Payments
3-D Secure
Definition
A card authentication protocol that adds a verification step between the shopper and the card issuer, shifting liability for fraudulent transactions from the merchant to the issuer when applied.
Key takeaways
- 3-D Secure adds an authentication step with the card issuer and shifts liability for fraudulent transactions to the issuer.
- For gambling operators it cuts fraud and chargeback exposure but adds friction that costs deposit conversions.
- Strong customer authentication rules made it effectively mandatory for European card payments, subject to exemptions.
Why it matters
3-D Secure matters to gambling operators for two reasons that pull against each other. It reduces fraud and moves chargeback liability to the issuer, which for a merchant category historically treated as high risk is valuable. It also inserts a step into the deposit flow, and every additional step costs conversions, which for a business acquiring customers at a meaningful cost per acquisition is a real commercial loss.
The balance has been changed by regulation rather than by choice. Strong customer authentication requirements under the EU’s second Payment Services Directive made the second-generation protocol effectively mandatory for European card payments, with narrow exemptions for low-value and low-risk transactions. Operators therefore compete on how intelligently they use those exemptions rather than on whether to authenticate at all. The related trend is away from cards altogether: open banking, Pix and pay-and-play flows avoid the problem by moving the payment to a rail where the bank has already authenticated the customer, which is one reason card share of gambling deposits has fallen in many markets where a good domestic alternative exists.
The bottom line
3-D Secure trades conversion for fraud protection, and regulation has largely removed the choice. The escape route is not using cards.
Sources
- Directive (EU) 2015/2366 on payment services in the internal market (PSD2) - EUR-Lex
- Strong Customer Authentication - Financial Conduct Authority
Frequently asked questions
What is 3-D Secure?
3-D Secure is a card authentication protocol that adds a verification step between the shopper and the card issuer during an online payment, such as a banking app approval or a one-time code. When a transaction is authenticated this way, liability for fraud moves from the merchant to the issuer. The current version, often called 3DS2, uses richer data to approve many payments without a visible challenge.
Is 3-D Secure mandatory for online gambling deposits?
In the European Economic Area and the UK, strong customer authentication rules require two-factor authentication for most online card payments, and 3-D Secure is the main way card payments meet them. Exemptions exist for low-value and low-risk transactions, and operators compete on using them well. Elsewhere, whether to apply 3-D Secure is generally a merchant, acquirer or issuer decision.
How does 3-D Secure affect chargebacks for operators?
When a card payment is authenticated through 3-D Secure, liability for disputes claiming the cardholder did not authorise the payment generally shifts from the merchant to the issuing bank. That matters in gambling, a high-risk merchant category where chargebacks threaten acquiring relationships. It does not remove every dispute: claims that are not about fraud still have to be defended by the operator.