3D Secure 2 (3DS2)

3D Secure 2 (3DS2), standardised as EMV 3-D Secure by EMVCo, is the dominant card-payment authentication protocol for implementing Strong Customer Authentication (SCA / PSD2) on online transactions. It replaced 3DS1 (support discontinued October 15, 2022) and is now the mandatory authentication mechanism for SCA-regulated markets (EEA, UK) and an emerging mandate in others (Japan from April 2025). Unlike 3DS1's static-password challenge, 3DS2 sends more than 100 data elements to the issuing bank — including device fingerprint, shipping address, and transaction history — enabling risk-based authentication decisions that often require no cardholder interaction at all. (Stripe, stripe.com/guides/3d-secure-2, active 2026)

How 3DS2 Works

Data enrichment

Where 3DS1 sent fewer than 10 data elements to the issuer, 3DS2 sends over 100 — including device ID, IP address, shipping address, browser fingerprint, and prior transaction history — allowing issuers to make far more precise risk decisions. (Stripe, stripe.com/guides/3d-secure-2; ProcessOut, processout.com/blog/sca-finding-the-balance-between-risk-and-friction, March 2024)

Frictionless vs challenge flow

3DS2 produces one of two authentication paths:

Path	What happens	Cardholder experience
Frictionless	Device fingerprint and transaction data assessed silently; issuer approves without cardholder input	Invisible — no interruption
Challenge	Issuer determines risk too high; cardholder prompted for OTP, biometric, or banking-app confirmation	Explicit step — typically a modal in the checkout flow

The issuing bank decides which path applies. The merchant and PSP can influence this decision by sending richer data and requesting exemptions, but cannot control the final outcome. (ProcessOut, March 2024)

Practitioners in r/payments note the conversion impact is almost entirely from the challenge flow — frictionless 3DS2 is "basically invisible to the customer." (r/payments, 2024-04, ~60 upvotes)

Liability shift

Successful 3DS2 authentication — frictionless or challenged — shifts fraud chargeback liability from the merchant to the issuing bank. (Stripe, stripe.com/guides/3d-secure-2, active 2026)

Scenario	Fraud liability
Challenge flow completed	Shifts to issuer
Frictionless granted (no exemption requested)	Typically shifts to issuer
SCA exemption applied by merchant/PSP	Stays with merchant/acquirer
Transaction out of SCA scope	Outside framework

The liability shift covers only fraud-coded disputes — it does not cover chargebacks for "item not received" or "not as described." (Paytia, paytia.com/resources/blog/3-d-secure-authentication, 2026)

Spec Versions

Current production standard: EMV 3DS v2.3.1.1

EMV 3DS v2.3.1.1 replaced v2.3.1.0 effective May 2023 and is the current production standard for which EMVCo testing is available. (EMVCo Knowledge Hub, emvco.com/knowledge-hub/enhancing-the-emv-3-d-secure-specifications/, 2023-05-19)

Key features by version

EMV 3DS v2.2:

Delegated authentication: merchant with FIDO-compliant biometric capability (e.g. fingerprint in their own app) can authenticate on behalf of the cardholder, potentially removing the 3DS redirect entirely. Issuer adoption was noted as limited as-of March 2024. (ProcessOut, March 2024)
Decoupled authentication: the challenge can occur up to 7 days after the payment request in a separate channel — useful for high-value B2B transactions. (ProcessOut, March 2024)

EMV 3DS v2.3:

WebAuthn / Secure Payment Confirmation (SPC): developed with W3C and FIDO Alliance, allows issuers and merchants to use biometric authentication (fingerprint, face) within the 3DS flow, replacing OTP. (EMVCo, emvco.com/knowledge-hub/what-is-new-with-emv-3ds-v2-3/, modified 2024-09-26)
Automated OOB transitions: automates the app-switch from merchant app to banking app for out-of-band authentication, eliminating manual steps. (EMVCo, 2024-09-26)
Device binding: consumers can specify they want to be remembered on a device for faster future authentication. (EMVCo, 2024-09-26)
Split-SDK Specification: separates client and server SDK functions, enabling 3DS deployment across non-traditional channels including smart speakers and IoT devices. (Checkout.com, checkout.com/blog/3ds-2-3, 2023-08-15)

EMV 3DS White Paper update (August 2025): EMVCo updated the White Paper to add guidance on Challenge Flow (including WebAuthn/SPC and Decoupled Authentication), 3DS message extensions (five defined to date: Device Acknowledgement, Bridging, Attribute Verification, Travel Industry, Payment Token), and Split-SDK architecture. (EMVCo Knowledge Hub, emvco.com, 2025-08-21)

