. 3DS answers "is this the cardholder?" The payment authorisation that follows answers "will the issuer pay?" Our guide to how card payments work covers that second step.

How EMV 3DS works, step by step

1. Checkout begins. The shopper enters a card on the merchant's site or app.
2. The 3DS Method runs (browser checkouts). A hidden iframe lets the issuer's ACS gather browser data early. EMVCo says this typically completes within 5 seconds, and Visa recommends allowing 5 seconds for it.
3. The 3DS Server sends an Authentication Request (AReq). It carries device, cardholder and transaction data, plus any exemption request from the merchant. The Directory Server routes it to the issuer's ACS.
4. The ACS assesses risk. It scores the payment using the data received.
5. The ACS replies with an Authentication Response (ARes). Either the shopper is authenticated without further steps (frictionless), an exemption is applied, or a challenge is required.
6. If a challenge is needed, the shopper responds. The bank shows a passcode screen, a biometric check or an approval in its app. Challenge messages pass between the shopper's device and the ACS.
7. The ACS sends the result (RReq). The 3DS Server acknowledges it.
8. The merchant sends the authorisation. The authentication result travels with the payment to the acquirer and issuer.

Decoupled and merchant-initiated authentication

EMVCo also defines decoupled authentication, where the bank verifies the cardholder outside the checkout, for example by text, email, phone call or push notification, and returns the result later. It serves as a fallback when the normal challenge cannot run, and EMVCo says it is the only way to challenge cardholders in 3RI requests, which are started by the merchant without the cardholder present (for example some mail and telephone orders, recurring payments or split shipments).

Frictionless vs challenge

Sources: EMVCo; Visa, checked 3 November 2026.

EMVCo's August 2025 white paper update lists the authentication methods available inside a challenge: one-time passcodes, out-of-band approval in a banking app, WebAuthn, and Secure Payment Confirmation, a W3C web standard built on WebAuthn.

The data merchants send

The frictionless rate depends heavily on data. EMVCo says its core specification defines more than a hundred data elements. Visa's best-practice guide for Visa Secure singles out priority fields: browser IP address and screen size (browser checkouts), a device identifier (app checkouts), cardholder name, email and phone number, and billing and shipping addresses.

Visa published the effect of better data in the same guide:

Source: Visa, dataset of over 95% of Visa Secure global transactions, February to March 2022. Visa also reports up to a 65% lift in issuers' fraud detection rate when priority data is present, based on Visa global fraud reports from August 2021.

Strong customer authentication in plain English

SCA is a legal requirement in the EU and EEA. The technical rules sit in Commission Delegated Regulation (EU) 2018/389, adopted on 27 November 2017, which applies from 14 September 2019.

Article 4 of that regulation says SCA must use two or more elements from three categories:

The elements must be independent, so that a breach of one does not weaken the others. For remote payments, Article 5 adds dynamic linking: the shopper must see the amount and the payee, and the authentication code must be tied to both. Change either, and the code is no longer valid.

EMV 3DS is how most card issuers deliver this online. EMVCo notes that an EBA opinion of 21 June 2019 recognised that protocols such as EMV 3DS can support SCA. The issuer, not the merchant, performs SCA; the merchant's job is to send good data and request an exemption where one fits.

SCA exemptions

Regulation 2018/389 lists cases where the payer's bank may skip SCA. The ones that matter most to card merchants:

Source: Regulation (EU) 2018/389 as published in the Official Journal, checked 3 November 2026.

Transaction risk analysis

TRA lets a provider skip SCA on a remote payment if its own fraud rate for that payment type stays under a reference rate, the amount is under the matching threshold, and its real-time checks raise no warnings. Those checks look for unusual spending, unusual device or software access, signs of malware, known fraud scenarios, abnormal payer location and high-risk payee location.

Source: Annex to Regulation (EU) 2018/389.

