3-D Secure (3DS) is the extra checkout step where the customer's bank confirms the buyer's identity. In most cases it moves the loss on a fraud dispute from you to the bank. A few exceptions catch merchants who assumed they were covered.
A full Visa authentication (the highest result, called ECI 5) moves the loss to the bank. An "attempts only" response (ECI 6), where the bank's system declined or was unavailable, does not always move it, and the rules vary by region. Visa Data Only runs the check to help the bank score risk. It never challenges the customer and never moves the loss. Cards not enrolled in 3DS get no protection. If you fail to pass the authentication proof (the CAVV) along with the payment, the bank can reopen the case.
Protection covers fraud disputes (Visa 10.x reason codes) only. Consumer disputes (13.x) and disputes about the bank approving the payment (11.x) are never covered. Gambling, adult and certain digital subscription categories are excluded by card brand rule. In the EEA and UK, a merchant who claims an exemption from the extra identity checks that the European PSD2 rules require keeps the loss on fraud.
Sources
- A full Visa authentication response (ECI 5) shifts liability on fraud reason codes; an "attempts only" response (ECI 6) does not shift in all regions, and Visa Data Only runs the 3DS pipe for issuer risk-scoring without challenging the cardholder, with no liability shift.Visa Secure Program Guide; Visa Core Rules and Visa Product and Service Rules, 18 April 2026
- 3DS liability shift applies to fraud-related Visa Dispute Conditions only (10.x); non-fraud conditions (11.x, 12.x, 13.x) are not covered regardless of authentication.Visa Core Rules, Section on 3DS liability allocation
- Specific merchant category codes (gambling, adult, certain digital subscription categories) are excluded from 3DS liability shift by network rule.Visa Secure Program Guide; Mastercard Identity Check Operations Guide
- In the EEA and UK under PSD2, a merchant claiming an SCA exemption (TRA, low-value, MIT, corporate) carries the fraud liability for that transaction.EBA RTS on Strong Customer Authentication, 2019; PSD2