3D Secure 2
Strengthen Payment Security and Reduce Checkout Friction
HostedPCI provides 3D Secure 2 (3DS2) integration to help businesses authenticate online card payments, reduce fraud risk, and support a smoother checkout experience.
3D Secure 2 adds an authentication layer to online payments, allowing card issuers to verify a cardholder’s identity using transaction information and risk indicators.
Through risk-based authentication, lower-risk transactions may be authenticated without additional customer interaction, while transactions requiring further verification can trigger an authentication challenge.
HostedPCI integrates with third-party authentication providers, including CardinalCommerce and PAAY, helping businesses incorporate cardholder authentication into existing payment workflows across supported payment gateways.
Improve your online payment authentication with HostedPCI.
Contact our team to discuss your 3D Secure 2 integration requirements.
What Is 3D Secure 2?
3D Secure 2, also known as 3DS2 or EMV 3-D Secure, is an authentication protocol designed to help verify the identity of cardholders during card-not-present transactions.
Developed under EMVCo specifications, 3D Secure 2 allows businesses and card issuers to exchange additional transaction information to assess fraud risk before payment authorization.
Depending on the issuer’s risk assessment, authentication may be completed without customer interaction or require additional verification.
This helps businesses strengthen online payment security while reducing unnecessary interruptions during checkout.
Major card networks use 3D Secure through authentication programs such as Visa Secure and Mastercard Identity Check.
How Does 3D Secure 2 Work?
3D Secure 2 uses transaction information to help card issuers determine whether additional cardholder verification is necessary.
Step 1: Customer Initiates a Payment
The customer enters their credit card information during checkout.
The merchant’s payment integration initiates the authentication process using the required transaction and cardholder information.
Step 2: Authentication Request Is Evaluated
The authentication request travels through the 3DS Server and card network’s Directory Server to the issuer’s Access Control Server (ACS).
The issuer evaluates available transaction information, including payment details, device information, and other risk indicators, to determine whether additional authentication is required.
Step 3: Frictionless Authentication or Customer Challenge
Based on the issuer’s assessment, the transaction follows one of two authentication paths.
Frictionless Authentication
The issuer completes authentication without requiring the customer to perform another verification step.
This helps reduce checkout interruptions and supports a smoother payment experience.
Challenge Authentication
When additional verification is required, the issuer may ask the customer to confirm their identity using a one-time passcode, banking application, biometric verification, or another supported authentication method.
Step 4: Authentication Result Is Returned
The authentication provider returns the outcome and applicable authentication information.
The payment authorization is then submitted through the configured payment gateway using the required authentication values.
The card issuer ultimately determines whether to approve or decline the payment.
Benefits of 3D Secure 2 for Businesses
Reduce Online Payment Fraud
3D Secure 2 adds cardholder authentication to online payment workflows, helping businesses identify potentially unauthorized transactions before payment authorization.
Improve the Checkout Experience
Risk-based authentication allows many transactions to proceed without an additional verification step.
This can reduce checkout friction and help limit payment abandonment.
Potentially Higher Approval Rates
3D Secure 2 provides issuers with additional transaction information and authentication results.
This can support more informed risk decisions and may improve authorization outcomes, depending on the transaction, issuer, and payment provider.
Support Strong Customer Authentication Requirements
3D Secure 2 helps businesses support Strong Customer Authentication (SCA) requirements under PSD2 in the European Economic Area (EEA) and equivalent authentication rules in the United Kingdom.
Applicable requirements depend on the transaction, region, issuer, payment provider, and available exemptions.
Potential Fraud Liability Shift
Eligible transactions authenticated through 3D Secure 2 may qualify for a fraud liability shift under applicable card network rules.
Eligibility depends on the authentication outcome, transaction type, payment provider, and relevant network requirements.
HostedPCI 3D Secure 2 Integration
Third-Party Authentication With Multi-Gateway Payment Support
HostedPCI integrates with third-party 3D Secure authentication providers, including CardinalCommerce and PAAY, to support cardholder authentication within existing payment workflows.
The authentication provider facilitates the 3DS process, while HostedPCI manages the integration with supported payment gateways. The card issuer determines whether authentication can be completed without additional customer interaction or requires a challenge.
For supported gateway integrations, businesses can authenticate through CardinalCommerce or PAAY and use the resulting authentication information when submitting payment authorization through HostedPCI.
This allows businesses to incorporate 3D Secure authentication without relying exclusively on a payment gateway’s own authentication solution.
Provider onboarding, account requirements, and available functionality are confirmed during implementation.
3D Secure 2 With HostedPCI iFrame
HostedPCI’s payment iFrame supports configured 3D Secure 2 authentication workflows.
Businesses can collect payment information through HostedPCI’s hosted payment fields and initiate authentication as part of the checkout process.
HostedPCI provides integration parameters and callback functionality to support authentication events, frictionless authentication, and cardholder challenges.
This helps businesses incorporate 3DS2 while limiting direct handling of cardholder information within their applications.
Authentication Results and Payment Authorization
Following authentication, HostedPCI supports the handling of authentication results required for the configured payment workflow.
Depending on the card network and integration, these values may include:
- CAVV / AAV: Authentication verification values associated with Visa and Mastercard.
- ECI (Electronic Commerce Indicator): Indicates the e-commerce authentication status, including successful authentication or an authentication attempt.
- DS Transaction ID: Identifies the authentication transaction within the card network’s Directory Server.
- 3DS Protocol Version: Identifies the EMV 3-D Secure protocol version used during authentication.
Depending on the integration configuration, authentication results may be processed through HostedPCI’s transaction workflow or returned to the merchant for subsequent processing.
