Home/FAQ/Payment explainers/3D Secure / 3DS
Explainer
What is 3D Secure (3DS) verification on card payments?
3D Secure — often written 3DS or EMV 3DS — is the e-commerce authentication protocol maintained by EMVCo to reduce card-not-present fraud. It lets the merchant and the issuer exchange data about the transaction, the payment method and the device so the issuer can confirm the payer is the cardholder. This site does not run live 3DS or ask for one-time codes.
paytools.dev editorial
Editor·About this site
Reviewed 14 October 2026
What is 3D Secure?
EMVCo’s EMV 3DS page says issuers and merchants use it to authenticate consumers and prevent CNP fraud. The protocol defines messages between the merchant and the issuer. The data include the transaction, the payment method and the device. Issuers use that to spot unauthorised payments quickly and to avoid unnecessary checkout friction.
The specifications cover app and browser checkout, several step-up methods, a non-payment message category and merchant-initiated account verification. They are available royalty-free from EMVCo. EMVCo also works with the PCI Security Standards Council on security evaluation. Older brand names such as Verified by Visa are card-network product labels; the shared specification is EMV 3DS.
What happens during a 3DS check?
EMVCo’s flow is: the cardholder pays online; the merchant sends transaction, method and device data through EMV 3DS; the issuer authenticates the consumer and decides whether to approve. Many payments complete after a Buy click (frictionless). For higher-risk payments the issuer may send a one-time code, a knowledge question, a biometric check or another challenge.
Stripe’s 3DS documentation notes that not every card is prompted. Authentication happens on official merchant and issuer pages. This site does not run live 3DS or ask for one-time codes.
How does 3DS relate to Strong Customer Authentication?
For the EU, EMVCo cites the European Banking Authority opinion of 21 June 2019: protocols such as EMV 3DS can support Strong Customer Authentication (SCA) under PSD2 because they enable two-factor authentication. EMVCo recommends version 2.2 or higher for full functionality.
SCA is a regulatory requirement; 3DS is a card-network protocol that can carry part of that authentication. Not every card payment reaches a challenge, and one challenge is not a legal finding. This page only defines the protocol.
How is 3DS different from the card security code?
The printed card security code (often called CVV or CVC) is static data on the instrument. 3DS is an issuer–merchant authentication protocol. It may send a one-time code, open the bank app, or complete on a frictionless path.
If the checkout text is a 3DS / SCA failure rather than “what is 3DS”, use the existing Stripe 3DS failed page. That page covers visible error text. This page only explains the protocol.
Questions and answers
- Is 3DS the same as typing the CVV?
- No. The CVV is the security code printed on the card. 3DS is an issuer–merchant authentication protocol and may send a separate one-time code or open the bank app.
- Does every card payment show a 3DS window?
- No. EMVCo describes the challenge as an issuer option on higher-risk payments. Stripe also notes that not every card is prompted. Many payments complete after a Buy click.
- Can paytools.dev run 3DS?
- No. This site does not run live 3DS and does not collect one-time codes, CVV or passwords.
Official pages to verify
Sources and review
Facts follow EMVCo’s EMV 3-D Secure page, including its summary of the EBA/PSD2 SCA opinion, and Stripe’s 3D Secure documentation. Reviewed 14 October 2026.