Explained to kids!
3-D Secure is the little check a bank can do when someone pays online with a card: “Is it really you?” Sometimes the bank already knows it is you and asks nothing. Sometimes it asks for a code or a fingerprint. An exemption is a good reason to skip the check, like a very small amount.
Let’s see it in real life…
On Saturday, Hugo goes to the post office with his aunt Nadia to pick up a parcel.
Mrs. Baptiste at the counter smiles: “Hello Nadia!” She hands over the parcel without asking for anything. She has seen Nadia every week for years.
Behind them, a man nobody knows wants a big parcel. Mrs. Baptiste says: “Your ID card, please, and the code we sent you.”
Hugo whispers: “Why not us?” Nadia says: “She is sure it is me. For him, she is not, so she checks.”
Then a girl picks up a tiny envelope. No ID, no code. “For small things, we don’t bother,” says Mrs. Baptiste.
The florist from across the street comes in. Parcels for her shop arrive every day, and the post office put her on a list of people it trusts. No questions either.
Hugo counts on his fingers: known face, small thing, trusted list. Three good reasons to skip the check.
On the way home, Nadia pays for bread with her card. The bank also decides, in a second: ask, or don’t ask.
“And if the man with the big parcel had fake papers?” asks Hugo. “Then it is the post office’s mistake, not the sender’s,” says Nadia. “That is why they check.”
That is 3-D Secure, with its exemptions.
Tiny recap
- It means… the bank can ask “is it really you?” when you pay online, and skips the question when it is sure or when the amount is tiny.
- It helps when… someone tries to use a stolen card number. A code or a fingerprint stops them.
- Watch out for… too many questions make people give up, and no questions at all let thieves in. The bank has to find the right balance.
…detailed for specialists
3-D Secure (3DS) is the protocol a merchant uses to let the card issuer authenticate the cardholder during an online payment. SCA exemptions are the cases where European rules allow the issuer or the acquirer to skip that authentication: small amounts, low-risk transactions, trusted merchants, recurring charges. Together they decide how much friction a checkout carries.
In 2026 the subject matters more than it did in 2021, when PSD2 enforcement ended. Fraud is adapting, the EU is rewriting its rules with PSD3 and the PSR, the UK is loosening its own, and the schemes keep changing the data they want to see. Every PSP, PayFac and platform makes dozens of authentication decisions per second, and each one moves approval rates, fraud losses and liability.
What is 3-D Secure, and what is SCA?
Strong customer authentication is the legal requirement. Under PSD2 and the regulatory technical standards of Delegated Regulation 2018/389, a customer-initiated electronic payment inside the EEA must be authenticated with two of three factors: something the customer knows, has or is. The UK kept the same rules after Brexit, under FCA supervision.
EMV 3DS is the industry protocol that carries it for cards. The merchant’s 3DS server sends the issuer’s access control server a message with the order, the device and the customer; the issuer decides. Version 2.1 was retired by Mastercard on September 24, 2024 and Visa on September 25, 2024, and 2.2 became the baseline. Version 2.3 adds FIDO-based WebAuthn and Secure Payment Confirmation, device binding, automated out-of-band transitions and richer recurring and token data. Other regions mandate 3DS without a PSD2-style law, a point to check before you expand into new markets: Japan has required EMV 3DS on e-commerce credit card transactions since April 1, 2025 under the METI security guidelines, which our guide to payment methods in Japan covers.
How does a 3DS 2 authentication work?
- The merchant sends the authentication request with the cardholder name, billing address, email or phone, IP or device ID and browser data. Visa made these fields mandatory on August 12, 2024, and Mastercard required them from July 1, 2026.
- The issuer scores the transaction. With enough data and a low score, it authenticates silently: this is the frictionless flow. The customer sees nothing.
- Or the issuer challenges. A push to the banking app, a biometric check, or a one-time code. In 3DS 2.3, the app-to-app switch is automated and a passkey can replace the code.
- The result comes back as an ECI value and a cryptogram. Fully authenticated means Visa ECI 05 or Mastercard ECI 02; attempted means ECI 06 or 01; not authenticated means ECI 07 or 00.