Authentication and payment authorization are separate steps. Successful cardholder authentication does not guarantee payment approval.
3D Secure 2 Across Multiple Payment Gateways
HostedPCI supports 3DS2 pass-through authentication, where authentication is performed by an external provider and the resulting authentication data is included in the authorization request to a compatible payment gateway.
Supported combinations include CardinalCommerce with Authorize.Net, and CardinalCommerce or PAAY with FluidPay.
For gateways that accept externally authenticated transactions, HostedPCI can incorporate the required authentication results into the payment authorization workflow.
This provides businesses with greater flexibility when integrating 3D Secure authentication with multiple payment providers.
See the HostedPCI 3D Secure 2 API documentation for supported integrations and technical requirements.
3D Secure 2 for Recurring and Merchant-Initiated Payments
Certain 3D Secure 2 configurations support 3DS Requestor-Initiated (3RI) authentication for situations where the cardholder is not actively participating in the transaction.
This functionality can be relevant to recurring payments, subscriptions, and other eligible merchant-initiated payment workflows.
Availability depends on the supported 3DS protocol version, authentication provider, issuer, and integration configuration.
Businesses requiring 3RI authentication should discuss their specific requirements with HostedPCI during integration planning.
Who Can Benefit From 3D Secure 2?
E-commerce Businesses
Online retailers can add cardholder authentication to their checkout process to help reduce card-not-present fraud while maintaining a smoother customer payment experience.
SaaS and Subscription Platforms
Software platforms offering recurring billing can use 3D Secure 2 for initial customer payments and evaluate supported authentication options for eligible subsequent transactions.
Travel and Hospitality Businesses
Booking platforms, travel agencies, and hospitality providers can authenticate online payments, particularly where higher transaction values or cross-border payments create additional fraud concerns.
Businesses Using Multiple Payment Gateways
Organizations working with multiple payment providers can use HostedPCI’s 3DS2 pass-through authentication with compatible gateways, helping maintain a consistent authentication approach across supported payment integrations.
Need to add 3D Secure 2 to your payment workflow?
Contact HostedPCI to discuss your authentication and payment gateway requirements.
3D Secure 2 FAQs
What is the difference between 3D Secure and 3D Secure 2?
3D Secure 2 is the newer generation of the 3D Secure authentication protocol.
It replaced the original 3D Secure 1 (3DS1) protocol, which Visa and Mastercard retired in October 2022.
Compared with 3DS1, 3D Secure 2 supports richer transaction data exchange, risk-based authentication, and improved experiences on desktop and mobile browsers.
Does 3D Secure 2 require customers to enter a password?
Not always.
Many transactions can complete authentication without requiring an additional customer action.
When further verification is required, the card issuer determines the authentication method, which may include a one-time passcode, banking app approval, or biometric verification.
Does 3D Secure 2 reduce payment fraud?
3D Secure 2 can help reduce online payment fraud by allowing card issuers to verify cardholder identity and assess transaction risk before authorization.
It does not guarantee that every fraudulent transaction will be prevented.
Does 3D Secure 2 improve authorization rates?
3D Secure 2 may improve authorization outcomes by providing issuers with additional transaction information and cardholder authentication results.
However, authorization rates depend on the issuer, merchant, transaction characteristics, and payment provider. Improved approval rates are not guaranteed.
Does 3D Secure 2 provide a liability shift?
Eligible authenticated transactions may qualify for a fraud liability shift under applicable card network rules.
A liability shift is not guaranteed for every transaction. Requirements vary by card network, region, transaction type, and authentication result.
Is 3D Secure 2 required for PSD2 compliance?
3D Secure 2 is commonly used to support Strong Customer Authentication requirements under PSD2 in the European Economic Area and equivalent requirements in the UK.
Whether authentication is required for a particular transaction depends on applicable regulations, available exemptions, and payment circumstances.
Which 3D Secure authentication providers does HostedPCI support?
HostedPCI integrates with third-party authentication providers, including CardinalCommerce and PAAY.
Provider onboarding, account requirements, and supported functionality are confirmed during implementation.
Does HostedPCI support 3D Secure 2 with multiple payment gateways?
Yes, for supported combinations.
HostedPCI supports pass-through authentication through CardinalCommerce or PAAY, with authentication results included in authorization requests to compatible gateways.
Supported integrations include CardinalCommerce with Authorize.Net and CardinalCommerce or PAAY with FluidPay.
See the 3D Secure 2 API documentation for additional integration details.
Can 3D Secure 2 be used with HostedPCI iFrame?
Yes.
HostedPCI’s payment iFrame supports configured 3D Secure 2 authentication workflows, allowing businesses to collect payment details through hosted fields and initiate cardholder authentication.
This helps limit direct exposure of cardholder information within the merchant’s applications.
Can 3D Secure 2 be used for recurring payments?
Certain 3D Secure 2 configurations support authentication scenarios involving recurring payments and merchant-initiated transactions.
Available functionality depends on the authentication provider, protocol version, transaction type, and integration configuration.
Does 3D Secure 2 eliminate PCI DSS requirements?
No.
3D Secure 2 is an authentication protocol and does not replace PCI DSS compliance obligations.
HostedPCI’s hosted payment collection and tokenization services can help reduce PCI DSS scope depending on how the overall payment integration is implemented.
Integrate 3D Secure 2 With HostedPCI
Strengthening online payment authentication should not require unnecessary checkout friction or replacing your payment infrastructure.
HostedPCI helps businesses incorporate 3D Secure 2 authentication into their existing payment workflows while maintaining flexibility across supported payment gateways.
Contact HostedPCI to discuss your 3D Secure 2 integration requirements.
Explore HostedPCI 3D Secure 2 API Documentation for technical integration details.