3-D Secure

An extra verification step during an online card purchase, usually a code sent to your phone, that confirms you're really the cardholder.

For example, after entering card details at checkout, a shopper might be asked to approve the payment with a fingerprint in their banking app. Many payments skip the extra step entirely.

A messaging protocol developed by EMVCo, the card industry's technical standards body, that lets a card issuer require the shopper to complete an additional identity challenge, typically a one-time passcode or biometric prompt through their banking app, before a card-not-present transaction completes.

The current version, 3-D Secure 2, sends the issuer richer data about the purchase and decides between two outcomes:

• Frictionless flow, in which the issuer scores the data, feels confident, and authenticates the payment with no action from the shopper.
• Challenge flow, in which the issuer wants more proof and asks the shopper to approve in a banking app, use a fingerprint or face scan, or enter a one-time passcode.

A typical 3-D Secure payment follows these steps:

1. The shopper enters card details at checkout.
2. The merchant sends data about the payment and device to the issuer.
3. The issuer approves silently or issues a challenge.
4. After successful authentication, the payment goes on to authorization.

3-D Secure sits next to terms that are easy to mix up:

• Strong Customer Authentication (SCA) is the European rule that requires two independent proofs for most online payments, and 3-D Secure is the common way to meet it.
• One-time passcode is one of the challenge methods the issuer can use.
• Card-not-present fraud is the fraud type the protocol aims to reduce.