3D Secure (3DS) is an authentication step for online card payments. The cardholder confirms their identity with their bank, for example by approving a push notification in the banking app or entering a one-time code. Card schemes brand it as Visa Secure and Mastercard Identity Check.
During checkout the payment gateway sends transaction details to the card issuer. The issuer can approve silently if the risk looks low, which is called a frictionless flow, or challenge the customer for extra proof. Once authenticated, the payment proceeds to normal authorisation.
Online retailers, ordering apps and hospitality web ordering use 3DS to cut card-not-present fraud. Successful authentication can shift responsibility for certain fraud chargebacks from the merchant to the issuer, though the exact rules depend on the scheme and provider.
Pitfalls include poor mobile experiences that cause drop-off at the challenge step, and applying 3DS to every transaction when risk-based rules would suffice. Check that your gateway supports the current 3DS version and lets you tune when challenges appear. Test the flow on real phones. Authentication is handled by the issuing bank, not by the merchant, so businesses only receive the pass or fail result. Ask your gateway provider how it reports 3DS outcomes so you can see where customers abandon checkout.
3DS matters for any business taking payments online, because fraud and chargebacks directly hit margins. Balance security against conversion rather than treating it as a switch.