3D secure version 2
3D Secure version 2 (3DS2) is the modern, enhanced version of the 3D Secure online payment authentication. It uses frictionless, risk-based checks and supports seamless background verification or step-up prompts (via an app, push notification, or biometrics) rather than full-page redirects. It collects more data (device, location, behavior) to reduce unnecessary prompts, improves mobile UX, and aims to maintain strong customer authentication (SCA) while preserving conversion. It's backward-compatible with 3DS1 for liability shifts.
Key benefits of 3D Secure 2
- Better user experience: frictionless/step-up flows reduce checkout friction, especially on mobile.
- Higher approval rates: risk-based decisions keep more legitimate transactions intact.
- More data for risk assessment: device, location, behavior, and merchant data improve decisions.
- Fewer redirects: in-app or seamless authentication keeps users in flow.
- Stronger security with SCA alignment: supports two-factor-like authentication without heavy disruption.
- Broad device support: works well with mobile wallets and newer devices.
- Backward compatibility: maintains liability shifts with 3DS1 for older flows.
- Flexible exemptions: supports exemptions for low-value or recurring payments in many regions.
Supported 3D Secure version 2 flows
On our platform, we support multiple scenarios of performing 3D Secure 2, responding to the payment context and conditions.
- Frictionless without Method URL - Frictionless authentication occurs entirely in the background; no user-facing redirect or URL routing.
- Frictionless with Method URL - Frictionless authentication still happens in the background, but a Method URL is used to establish or maintain the authentication context (often for risk signaling or to align with certain issuer networks). The user experience stays seamless, but the flow uses a URL-based handoff behind the scenes.
- Challenge without Method URL - An explicit user-facing challenge is presented without relying on a Method URL handoff (e.g., a visible in-flow prompt via an app or browser).
- Challenge with Method URL - The explicit challenge is delivered with a Method URL handoff involved (URL routing to the issuer’s authenticator, then back to the merchant).
You can find the flow diagrams, test card data, and API examples for these 3D Secure 2 flows in the Test cases section below.