EMV 3-D Secure is an online authentication protocol. The merchant sends the issuing bank data about the purchase and device. The bank uses it to judge risk. Low-risk payments are approved with no extra step, and higher-risk ones trigger a challenge such as a one-time code or a biometric check.
What the protocol is for
EMVCo maintains the EMV 3DS specifications, which are available royalty-free. The aim is to confirm that the person paying online is the cardholder and so reduce card-not-present fraud. It replaced the older 3-D Secure model that redirected most shoppers to a bank page.
What the merchant sends
The merchant passes details about the purchase, the payment method and the device being used. The issuer uses those signals to assess risk. EMVCo notes that merchants and issuers remain responsible for applying privacy law to that data.
For a developer, this means the quality of the data you send affects the outcome. Thin or inconsistent data tends to push the issuer toward a challenge.
The two outcomes
EMVCo's page does not use the words frictionless or challenge, but it describes both outcomes:
- Approved with little friction: for many transactions the consumer simply confirms the purchase.
- Challenge: for higher-risk transactions the issuer can require a one-time passcode, knowledge-based questions or biometrics.
The issuer decides, not the merchant. You can request an exemption or ask for a challenge, but the final call sits with the bank.
Relation to PSD2
EMVCo states that the European Banking Authority recognised EMV 3DS in a June 2019 opinion as a way for merchants and issuers to support strong customer authentication. The protocol supports SCA through two-factor authentication. EMVCo recommends version 2.2 or higher for the best functionality, though version 2.1 also supports SCA.
Engineering checklist
- Handle both outcomes in your checkout state machine, including a challenge that appears after a frictionless attempt was expected.
- Send complete and consistent device and customer data on every request.
- Plan for timeouts, abandoned challenges and retries, and measure how many payments fall out at each stage.
- Keep the authentication result with the payment record, so disputes can show what happened.
- Test with the issuer test cards your acquirer provides, covering both outcomes and failures.
What it does not do
3DS authenticates a payment attempt. It does not protect your checkout page from tampering, your API from abuse or your database from injection. Treat it as one control in a payment flow.
Quick check
Who decides whether a customer gets challenged?
The issuing bank decides, using the data the merchant supplies. A merchant can request an exemption but cannot force the outcome.
Does EMV 3DS satisfy PSD2 SCA?
EMVCo says the EBA's June 2019 opinion recognised it as a way to support SCA through two-factor authentication. Your provider still owns the compliance decision.
Sources
Last reviewed: 19 October 2026.
