3D Secure

Why it matters

It shifts fraud liability away from the merchant when used correctly, and is increasingly mandatory under regulation in various regions for card-not-present transactions. A checkout that cannot handle the redirect and return flow 3D Secure requires will lose the sale entirely at that step, not just add friction to it. It also shifts over time as regulation changes: mandatory authentication requirements have expanded across more regions and more transaction types in recent years, meaning a checkout that ignored this a few years ago is increasingly likely to break today. It also differs by card network in its exact flow, meaning a checkout tested only against one network's implementation can still fail unexpectedly on another's.

What goes wrong when it's handled badly

A checkout built without accounting for the redirect 3D Secure introduces can break the payment flow entirely on cards that require it, showing the transaction as failed even though the customer completed the authentication correctly. This shows up disproportionately on international and increasingly on regional cards as issuers roll out mandatory authentication. A concrete example is a checkout that opens the authentication step in a popup window blocked by the customer's browser, silently failing the payment with no clear message, leaving the customer assuming the site itself is broken rather than their popup blocker. Testing the full authentication flow against real, 3D-Secure-enrolled test cards before launch, not just a standard test card that skips the step, is what catches this before real customers do. Monitoring authentication success rates specifically, not just overall payment success, is what isolates this step as the actual point of failure when something goes wrong.