3-D Secure and online card checks, explained

3-D Secure is an extra check used on online card payments to confirm the person paying is the cardholder. When a customer pays online, the card's issuing bank may verify them quietly in the background or ask them to confirm with a code, an app, or a fingerprint. It's for online sales, not counter sales, and it can change who carries the loss if a sale turns out to be fraud.

If your store only takes cards at the counter, you'll rarely deal with it. If you sell online or are thinking about it, it's worth knowing.

How does 3-D Secure work?

3-D Secure adds a step between the customer entering their card and the payment being approved. The name refers to three domains: the merchant's side, the issuer's side, and the network connecting them.

When a customer checks out online, the merchant's payment system sends information about the purchase and the device to the card's issuer. The issuer looks at that data and decides.

If the risk looks low, the issuer approves the check quietly. That's called a frictionless flow. The customer doesn't see anything extra.

If the risk looks higher, the issuer asks the customer to confirm. That's called a challenge. It might be a one-time code sent by text, a prompt in the bank's app, or a fingerprint or face check on their phone.

The card brands market it under their own names, but it's the same idea underneath.

What does it change for the merchant?

Two main things.

Fraud. A sale that passes 3-D Secure is more likely to be the real cardholder. That lowers fraud on online orders.

Disputes. For many online transactions that are authenticated with 3-D Secure, the liability for certain fraud chargebacks can shift from the merchant to the issuer. That means if the cardholder later says, "I didn't make this purchase," the merchant may be better protected. The rules have conditions and vary by network, so don't assume every authenticated sale is covered.

It doesn't protect against other dispute types, like "item not received" or "not as described." Those still depend on your records.

Are there downsides?

Some.

Challenges add friction. A customer who has to find a code on their phone may give up. Newer versions of 3-D Secure try to reduce challenges by sharing more data, so most customers get the frictionless flow.

Setup depends on your payment tools. Not every online checkout or payment link supports it, and some turn it on by default while others make it optional.

It doesn't apply at the counter. Chip and tap already verify the card in person. The EMV standard that covers chip payments also publishes the 3-D Secure specification, but they solve different problems.

Does your setup use it?

If you only take cards at the counter, you don't need to think much about 3-D Secure. Your protection there is chip, tap, and PIN.

If you take any online payments, ask your provider how card-not-present checks work on your account. Ask whether 3-D Secure is available, whether it's on by default, and what happens when a customer fails a challenge.

Ask the NRS Pay team what your setup supports. Don't assume any online feature is available until your provider confirms it. For more on the broader category, Wikipedia's page on the card-not-present transaction explains why online sales carry different risks. And you can learn more about NRS Pay.

A practical note: if you do start taking online payments, watch your first few weeks of orders closely. See how many customers are asked to confirm and how many abandon the payment. That tells you whether the extra check is helping or getting in the way, and it gives you real numbers to discuss with your provider.