About 3D Secure

3D Secure adds a layer of security, prior to authorization, to help authenticate online transactions by requiring customers to complete an additional verification with the card issuer. For example, when the merchant initiates 3D Secure at checkout, the cardholder must then enter a one-time passcode received via email or SMS to continue with their purchase.

In 2019, banks began to phase in support for 3D Secure 2, which makes several improvements to the original 3D Secure protocol, 3D Secure 1. Although 3D Secure 1 provided improved security, 3D Secure 2 provides an improved cardholder experience and is updated for payments made using smartphones.

This new version introduces frictionless authentication, which minimizes the inconveniences cardholders might experience when making a card purchase, while also reducing fraud and providing added security to online transactions. 3D Secure 2 improves the authentication flow by embedding the challenge within the checkout flow without redirecting the cardholder to additional authentication pages.

3D Secure 2 is the primary method for meeting the new strong customer authentication (SCA) regulation in Europe that requires increased security. The SCA regulation requires that transactions be secured using 3D Secure. To do business in Europe, you will need to apply more authentication to transactions. Using 3D Secure provides this additional security without negatively impacting the cardholder experience.

Not all merchants have fully transitioned from 3D Secure 1 to 3D Secure 2. Marqeta supports both 3D Secure 1 and 3D Secure 2 for Visa.

If an online payment is successfully authenticated via 3D Secure, the merchant is not liable for subsequent fraud-related chargebacks on that transaction. If a transaction is disputed by the cardholder as fraudulent, liability shifts from the merchant to the card issuer.

However, if a cardholder disputes a transaction for a reason other than fraud, liability remains with the merchant. For these cases, you should plan how to avoid and manage disputes.

There are rare cases when transactions authenticated by 3D Secure do not shift liability to the issuer, such as if an account experiences excessive levels of fraud.

Transactions that have been authenticated using 3D Secure cannot be disputed as fraudulent; however, the issuer may investigate a transaction by requesting additional information.

An exemption allows a transaction to take place without conforming to the SCA two-factor authentication requirement. You can take advantage of exemptions allowed under the Revised Payment Services Directive (PSD2). Transactions that qualify for an exemption enable a frictionless experience for cardholders while remaining vigilant for fraud risk. Exemptions may be granted in cases such as low-value transactions, low-risk transactions, those involving secure corporate payments, or those with merchants on the allow list. Be aware that exemptions present the following considerations:

The cardholder can likely claim full reimbursement from their payment service provider if there was no SCA measure in place and if the cardholder did not act fraudulently.

The key details of the SCA exemptions were defined in the Official Journal of the European Union on March 13, 2018 and in PSD2 Directive 2015/2366 of the European Parliament and of the Council of November 25, 2015.

The following 3D Secure policies are available:

There are two options available for authenticating your cardholders when it has been determined that an SCA (challenge) is required. Both of these options are available regardless of the 3D Secure policy that you choose; however, each option has different integration and configuration requirements:

Both of these options are available, regardless of the 3D Secure policy that you choose; however, each option has unique integration and configuration requirements.

In the payments ecosystem, authorization occurs after the completion of 3D Secure authentication. The merchant uses the authentication data captured as part of the 3D Secure process to submit an authorization for approval. For more on authorization transactions, see About Transactions.

In order to claim any of the allowed SCA exemptions, the PSD2 regulation mandates certain monitoring, reporting, and auditing requirements. Marqeta does not own any liability or responsibility in regard to satisfying the requirements of monitoring, reporting, or audits under PSD2 or when any SCA exemptions are claimed.

Marqeta is an issuer processor. For 3D Secure, the transaction authentication requests are limited to remote (i.e., card not present) e-commerce transactions only. The fraud rate and other reporting requirements, however, apply at the issuer level and across all payment transactions, i.e., both remote and non-remote.

Marqeta cannot provide a holistic view of fraud rates and other data for the issuer bank, who may have many programs for which they have issued cards. It is your responsibility—or the responsibility of your issuer bank—whether you are using your own systems to make 3D Secure SCA decisions or are using the Automated Decisioning self-serve solution to manage this (depending on whether you or the issuing bank are the BIN sponsor and on the agreement between you and your bank).