3-D Secure (3DS)

The name refers to three domains: the merchant and its acquirer, the card issuer, and the scheme infrastructure between them. In the current version, EMV 3DS, the business's checkout sends the issuer a set of data about the device, the order and the customer. The issuer decides whether that is enough to authenticate the payment silently or whether to challenge the cardholder, typically with a prompt in their banking app. A payment authenticated by 3DS generally shifts liability for fraud-related chargebacks from the business to the issuer.

Why it matters: 3DS is how a UK online business satisfies the FCA's strong customer authentication rules, which apply when a payer initiates an electronic payment unless an exemption applies. It also affects authorisation rates in both directions: an authenticated payment is less likely to be declined for risk, and a clumsy challenge is where customers abandon.

For a software platform the practical question is which exemptions the regulated acquiring partner applies and how the checkout handles the challenge inside the product rather than bouncing the customer to a separate page. Merchant-initiated payments against a stored card, such as a recurring charge the customer agreed to, are outside SCA after the first authenticated payment, which is why tokenisation and 3DS are set up together.