3D Secure 2 (3DS2)
DEFINITION
3D Secure 2 (3DS2) is a card authentication protocol that lets an issuing bank verify a shopper's identity during an online payment, shifting fraud-related chargeback liability to the issuer when the issuer approves the authenticated transaction.
TABLE OF CONTENTS
RELATED TERMS
3D Secure 2 (3DS2) is a card authentication protocol that lets an issuing bank verify a shopper's identity during an online card payment. When the issuer approves a transaction authenticated through 3DS2, liability for fraud-related chargebacks on that transaction generally shifts from the merchant to the issuer.
The "2" marks the second generation of the 3D Secure standard. It passes far more data about the transaction and the device to the issuer, so the issuer can approve most payments in the background without asking the customer to do anything extra. This is the frictionless flow. Only transactions the issuer judges to be higher risk trigger a challenge, such as a one-time passcode or a biometric check. A subscription platform such as Recurly can apply 3DS2 to card transactions and exchange the authentication data with the payment gateway during checkout and during later rebills. Recurly supports 3DS2 on gateways including Adyen, Worldpay, Braintree, and Cybersource, configured through Recurly.js and its API, with hosted checkout pages handling the flow automatically.
Why 3D Secure 2 matters for subscription businesses
For a recurring revenue business, 3DS2 sits where fraud control, authorization rates, and regulation meet. Authenticating a payment through 3DS2 moves chargeback liability to the issuer on approved transactions, which reduces the merchant's exposure to fraud disputes. Because the protocol carries more context than its predecessor, issuers can approve a larger share of legitimate payments without interrupting the customer, which protects conversion at checkout.
3DS2 is also tied to regulation in some markets. Strong customer authentication rules require an additional identity check on many electronic payments in certain regions. This is primarily PSD2 and strong customer authentication, which apply only when both the merchant's acquiring bank and the customer's issuing bank are in the EEA or UK, and Recurly automatically flags eligible renewals as merchant-initiated to claim the applicable exemption. Getting authentication right in those markets is the difference between a payment that clears and one the issuer declines.
How 3D Secure 2 works
3DS2 runs an exchange between the merchant, the payment gateway, and the card issuer before the payment is authorized:
The customer submits card details at checkout, or the platform initiates a scheduled rebill.
The platform and gateway collect transaction and device data and send it to the issuer through the 3DS2 flow.
The issuer scores the risk of the transaction using that data.
If the risk is low, the issuer authenticates the payment silently and the customer sees no extra step, the frictionless flow.
If the issuer wants more assurance, it challenges the customer with a step such as a one-time passcode or biometric prompt.
Once authenticated, the transaction proceeds to authorization, now carrying the authentication result.
Recurring charges after the first payment are usually treated as merchant-initiated, which can change whether a challenge is needed. Recurly automatically flags eligible renewals as merchant-initiated, and if an issuer still challenges one, Recurly's 3DS dunning flow re-authenticates the customer on Adyen, Worldpay, and Stripe.
How to use 3D Secure 2
Decide which transactions to authenticate, such as first payments, high-value orders, or all payments in regulated markets.
Store the customer's consent and the credential correctly so later rebills can be flagged as merchant-initiated where the rules allow.
Present the challenge cleanly on both desktop and mobile so a required step does not cost you the sale.
Monitor how often transactions go frictionless versus challenged, and watch decline reasons for authentication failures.
Keep gateway and platform configuration aligned so the authentication result is passed through to authorization. In Recurly this means configuring Recurly.js, or using hosted checkout pages, which handle it automatically per the 3DS2 integration guide, and confirming your gateway supports 3DS2.
Benefits and examples
Fraud liability shift: an approved, 3DS2-authenticated transaction generally moves chargeback liability for fraud to the issuer.
Higher approval rates: richer data helps issuers approve more legitimate payments.
Less checkout friction: most authentications happen in the background, so genuine customers are rarely interrupted.
Regulatory coverage: authentication satisfies strong customer authentication requirements where they apply. This applies primarily in the EEA and UK under PSD2, though Recurly recommends supporting 3DS broadly since issuers elsewhere may still enforce it at their discretion.
As an illustration, a subscription business selling into a market with strong customer authentication rules routes first payments through 3DS2. Most customers are authenticated silently and never see a prompt, while a smaller set are asked for a one-time passcode. Payments that clear authentication move to the issuer for fraud liability, and the business tracks the frictionless share to judge how much authentication is affecting checkout.
Frequently asked questions
What is the difference between 3D Secure and 3D Secure 2? 3D Secure 2 is the newer version of the protocol. It sends more transaction and device data to the issuer so most payments can be authenticated without any extra step for the customer, where the original version more often interrupted the shopper.
Does 3DS2 stop all fraud? No. It authenticates the shopper's identity and shifts fraud liability on approved transactions to the issuer, but it is one control among several rather than a complete fraud defense.
Do recurring charges need 3DS2 every time? Not usually. The first payment is typically authenticated, and later charges are often treated as merchant-initiated, though the exact handling depends on the rules in each market. Recurly automatically flags eligible renewals as merchant-initiated, and falls back to a 3DS dunning re-authentication flow on Adyen, Worldpay, and Stripe if an issuer still challenges one.
Is 3DS2 required everywhere? No. It is mandated in some regions and optional in others. It is mandated under PSD2 in the EEA and UK, and Recurly recommends supporting it broadly since issuers elsewhere may still choose to enforce it.
