# 3-D Secure Source: 3-D Secure is how the payer's bank checks that the payer is the cardholder, before it authorizes an online payment. In the EEA, the law requires it for most payments that the payer makes. Last reviewed 2 November 2026. ## Strong customer authentication The EU's second Payment Services Directive, PSD2, requires strong customer authentication, SCA, for an electronic payment that the payer starts. The payer proves who they are by two of three kinds of evidence: something they know, such as a PIN; something they have, such as their phone; and something they are, such as their face or fingerprint. For card payments online, the issuer does this through 3-D Secure, which Visa calls Visa Secure and Mastercard calls Identity Check. The current version is 3-D Secure 2. The payment window runs it for every payment for which the issuer asks, and always when the payer saves a card for later charges. ## Frictionless and challenged The window sends the issuer what it knows about the payment and the payer's browser, and the issuer decides: - **Frictionless.** The issuer judges the risk to be low and approves the authentication without asking the payer anything. - **Challenged.** The issuer asks the payer to confirm, in the bank's app or on its page, with a code or a fingerprint. The window then sends the payer to the bank, and takes them back afterwards. Either way, the payment is authenticated, and the transaction lists `"3dsecurev2"` among the services that took part in it. Older transactions may list `"3dsecure"`, the first version, or `"dsbn"`, which was Dankort's own. ## Exemptions Some payments are outside SCA, or exempt from it, and the issuer then asks for no authentication: - **Merchant-initiated payments**, such as charges of a subscriber, are outside the rule, as the payer is not there to authenticate. The payer authenticates once, when they save their card. See [Stored credentials](https://docs.gjold.com/learn/stored-credentials). - **Low-value payments**, of up to 30 euros each, until five of them, or 100 euros, have gone by since the payer last authenticated. - **Low-risk payments**, which the acquirer or issuer judges safe from their fraud rates. Whether to apply an exemption is the acquirer's and the issuer's call, not yours, and the issuer can always ask for authentication anyway. Apple Pay needs no 3-D Secure: the payer's Face ID, Touch ID, or passcode is the strong authentication. ## Liability shift For a payment that the payer authenticated, a [chargeback](https://docs.gjold.com/learn/chargebacks) for fraud is the issuer's loss, not yours: the liability shifts to the issuer. It does not shift for disputes of other kinds, such as goods that never arrived.