- The merchant authorizes with the cryptogram attached. Authentication and authorization are two separate calls, and the issuer can still decline the second one.
What are the SCA exemptions?
The RTS lists the cases where SCA may be skipped. The main ones for card payments:
- Low value (Article 16): remote payments up to EUR 30, with a ceiling of EUR 100 or five transactions since the last SCA. The issuer keeps the counters, so the merchant cannot know in advance whether the exemption will hold.
- Transaction risk analysis (Article 18): the acquirer or issuer may exempt a payment if its fraud rate stays under a reference rate for the amount band. For cards, the annex sets 0.13% up to EUR 100, 0.06% up to EUR 250 and 0.01% up to EUR 500. The EBA has confirmed that the rate is calculated per transaction type, not per band: a PSP at 0.10% can only exempt payments up to EUR 100. Two consecutive quarters above the reference rate and the exemption is lost for that band.
- Trusted beneficiaries (Article 13): the cardholder adds a merchant to a whitelist at the issuer, after one SCA. Later payments skip it.
- Recurring transactions (Article 14): the same amount to the same payee, authenticated once when the series starts.
- Secure corporate payments (Article 17): dedicated corporate processes and cards, where the regulator accepts the security level.
Two cases fall outside SCA altogether rather than being exempted. Merchant-initiated transactions (MIT), such as a variable subscription charge or a hotel’s final bill, are not customer-initiated, so no SCA applies after the initial mandate. And a payment where either the issuer or the acquirer sits outside the EEA is out of scope; the issuer applies “best efforts”. The VRP episode shows how account-to-account rails handle the same recurring problem.
Who carries the fraud: the liability shift
Authentication decides who pays for fraud. When the issuer authenticates, fraud liability moves from the merchant to the issuer: Visa reason code 10.4 and Mastercard 4837 fraud disputes are no longer chargeable to the merchant. A frictionless result counts as much as a completed challenge. When the merchant requests an exemption, no authentication takes place and the fraud liability stays with the merchant. The shift covers fraud only: a “goods not received” chargeback is still the merchant’s problem, authenticated or not.
That is the real trade behind every exemption: less friction and no liability shift, against more friction and protection. A merchant with a 0.02% fraud rate on EUR 40 baskets gains from TRA. A marketplace selling EUR 900 phones to new customers does not.
Delegated authentication: when the issuer lets someone else check
Issuers can delegate the SCA to a merchant, a wallet or a device maker that has proven its own authentication, typically a FIDO passkey or a biometric on the phone. Apple Pay and Google Pay already work this way, as explained in the Xpay episode, and EMV 3DS 2.3 carries the data to say so. Visa and Mastercard run programs for it, and the #TheShot episode on delegated authentication walks through the model. The catch is trust: an issuer that does not recognize the delegate can demote the transaction and challenge anyway. We cover the full picture in payment authentication: 3D Secure, SCA and delegated authentication.
3-D Secure and SCA in numbers (2026)
- Fraud: payment fraud in the EEA reached EUR 4.2 billion in 2024, with card fraud on EU-issued cards up 29% to EUR 1.33 billion, according to the joint EBA-ECB report.
- SCA works: the same report finds card fraud 17 times higher when the counterparty is outside the EEA, where SCA is not required.
- TRA thresholds: 0.13%, 0.06% and 0.01% reference fraud rates for the EUR 100, 250 and 500 bands.
- Challenge success: Ravelin measures 95% in the UK, 91% in France, 88% in the United States and 36% in Brazil, and reports frictionless rates declining or flat in 28 of 37 countries.
- Exemptions: 78% of merchants surveyed use SCA exemptions, up on the previous year.
- UK contactless: the FCA proposes to replace the GBP 100 single and GBP 300 cumulative limits with a risk-based exemption set by each PSP.
What changes with PSD3, the PSR and the UK rules?
The Council and the Parliament reached a provisional agreement on PSD3 and the PSR on November 27, 2025. The final compromise texts went to COREPER on April 23, 2026, and most provisions apply 21 months after entry into force, which points to 2028. On SCA, the PSR keeps the two-factor principle but clarifies when it applies, treats merchant-initiated transactions explicitly, and requires authentication methods that do not depend on a smartphone and are free of charge. Fraud liability widens: a PSP without adequate anti-fraud mechanisms, or without verification of payee, pays. Our PSD3 episode tracks the timeline, and The EU Law of Payments in the Payments Library is the reference text.