In 3DS terms, the merchant or its PSP can ask for an exemption in the AReq, and the issuer's ACS decides whether to accept it and reports that in the ARes. The issuer can always insist on a challenge. For the EU's planned payments reform, see our PSD3 and PSR explainer.

Versions of EMV 3DS

Source: EMVCo 3-D Secure page, checked 3 November 2026.

EMVCo has also defined five message extensions that add data without a new version: Device Acknowledgement, Bridging, Attribute Verification, Travel Industry and Payment Token. The Payment Token extension links 3DS to network tokenisation. For apps, EMVCo describes a Split-SDK option that moves much of the SDK logic to a server, so fixes do not require an app update.

Who provides 3D Secure

• Card schemes run the Directory Servers and the branded programmes: Visa Secure (Visa) and Mastercard Identity Check (Mastercard). Mastercard's 1 June 2026 European release describes a frictionless Identity Check that helps issuers assess risk without disrupting the shopper.
• Issuers run, or outsource, the ACS.
• PSPs and gateways usually provide the 3DS Server and SDK to merchants as part of their checkout. Primer lists 3D Secure among its products, and Stripe documents 3DS handling within its payment flows. When payments are split across processors, authentication has to match the acquirer: Stripe's orchestration documentation asks merchants to supply the acquirer BIN of the processor each 3DS payment is routed to. See our payment orchestration guide.

Benefits and trade-offs for merchants

How fraud chargeback liability is allocated for authenticated payments is set by each card scheme's rules and is outside the scope of this guide; acquirers can confirm the terms that apply. More in the cards hub and the regulation hub.

Frequently asked questions

What is 3D Secure?

3D Secure (3DS) is the card industry's protocol for confirming that the person paying online is the genuine cardholder. The merchant sends transaction, payment and device data to the issuer, which either approves without bothering the shopper or asks for extra proof such as a one-time passcode or a banking-app approval. The current version, EMV 3-D Secure, is maintained by EMVCo.

What is the difference between frictionless and challenge flow in 3D Secure?

In the frictionless flow the shopper does nothing beyond clicking pay, because the issuer's real-time risk check is satisfied or an exemption applies. In the challenge flow the issuer sees higher risk or needs cardholder confirmation, so the shopper enters a passcode, uses biometrics or approves in a banking app.

Is 3D Secure the same as SCA?

No. SCA is a legal requirement in the EU and EEA, while EMV 3DS is how most card issuers deliver it online. The issuer, not the merchant, performs SCA; the merchant's job is to send good data and request an exemption where one fits.

What are the SCA exemptions for card payments?

Regulation 2018/389 lists cases where the payer's bank may skip SCA, including contactless payments up to EUR 50, low-value remote payments up to EUR 30, recurring transactions, trusted beneficiaries and transaction risk analysis. The issuer's ACS decides whether to accept an exemption request and can always insist on a challenge.

What are Visa Secure and Mastercard Identity Check?

They are the card schemes' brand names for 3D Secure: Visa calls its programme Visa Secure, and Mastercard's is Identity Check. The underlying protocol is the same.

How can merchants reduce 3D Secure challenges?

Better data helps. In Visa's figures from February to March 2022, merchants that completed the 3DS Method at least 95% of the time saw a +127% frictionless rate, and those that filled more than half of the priority data elements saw +57%. Priority fields include browser IP address, a device identifier, cardholder name, email and phone number, and billing and shipping addresses.

Key terms

• ACS (Access Control Server): the issuer-side system that authenticates the cardholder.
• AReq / ARes: the authentication request and response messages.
• Challenge flow: authentication that asks the shopper for extra proof.
• Directory Server: the scheme system that routes 3DS messages to the issuer.
• Dynamic linking: tying the authentication code to the amount and payee.
• Frictionless flow: authentication approved on data alone, with no shopper action.
• SCA: strong customer authentication, using two of knowledge, possession and inherence.
• TRA: transaction risk analysis, an SCA exemption based on a provider's fraud rate.
• 3RI: a 3DS request started by the merchant without the cardholder present.