Does an authenticated transaction protect the merchant in every case?

No. The liability shift concerns fraud: when a transaction is authenticated successfully, fraud liability moves from the merchant to the issuer. It only holds when the issuer trusts the authentication that was performed. If a wallet or device authenticated the cardholder and the issuer does not accept that method, the authentication is ignored and the merchant gets no shift.

What the liability shift covers

When a cardholder is authenticated through 3-D Secure and the issuer approves, liability for fraud disputes moves from the merchant to the issuer. The shift covers fraud reason codes only: a dispute about goods not received or not as described still lands on the merchant, authenticated or not.

When the shift does not apply

• The issuer did not participate in the authentication, and the transaction was approved under an attempt flow.
• A wallet or device performed the authentication and the issuer does not accept that method.
• The authentication data was not passed correctly in the authorization message.
• An exemption was requested, such as low value or transaction risk analysis, which keeps liability with the merchant.

What operators should check

That the authentication result and the exemption used are stored on each transaction, and that the authorization carries them. When a fraud chargeback arrives, the first question is whether the shift applied, and the transaction record should answer it in seconds. Reporting by authentication outcome also shows which issuers or markets reject delegated methods, so rules can be adjusted per merchant and market.