What Is EMV 3-D Secure? Definition, Payment Flow, and Examples
EMV 3-D Secure (EMV 3DS) is the modern 3DS specification framework maintained by EMVCo, supporting richer device data, frictionless, and challenge flows. This guide focuses on EMV 3DS's real role, boundaries, and common points of confusion.
Key points
- Definition: EMV 3-D Secure (EMV 3DS) is the modern 3DS specification framework maintained by EMVCo, supporting richer device data, frictionless, and challenge flows.
- Flow position: 3-D Secure is a cardholder-authentication framework for e-commerce, and EMV 3DS is the current specification family maintained by EMVCo.
- Do not confuse: EMV 3DS / 3D Secure
How it fits into the payment flow
For EMV 3DS, the relevant process is as follows: 3-D Secure is a cardholder-authentication framework for e-commerce, and EMV 3DS is the current specification family maintained by EMVCo. Risk data can support a frictionless flow or lead the issuer side to require a challenge before or alongside authorization.
A practical review of EMV 3DS should account for this: frictionless does not mean no authentication processing; it means the user commonly has no extra interaction. A challenge can use app confirmation, a one-time code, or another supported method. Issuer and program implementations vary.
Practical example
A merchant uses EMV 3DS messages to exchange browser, device, merchant, and transaction data so the issuer can assess risk or challenge. Implementation still follows the relevant 3DS program.
How it differs from related terms
| Term | Definition |
|---|---|
| EMV 3-D Secure | is the modern 3DS specification framework maintained by EMVCo, supporting richer device data, frictionless, and challenge flows |
| 3D Secure | is a cardholder-authentication framework for card-not-present payments that exchanges risk and authentication data across three domains |
| Strong Customer Authentication | is a regulatory requirement in some regions to verify a payer with independent factor categories, with scope and exemptions varying by jurisdiction |
EMV 3DS focuses on the fact that it is the modern 3DS specification framework maintained by EMVCo, supporting richer device data, frictionless, and challenge flows. 3D Secure, by contrast, is a cardholder-authentication framework for card-not-present payments that exchanges risk and authentication data across three domains. They can appear in one transaction while answering different questions.
Use cases and limits
A key limit of EMV 3DS is the following: successful authentication does not guarantee authorization. A failed challenge should not be answered by repeatedly entering codes on an unfamiliar page. Merchants must also protect redirects and callbacks.
Frequently asked questions
These answers address two common search questions about EMV 3DS.
Is it the same as 3D Secure?
No. EMV 3-D Secure (EMV 3DS) is the modern 3DS specification framework maintained by EMVCo, supporting richer device data, frictionless, and challenge flows. 3D Secure (3DS) is a cardholder-authentication framework for card-not-present payments that exchanges risk and authentication data across three domains. Compare the object, processing stage, and responsible party.
Does a frictionless flow mean that 3DS was not used?
For EMV 3DS, no. It generally means the 3DS risk assessment did not require additional cardholder interaction; authentication data can still be exchanged in the background.
These primary sources support the definition and process for EMV 3DS. Current product, network, and local rules still control a real transaction.