Browser-based OOB guidance (February 2026): EMVCo identified a primary failure mode — when a cardholder switches from the merchant's mobile browser to their banking app, the issuer times out the authentication. EMVCo recommends issuers adopt a flow where the issuer directly retrieves the authentication result and sends it to the merchant before the cardholder manually clicks "Complete," eliminating this timeout. (EMVCo Knowledge Hub, 2026-02-04; collaborators: Netflix, G+D Netcetera, Entersekt)

EMV 3DS v2.4.0.0 (draft): Draft Specification published June 3, 2026, accessible to EMVCo subscribers. Eyes AI-powered risk-based authentication and full EUDI Wallet integration. (EMVCo, emvco.com, 2026-06-03)

Network deprecations and mandate timeline (as-of 2026-07-05)

Event	Date
3DS1 discontinued by all major card brands	October 15, 2022
Bancontact (BCMC) stopped supporting 3DS1	June 2024
Mastercard deprecated EMV 3DS v2.1.0	July 2024
Visa deprecated EMV 3DS v2.1.0	September 24, 2024
JCB updated mandatory J/Secure data fields to "required"	October 1, 2025
Japan Credit Card Security Guidelines (3DS2 mandate)	April 1, 2025
PCI 3DS SDK Security Standard sunset period	May 1 – October 31, 2026
EMV 3DS v2.4.0.0 draft published (subscriber access)	June 3, 2026

(Sources: Adyen Docs, docs.adyen.com/online-payments/3d-secure-for-regulation-compliance; Stripe, stripe.com; EMVCo, emvco.com; PCI SSC, pcisecuritystandards.org)

SCA Exemptions

3DS2 enables PSPs and merchants to request SCA exemptions — authentication is skipped for qualifying transactions, improving conversion. Exempted transactions that pass frictionless do NOT benefit from the liability shift. (Stripe, stripe.com/guides/3d-secure-2)

Exemption type	Conditions	Liability
Low-value	<€30; resets after 5 consecutive uses or €100 aggregate	Stays with merchant
Transaction Risk Analysis (TRA)	Merchant/PSP fraud rate meets thresholds; richer data sent	Stays with merchant
Merchant-initiated (MIT)	Only SCA required at mandate setup; subsequent charges exempt	Stays with merchant
Card-on-file (Pattern 2 in Japan)	Stored credential for returning shoppers	Stays with merchant

Practitioner notes on exemptions:

TRA is described as the most commercially impactful exemption for mid-market merchants, but practitioners warn: "If you request TRA and the customer disputes as fraud, you own the chargeback — no issuer liability. Be honest about your data before leaning on TRA." (r/ecommerce, 2025-06, ~55 upvotes)
Low-value exemptions work reliably but the cumulative reset catches merchants off guard: "Suddenly a regular customer who's made a few small purchases gets challenged and doesn't understand why." (r/ecommerce, 2024-03, ~29 upvotes)
MITs for subscriptions are frequently misconfigured — setting incorrect flags causes renewals to be treated as customer-initiated and trigger 3DS. (r/stripe, 2025-01, ~63 upvotes)
Adyen's Japan data shows card-on-file (Pattern 2) RBA exemptions for returning shoppers improved conversion by over 5% for Wolt. (Adyen Knowledge Hub, 2025-06-02)

Conversion and Fraud Impact Data

Japan post-mandate (April 2025 — as-of mid-2025)

Japan's Credit Card Security Guidelines mandated 3DS2 from April 1, 2025. This is the best available natural experiment for measuring 3DS2 mandate impact.

Stripe data (H1 2025): Transactions routed through 3DS quadrupled post-mandate; 60% authenticated via the frictionless pathway; average 93% conversion rate; dispute rates fell more than 30% versus the same period the prior year. (Stripe, stripe.com/blog/3ds-trends-in-regulated-markets, 2025-08-26)

Adyen data (as-of June 2025):

Gross success rate (individual transaction attempt) dropped ~1.6 percentage points
Net success rate (entire purchase order, accounting for retries) dropped ~0.8 percentage points
~3% of initiated 3DS2 transactions fail because cards are not enrolled for online use (issuer not set up)
Fraud-related issuer rejections: >4% of initiated 3DS2 transactions (Japanese issuers treat sustained monthly fraud above ¥500,000 over three months as "high fraud")
Technical errors during fingerprinting/challenge: ~2% of initiated transactions
Fraud notifications of fraud decreased up to 75% for in-scope transactions (as-of June 2025; Adyen notes fraud/chargeback data lags by up to 3 months) (Adyen Knowledge Hub, adyen.com/knowledge-hub/post-3ds-mandate-in-japan, 2025-06-02)

Japan conversion data — Stripe vs Adyen framing. Stripe reports 93% average conversion rate with 60% frictionless (optimistic framing: "mandate worked"). Adyen reports net success rate fell ~0.8pp and flags specific friction failure modes (un-enrolled cards, issuer risk aversion, technical errors). The figures are not necessarily irreconcilable — Stripe measures overall conversion rate, Adyen measures success rate delta — but both publishers have a commercial interest in presenting their platform's mandate handling favourably. Neither figure comes from an independent audit.

