3-D Secure 2 is the authentication protocol that asks a cardholder to confirm they are who they say they are, usually through a bank app, a code, or a biometric, before the payment is approved. The challenge protects the merchant, because a payment authenticated through 3-D Secure shifts liability for fraud from the merchant to the card issuer, but it costs conversion, because 10 to 25 percent of challenged shoppers abandon the checkout. The decision is not whether to use 3-D Secure. It is when to challenge and when to exempt, and the answer is to challenge the payments that look risky and exempt the ones that do not, using the data the protocol itself collects.
What the challenge actually does
3-D Secure 2 sends up to 150 data elements to the cardholder's bank, the Access Control Server, which decides whether the payment is low risk enough to approve silently or risky enough to challenge. The data includes the device, the browser, the IP address, the transaction history, and the merchant's own risk signals. When the bank is confident, the payment goes through without the shopper seeing anything. That is the frictionless flow, and it accounts for 70 to 85 percent of transactions, up to 80 to 95 percent when the merchant sends good data. When the bank is not confident, the shopper gets a challenge, and that is where the conversion cost lives.
The liability shift is the reason to care. A payment authenticated through 3-D Secure, with an ECI value of 05 for Visa or 02 for Mastercard, shifts liability for fraud chargebacks from the merchant to the issuer. A payment that is exempted, where the merchant claims an exemption and the issuer accepts it, does not shift liability: if the payment turns out to be fraudulent, the merchant still bears the chargeback. That asymmetry is the whole decision. A challenge costs conversion but buys protection. An exemption saves conversion but keeps the risk.
The protocol version matters too. EMVCo 2.2 and 2.3 are the current versions, and 2.1 was deprecated in September 2024. A merchant still running 2.1 is running a protocol the networks no longer support properly, and the frictionless rate will suffer for it. The upgrade is not optional, and it is not a project. It is a configuration change with the payment processor.
When to exempt, and when to challenge
Exempt the low-risk payments. A returning customer, on a known device, with a purchase history, buying a low-value item, is a payment the bank will approve frictionlessly anyway, and claiming an exemption saves the round trip. The low-value exemption, for transactions under 30 euros, is the most common, but it has a limit: after five consecutive exempted transactions or 100 euros cumulative, the next transaction must be authenticated. The transaction risk analysis exemption is the more powerful one, and it depends on the merchant's fraud rate: a fraud rate below 0.13 percent allows exemptions up to 100 euros, below 0.06 percent up to 250 euros, and below 0.01 percent up to 500 euros. A merchant with a low fraud rate can exempt more, which is the incentive to keep the fraud rate low.
Challenge the high-risk payments. A new customer, on a new device, from a new IP address, buying a high-value item, with a billing address that does not match the shipping address, is a payment that should be challenged, because the cost of a fraudulent order is higher than the cost of a lost conversion. Challenge the payments where the data is thin, where the velocity is high, or where the product is a known fraud target, and the challenge will catch the fraud that the frictionless flow would have missed.
And use the exemption the way it was designed: as a business decision, not a default. A merchant that exempts everything is a merchant that has kept all the liability and saved nothing, because the bank will challenge the risky payments anyway. A merchant that challenges everything is a merchant that has bought protection at the price of conversion, and the price is too high. The right split is the one the data supports, and the data is the fraud rate, the challenge abandonment rate, and the chargeback rate, measured together.
The measurement that settles the argument
Three numbers decide whether the 3-D Secure strategy is working. The frictionless rate, which should be 70 to 85 percent or higher: below that, the merchant is not sending enough data, or the data is wrong. The challenge abandonment rate, which runs 10 to 25 percent: above that, the challenge flow is broken, or the merchant is challenging payments that should have been exempted. And the chargeback rate, which should stay under 0.4 percent for good standing: above 0.6 percent, the merchant is exempting too much, and the liability is showing up as chargebacks.
Review the split monthly, not once. The fraud rate moves with the season, the product mix, and the attacker's attention, and a 3-D Secure strategy that was right in January can be wrong in November. The merchant that reviews the numbers monthly and adjusts the exemption thresholds accordingly is the one that keeps the liability shift where it belongs and the conversion where it belongs. The merchant that sets the rules once and forgets them is the one that discovers the problem from a chargeback report.
Frequently asked questions
What is 3-D Secure 2?
An authentication protocol that asks a cardholder to confirm their identity, usually through a bank app, a code, or a biometric, before a payment is approved. It sends up to 150 data elements to the cardholder's bank, which decides whether to approve silently or challenge.
What is the liability shift?
A payment authenticated through 3-D Secure, with an ECI value of 05 for Visa or 02 for Mastercard, shifts liability for fraud chargebacks from the merchant to the card issuer. A payment that is exempted does not shift liability: if it turns out to be fraudulent, the merchant still bears the chargeback.
How many 3-D Secure transactions go through without a challenge?
70 to 85 percent, up to 80 to 95 percent when the merchant sends good data. That is the frictionless flow, where the bank is confident enough to approve silently. The rest get a challenge, and 10 to 25 percent of challenged shoppers abandon the checkout.
When should I exempt a payment from 3-D Secure?
When the payment is low risk: a returning customer, on a known device, with a purchase history, buying a low-value item. The low-value exemption covers transactions under 30 euros, and the transaction risk analysis exemption depends on the merchant's fraud rate, from 0.13 percent for up to 100 euros down to 0.01 percent for up to 500 euros.