The UK goes the other way. The government has agreed to move parts of SCA out of the technical standards into FCA rules, towards outcome-based regulation, starting with contactless limits. A PSP operating in both markets will soon run two different rulebooks on the same 3DS stack.
3-D Secure and SCA: what changes for PSPs, PayFacs and platforms
Exemption logic belongs in routing
The decision to request TRA, flag an MIT or force a challenge should be a routing rule per merchant, amount band, card country and acquirer, not a checkout setting. The same merchant needs a challenge on a new card at EUR 400 and a TRA flag on a repeat customer at EUR 25. Since TRA depends on the acquirer’s fraud rate, the rule must know which acquirer the transaction will go to; on a multi-acquirer setup, see our article on payment routing.
Fraud rates are a portfolio asset
An acquirer’s TRA fraud rate is calculated on everything it processes. One sub-merchant with a card-testing problem can push the whole portfolio over 0.06% and kill the EUR 250 band for every other merchant. Velocity limits and pre-authentication screening protect the exemption as much as the merchant.
Soft declines need a second leg
When an issuer refuses an exemption, it returns a soft decline asking for authentication. The platform must be able to re-run the payment through 3DS without the customer starting over. A checkout that cannot do this loses the sale at the exact moment the issuer was willing to approve.
Evidence for disputes and audits
ECI, cryptogram, 3DS version, exemption flag and the issuer’s response must be stored on the transaction and exported with it. They decide whether a fraud chargeback is representable, and regulators can ask for the quarterly fraud-rate calculation behind each TRA exemption. NORBr Scheme Ready keeps the scheme rules, certifications and authentication data aligned across providers listed on connectors.
Is 3-D Secure worth it in 2026?
Where it is mandated, the question is how to use it, not whether. The best-performing merchants authenticate everything above their risk appetite, exempt what is both small and clean, and send the issuer the full data set so frictionless stays frictionless. The 17-times gap between EEA and non-EEA card fraud says the mechanism works. The declining frictionless rates say the data behind it is getting worse. For a PSP or PayFac, the work in 2026 is operational: routing-level exemption rules, portfolio fraud-rate monitoring, soft-decline recovery and clean evidence, with PSD3 and the UK reform as the next two rulebooks to load.
Frequently Asked Questions
What is the difference between 3-D Secure and SCA?
SCA is the legal requirement under PSD2: two authentication factors for customer-initiated online payments in the EEA and the UK. 3-D Secure is the card protocol that carries it between merchant and issuer. You can meet SCA without 3DS, for example with a wallet, but 3DS is how most card payments do it.
What are the main SCA exemptions for card payments?
Low value (up to EUR 30, capped at EUR 100 or five transactions since the last SCA), transaction risk analysis up to EUR 500 depending on the PSP’s fraud rate, trusted beneficiaries whitelisted at the issuer, recurring transactions of a fixed amount, and secure corporate payments. Merchant-initiated transactions are out of scope rather than exempted.
What is the 3DS liability shift?
When the issuer authenticates a transaction through 3-D Secure, frictionless or challenged, liability for fraud chargebacks such as Visa 10.4 or Mastercard 4837 moves from the merchant to the issuer. It does not cover non-fraud disputes, and it does not apply when the merchant requested an exemption instead of authenticating.
What are the TRA exemption thresholds?
Transaction risk analysis lets a PSP skip SCA when its card fraud rate is at or below 0.13% for payments up to EUR 100, 0.06% up to EUR 250, and 0.01% up to EUR 500. The rate is calculated per quarter on all remote card payments, so one band cannot be exempted on its own.
Does PSD3 change strong customer authentication?
The PSR keeps two-factor SCA but clarifies its scope, treats merchant-initiated transactions explicitly, requires methods that work without a smartphone, and widens PSP liability for fraud. Provisionally agreed in November 2025, it applies about 21 months after entry into force. Final texts were published in April 2026.
