EMV 3-D Secure: What a Merchant Should Know
The EMVCo protocol that checks a card-not-present shopper without unnecessary friction at checkout. What it does, what it leaves to you, and how to add it.
Your customer is at the pay button. The card is not in front of you, so you cannot check a chip or a signature. EMV 3-D Secure is the protocol built for that moment. It gives the bank that issued the card a way to confirm the shopper owns it. And it does that while keeping checkout easy for the shopper.
What EMV 3-D Secure is
EMV 3DS is an e-commerce fraud prevention protocol. EMVCo maintains it, along with the specifications that go with it. EMVCo, LLC owns the EMV trademark. EMVCo also partners with the PCI Security Standards Council. Together they review the security of EMV 3DS tools.
If you remember 3-D Secure from old checkouts, this is the next generation of that idea. Visa built the first 3-D Secure protocol. It added an identity check before a sale was approved. Visa then worked with other payment brands to develop EMV 3-D Secure.
How it works at checkout
EMV 3DS lets the merchant and the issuer trade data. The issuing bank reviews that data to verify the customer and clear the payment. Your checkout sends order and device details to the bank that issued the card. The bank runs its own risk checks on that data and sends back an answer.
A transaction uses consumer data to evaluate risk and prevent fraud. On Stripe, part of this exchange is handled for you. Stripe's guide says Stripe.js gathers basic device details during 3DS2 checks. It sends them to the issuing bank, which looks for fraud risk. You do not build that part yourself.
Frictionless and step-up authentication
Some low-risk payments ask the shopper nothing. The data exchange happens in the background, and the sale proceeds. Visa Secure is Visa's EMV 3DS program. For low-risk payments, it offers a data-only mode. The order details go to the issuer, and no question is put to the shopper.
When a sale looks riskier, the issuer can require extra proof. That can mean a one-time passcode, knowledge-based questions or biometrics. The shopper answers, the issuer decides, and checkout continues. You do not choose which method the issuer uses.
Where it helps, and where it stops
EMV 3DS is a strong tool against card not present fraud. Visa's data shows about 45% less fraud on checked online sales than on unchecked ones. Visa also reports a 9% lift in approval rates for sales checked through Visa Secure.
It is not a wall. A fraudulent sale can still get through and later turn into a chargeback. Keep your other checks in place. Do not treat an authenticated transaction as one that needs no review.
Strong Customer Authentication
Some payment rules require Strong Customer Authentication. That means checking two things, not one. EMV 3DS supports Strong Customer Authentication. It does this with two-factor authentication. If Strong Customer Authentication applies to your sales, EMV 3DS can support it. Your provider can confirm how it is configured for your store.
Which version to use
EMVCo recommends version 2.2 or higher of EMV 3DS for the best functionality. Ask your payment provider which version your checkout runs. If it is older, ask about upgrading before you build anything new around it.
Your privacy responsibilities
The data exchange is the heart of the protocol, and it involves your customer's personal data. Merchants and issuers using this consumer data are responsible for complying with privacy laws. Check what your checkout collects, where it sends it, and what your privacy policy tells customers.
Card-network programs
Visa runs its own program on top of the protocol. Visa Secure lets merchants check who a customer is using data. See how this works for one network in Visa 3-D Secure.
The protocol is not only for payments. EMV 3DS can also verify identity outside of payments. Examples include onboarding and account setup.
How to add it, and what it costs
EMVCo tests and approves EMV 3DS products. This checks that they follow the EMV 3DS Specifications. Your job is to turn the feature on, test it against your own checkout, and follow the flow as a shopper would.
EMVCo also keeps interactive EMV 3DS UI/UX Design Guidelines. They help issuers, merchants and tool makers make the check easy for shoppers. Use them when you design the screens a shopper sees during a step-up.
Costs vary by provider and change often. Check your provider's current pricing page before you decide. The same goes for 3-D Secure on PayPal or any other platform you might move to.
Turn it on, watch your approval rates, and keep your own fraud checks running alongside it.