European SCA markets (as-of H1 2024–mid 2025)

Successfully authenticated transactions (frictionless or challenged) are up to 3% more likely to be authorised than unauthenticated ones. (Adyen Knowledge Hub, 2025-06-02)
SCA caused initial conversion drops of 10–20% for unprepared merchants; merchants with proper exemption strategies saw impacts of 1–3%. (r/payments, 2024-01, ~88 upvotes)

Market maturity by country:

UK (most mature): UK issuers accepted exemption requests at rates 10 percentage points higher than EEA issuers; authentication success rates 5–10% higher than comparable SCA markets; over 75% of UK challenges authenticated via banking app (mostly biometrics). The FCA granted the UK an extra year to implement SCA vs the EEA, giving issuers more time to invest in risk-based infrastructure. (Stripe, 2025-08-26)
France: issuers challenged transactions at ~100% higher rates than the rest of the EEA and ~200% higher than UK, yet maintained high challenge success rates; frictionless increased 40% in H1 2024 as French issuers approved more exemption requests when richer data was sent over 3DS rails. (Stripe, 2025-08-26)
Southern Europe: noted by practitioners as having the worst-performing issuers for frictionless approval rates. (r/fintech, 2024-03, ~38 upvotes)

Issuer Behaviour

Issuer inconsistency is a major operational variable. Practitioners report that some banks frictionless-approve 95% of transactions while others challenge almost everything regardless of risk signals. (r/fintech, 2024-03, ~38 upvotes)
Soft declines (issuer returns error code 65 requiring SCA) are a top operational pain point. Platforms that don't handle the retry loop gracefully lose customers: "the customer sees a failure, closes the tab, and you never get them back." (r/payments, 2024-07, ~71 upvotes)
Japan issuer anomaly: post-mandate, Japanese issuers were paradoxically rejecting successfully authenticated transactions with "Suspected Fraud" declines — Adyen attributes this to disconnected Authentication and Authorisation platforms at those issuers. (Adyen Knowledge Hub, 2025-06-02)
Japan enrollment gap: ~3% of initiated transactions fail because the cardholder has not completed the 3DS2 enrollment/phone-number confirmation process with their issuer. (Adyen Knowledge Hub, 2025-06-02)

See Soft Decline for retry loop handling patterns.

PSP Comparison

Practitioners frequently compare PSP handling of 3DS2:

PSP	3DS2 approach	Practitioner view
Adyen	Configurable TRA thresholds, rich reporting by BIN/issuer/country	Praised for granular control and transparency; preferred by larger merchants
Stripe	Automated exemption logic (Stripe Radar); AI-optimised	Described as a "black box" at standard tier — no dashboard showing frictionless vs challenge split; enterprise tier has more control
Checkout.com	Granular reporting by BIN, issuer, country	Praised for 3DS2 data visibility
Shopify Payments	Automatic 3DS2 with no merchant visibility	Criticised: "flying blind — no % of checkouts in challenge flow vs frictionless"

(r/payments, r/stripe, r/shopify, 2024–2025; all stale-risk flagged)

Stripe vs Adyen for SCA control. r/payments merchants favour Adyen for granular exemption configuration and liability transparency. r/stripe merchants argue Stripe's automation is "good enough for most merchants and requires less operational overhead." The split tracks merchant size — smaller/mid-market prefers Stripe's managed approach; larger merchants prefer Adyen's configurability.

PSD3 / PSR Implications (as-of December 2025)

All PSD3/PSR claims are based on the political agreement reached 27 November 2025. Final legal text had not been published at time of source (December 2025). Formal adoption expected Q1–Q2 2026.

SCA redefined: PSR expected to allow two authentication elements from the biometric (inherence) category specifically — physiological biometrics (fingerprint, face) combined with behavioral biometrics (typing patterns, touch patterns) — rather than two elements from possession or knowledge categories. (OneSpan, onespan.com/blog/psd3-psr-updates-2025, 2025-12-16)
Behavioral monitoring mandated: PSPs must include environmental and behavioral characteristics (device fingerprinting, malware detection, remote access tool detection, typing/touch patterns) as mandatory enhanced transaction monitoring. (OneSpan, 2025-12-16)
Fraud intelligence sharing: PSPs to share fraud data with each other and with social media and telecom platforms. Revolut cited that ~75% of authorized fraud originates on social media. (OneSpan, 2025-12-16)
Delegated authentication legal basis: PSD3/PSR expected to give delegated authentication a defined legal basis; more wallet-led delegated SCA anticipated from 2027. (Ravelin research summary, 2025)
3DS2 continuity: the fundamental role of EMV 3DS 2 as the primary SCA mechanism for card payments is not under threat from PSD3. (gPayments, gpayments.com, 2026)
TRA thresholds: the proposed strengthened TRA exemption framework would introduce more granular fraud rate thresholds. (gPayments, 2026)

See PSD3 (Payment Services Regulation) for full regulatory context.

