If 3D Secure still means clunky redirects and forgotten passwords to your team, you are thinking of 3DS1. EMV 3D Secure 2 primarily operates in the background, incorporates mobile-friendly SDKs, and provides richer data, enabling issuers to approve more legitimate orders without slowing down the checkout process. The 2.3.1 update streamlines flows and broadens where it applies.
3DS2 vs 3DS1: The Practical differences
| Area | 3DS1 (legacy) | 3DS2 (modern) |
|---|---|---|
|
Customer experience |
Static passwords, page redirects | Frictionless by default, step-up only when risk is high |
| Data sent to issuer | Limited | Dozens of additional data elements to improve decisions |
| Mobile support | Weak, browser detours | Native iOS/Android SDKs for in-app flows |
| Use cases | One-off web payments | Web and app, recurring (3RI), stored credentials, decoupled/OOB |
| Outcomes | Interruptions, drop-off | Higher approval confidence with lower friction |
The frictionless flow is core to 3DS2: issuers silently evaluate rich context and approve without interrupting the shopper; only higher-risk cases see a challenge.
Why US merchants should care now
Less friction, better decisions: With a richer data set and risk-based checks, issuers can approve more genuine orders and prevent more fraud without blanket challenges.
Current network programs: Visa Secure (3DS) and Mastercard Identity Check govern how 3DS2 is used on their networks, replacing Verified by Visa and SecureCode from the 3DS1 era. These programs align 3DS2 to modern KPIs and implementation practices.
Fresh guidance for the US market: The US Payments Forum continues to publish practical resources on 3DS and related mobile and ecommerce security topics, useful for aligning stakeholders across risk, product, and engineering.
Data Only 3DS: Zero-friction Signal Sharing
Not ready to authenticate every transaction? Data Only lets you send EMV 3DS data to issuers without asking the customer to complete a challenge. It boosts issuer confidence and can improve authorisation outcomes while keeping checkout fast, often a stepping stone to a fuller 3DS program.
Liability shift in the United States (quick overview)
3DS can provide fraud-chargeback protection on qualifying transactions when authentication succeeds (or under program-specific conditions). It is not a blanket shield for every dispute type, so fold authentication results into a broader disputes playbook. Check your acquirer and the relevant network program for exact eligibility and reason-code handling.
Implementation options
-
Via your gateway/PSP: quickest path if your provider exposes 3DS2 and passes through the necessary fields.
-
3DS Server + ACS: choose your own server and (where applicable) ACS to optimise data, routing, and policy.
-
Mobile SDKs: keep authentication native in your iOS/Android apps to reduce drop-off and gather better device signals.
At a Glance
If your memory of 3D Secure is clunky pages and forgotten passwords, that was 3DS1. EMV 3DS version 2 uses risk-based checks and richer data so approvals can increase with less friction. US merchants can start with Data Only to send signals without challenges, then phase in full authentication for liability protection where it applies.
FAQs
Will 3DS2 hurt conversion like 3DS1 did?
Implemented correctly, it should not. Most traffic should run frictionless when you send complete, high-quality data; only higher-risk cases are stepped up.
Is 3DS2 available for mobile apps?
Yes. Certified SDKs allow in-app authentication, avoiding clunky browser detours and improving device-data quality.
Do I have to authenticate every transaction?
No. Many US merchants start with Data Only to share signals without challenges, then phase in full authentication for use cases that benefit from liability shift or added assurance.
What changed recently in the spec?
EMV 3DS v2.3.1 introduced additional data and features to streamline authentication and broaden support for channels and devices.