What is 3D Secure 2 (3DS2)?
Cardholder authentication for online payments.
3D Secure 2 adds issuer verified authentication to card-not-present payments, cutting fraud without interrupting every checkout.
3D Secure 2 (3DS2) is an EMVCo authentication protocol that verifies the cardholder with their card issuer during an online payment. It lets the issuer approve most transactions frictionlessly, challenge higher risk payments with a step up, and shift fraud liability from the merchant and acquirer to the issuer on success.
Last updated 21 October 2026
Background
Why did 3D Secure 2 replace 3DS 1?
3DS2 replaced 3DS 1 because the first version interrupted every checkout with a static password and gave issuers too little data to make good risk decisions.
3D Secure 1.0 required cardholder interaction for most authentications, so legitimate purchases were slowed down and issuers saw little transaction context. EMV 3DS 2.x changed that by sharing far richer data with the issuer before any decision is made.
- EMV 3DS 2.x shares over 100 data elements with the issuer, covering the device, the transaction and the merchant context, so risk can be assessed in the background.
- Native in-app authentication arrives through the 3DS SDK, extending the protocol to iOS and Android apps.
- Challenge flows support biometrics, including fingerprint and face recognition through the cardholder's banking app.
- Card schemes have sunset 3DS 1.0, making 3DS2 the only compliant option for card-not-present authentication.
The flow
How does 3D Secure 2 work?
In a 3DS2 payment, the 3DS Server sends transaction and device data through the scheme's Directory Server to the issuer's ACS, which either approves the payment frictionlessly or challenges the cardholder.
The ACS reviews the shared data with the issuer's risk rules and returns an authentication result through the same chain. Two flows cover the outcomes:
The frictionless flow
The ACS approves without any cardholder interaction. EMV 3DS 2.x dramatically increased frictionless rates compared to 3DS 1.0 because far richer transaction context reaches the issuer.
The challenge flow
When risk is higher, the cardholder completes a step up, such as a one-time passcode or a biometric check in their banking app. A completed challenge delivers the same liability shift.
EMV 3DS 2.x shares over 100 data elements with the issuer. This richer context drives accurate risk based decisions, high frictionless rates, native mobile SDK support and biometric challenge flows.
The participants
Who is involved in a 3DS2 transaction?
Six parties take part in a 3DS2 authentication: the merchant, the acquirer, the 3DS Server, the card scheme's Directory Server, the issuer and its ACS.
Merchant
Sells online and starts the authentication by sending transaction details to its 3DS Server during checkout.
Acquirer
The bank or processor that settles the merchant's card payments and operates the acquiring side of the 3DS flow.
3DS Server
The merchant and acquirer side component. ActiveServer builds the authentication request, shares the data elements and returns the result.
Explore 3DS AcquiringDirectory Server
The card scheme component that routes authentication messages between the 3DS Server domain and the issuer's ACS.
Issuer
The bank that issued the card. It assesses the risk and carries the liability for fraud chargebacks on authenticated transactions.
ACS
The issuer side Access Control Server that decides between frictionless approval and a challenge. GPayments' issuing ACS is ActiveAccess.
Explore 3DS IssuingRegulation
How does 3DS2 support SCA under PSD2?
PSD2 requires Strong Customer Authentication for most online card transactions in Europe, and 3D Secure 2 is the primary mechanism merchants and acquirers use to meet it.
Under the EU's Revised Payment Services Directive (PSD2), SCA asks for two independent factors on online payments. 3DS2 delivers this through issuer authentication, including one-time passcodes and biometric challenges, while risk based frictionless flows keep low risk conversions moving.
Liability
What is liability shift under 3DS2?
When a 3DS2 authentication succeeds, liability for fraud chargebacks shifts from the merchant and acquirer to the card issuer.
Without 3DS, merchants and acquirers bear the cost of fraud related chargebacks. With successful authentication, that cost transfers to the issuer, directly reducing financial exposure for the acquiring side of the payment chain.
Versions
Which 3DS2 versions are in use?
3D Secure 2 is specified by EMVCo as EMV 3DS 2.x. ActiveServer supports the current versions, including 2.3.1.
The name 3D Secure 2.0 is still widely used, but the protocol itself is delivered today as EMV 3DS 2.x. Card schemes have sunset 3DS 1.0, so EMV 3DS 2.x is the only compliant option for card-not-present authentication.
GPayments
How GPayments helps with 3D Secure 2
GPayments covers every side of the 3DS2 flow, from acquiring and issuing to testing and fraud prevention.
3DS Acquiring (ActiveServer)
The 3DS Server for merchants and acquirers. Create authentication requests, share data with issuers and receive results through a RESTful API.
Learn more3DS Issuing (ActiveAccess)
The ACS for issuers. Authenticate cardholders with risk based decisioning that maximises approval rates while blocking fraudulent transactions.
Learn more3DS Testing (TestLabs)
Certify your 3DS2 implementation against all EMV 3DS scenarios with a comprehensive automated testing platform.
Learn more3DS Fraud Prevention
Deploy rules based fraud detection across your 3DS flow to stop fraud before authentication.
Learn more3DS2 FAQ
Frequently asked questions
What is 3D Secure 2 (3DS2)?
3D Secure 2 (3DS2) is an EMVCo authentication protocol that verifies the cardholder with their card issuer during an online card payment. Transaction and device data is shared with the issuer, which either approves the payment frictionlessly or challenges the cardholder. A successful authentication shifts fraud chargeback liability from the merchant and acquirer to the issuer.
Why did 3DS2 replace 3DS 1.0?
3DS 1.0 interrupted most checkouts with a static password and gave issuers little data for risk decisions. EMV 3DS 2.x shares over 100 data elements with the issuer, supports risk based frictionless approval, adds native in-app authentication through the 3DS SDK, and supports biometric challenges. Card schemes have sunset 3DS 1.0, making 3DS2 the only compliant option for card-not-present authentication.
What is the difference between frictionless and challenge flow?
In the frictionless flow, the issuer's ACS approves the transaction from the shared data alone, with no cardholder interaction. In the challenge flow, the ACS needs more certainty, so the cardholder completes a step up such as a one-time passcode, a push approval in their banking app, or a biometric check. Frictionless authentication protects conversion, challenges protect higher risk payments, and both deliver liability shift when they succeed.
Is 3D Secure 2 mandatory?
In many markets it is effectively mandatory. The EU's Revised Payment Services Directive (PSD2) requires Strong Customer Authentication (SCA) for most online card transactions, and 3DS 2.x is the primary mechanism for meeting this requirement. Visa, Mastercard and other schemes have also sunset 3DS 1.0 globally, making 3DS 2.x the only compliant option for card-not-present authentication.
What is liability shift in 3DS2?
When a transaction is successfully authenticated with 3DS 2.x, liability for fraud chargebacks shifts from the merchant and acquirer to the card issuer. This is known as liability shift. Without 3DS, merchants and acquirers bear the cost of fraud related chargebacks. With successful authentication, that cost transfers to the issuer, directly reducing financial exposure for the acquiring side of the payment chain.
Which 3DS2 versions are supported?
3D Secure 2 is delivered as EMV 3DS 2.x. GPayments' ActiveServer supports the current EMV 3DS 2.x protocol versions, including 2.3.1. Card schemes have sunset 3DS 1.0, so EMV 3DS 2.x is the only compliant option for card-not-present authentication.
See 3D Secure 2.0 authentication in action
Talk to our team about 3DS acquiring, issuing, testing and fraud prevention for your payment flows.