Delegated Authentication

Delegated authentication (introduced in 3DS 2.2) allows a merchant with FIDO-compliant biometric capability to authenticate the transaction on behalf of the cardholder — potentially removing the 3DS redirect entirely. (ProcessOut, March 2024)

Delegated auth: theoretically transformative vs practically inaccessible. Web sources describe delegated authentication as a coming competitive differentiator, with legal clarity expected under PSD3 and more wallet-led adoption from 2027 onward. Reddit practitioners are blunter: "Unless you're processing hundreds of millions a year, you're not getting delegated auth." Requires formal agreement between merchant/PSP and card networks. No practitioner accounts of actual implementation found at sub-enterprise scale. (r/fintech, 2024-02, ~41 upvotes vs Ravelin/ProcessOut research summaries)

Key terms

Term	Meaning
EMV 3DS	The EMVCo standard name for 3DS2
ACS	Access Control Server — the issuer's 3DS decision engine
MPI	Merchant Plugin — merchant-side component that initiates 3DS2
ECI	Electronic Commerce Indicator — code that records authentication outcome, used by acquirers
Frictionless flow	Authentication completed without cardholder input
Challenge flow	Cardholder prompted for OTP, biometric, or app confirmation
Soft decline	Error code 65 — issuer requires SCA before authorising
TRA	Transaction Risk Analysis — exemption type based on fraud rate thresholds
MIT	Merchant-Initiated Transaction — recurring charge exempt from SCA post-setup
Delegated auth	Merchant authenticates on behalf of issuer using FIDO biometrics
Decoupled auth	Challenge occurs in separate channel up to 7 days post-payment
OOB	Out-of-Band — authentication via separate app (e.g. banking app)
SPC	Secure Payment Confirmation — W3C/FIDO standard for biometric browser auth

Benchmarks (as-of 2025–2026)

Metric	Value	Source	Date
Data elements sent per transaction	100+ (vs <10 in 3DS1)	Stripe	active 2026
Japan mandate: Stripe conversion rate	~93%	Stripe	Aug 2025
Japan mandate: Adyen net success rate change	–0.8 pp	Adyen	Jun 2025
Japan mandate: fraud reduction	up to 75%	Adyen	Jun 2025
EU: authenticated transactions vs unauthenticated	3% more likely to be authorised	Adyen	Jun 2025
UK: exemption acceptance vs EEA	+10 percentage points	Stripe	Aug 2025
UK: challenges via banking app	>75%	Stripe	Aug 2025
France: challenge rate vs EEA	~100% higher	Stripe	Aug 2025
Prepared vs unprepared SCA conversion drop	1–3% vs 10–20%	r/payments (~88 upvotes)	Jan 2024
Wolt Japan (Adyen RBA): returning shopper conversion improvement	>5%	Adyen	Jun 2025

What practitioners report

Challenge flow on mobile — especially bank OTP redirects — causes 8–12% mobile checkout abandonment for some merchants. (r/shopify, 2024-08, ~45 upvotes)
Sending complete and accurate 3DS data is a key lever. Poor data quality directly causes failed authentications and increased challenge rates. (Adyen Knowledge Hub, 2025-06-02)
Merchants with proper exemption strategy and PSP support see SCA impacts of 1–3%; those without saw 10–20% conversion drops at SCA enforcement. (r/payments, 2024-01, ~88 upvotes)
Japanese issuers sometimes reject authenticated transactions — likely due to disconnected auth and authorization systems at those issuers. Merchants should implement retry strategies for this edge case. (Adyen Knowledge Hub, 2025-06-02)

Contradictions summary

Japan conversion framing: Stripe (93% conversion, optimistic) vs Adyen (net –0.8pp, friction-focused). [See Conversion section above]
Fraud reduction vs adaptation: Academic/PSP view (3DS2 reduced EU fraud 70–80%) vs practitioner scepticism (fraudsters adapted via OTP social engineering and SIM swaps; conversion cost is real and permanent). (r/payments, 2024 vs Adyen/Stripe data)
PSP control preference: Adyen granular vs Stripe automated — split by merchant size.
Delegated auth access: enterprise-only in practice (Reddit) vs emerging competitive differentiator (web sources).