Does 3D Secure stop fraud chargebacks?

3D Secure does not stop fraud chargebacks on its own. A successful authentication typically shifts liability for a fraud dispute to the issuer, but Stripe says the shift is never assured, it covers fraud disputes only, and it can be lost through a monitoring program or an unanswered inquiry.

What does 3D Secure cover?

It covers fraud disputes only. 3D Secure (3DS) is the extra step at checkout where the cardholder confirms the purchase with their bank. Stripe says a customer who claims the product never arrived, or that it was not as described, opens a dispute that follows the standard process whether or not the payment was authenticated.

A 3DS flag on a 13.1 notice is therefore no defence. Visa's 13.1 asks whether the goods were delivered, while the 3DS flag answers who made the purchase. For any non-fraud dispute, build the response from delivery and order records.

When to add 3DS is a separate call, because authentication adds a step at checkout. The evidence above suggests using it where the buyer is new and the order is large, with less benefit where the buyer has a long clean history that CE 3.0 can already prove. Our guide to Visa 10.4 and CE 3.0 in practice shows how the pieces are matched.

When does the liability shift fail?

It fails in several cases Stripe lists, including merchants in a fraud monitoring program and industries Visa excludes.

In the US, Visa's Secure Excessive Fraud Program applies at 3DS fraud volume of USD 75,000 and a rate of 0.9%, according to Stripe. A merchant caught by it loses the liability shift on domestic 3DS until it exits. The protection is weakest for the merchant with the most fraud, so watch those two figures.

Procedure matters too. An inquiry on a 3DS-authenticated charge has to be answered, because an unanswered inquiry that becomes a chargeback can void the shift. Answer every inquiry, even when the charge looks protected.

Wallets add a wrinkle. Stripe says the shift applies in some cases with equivalent cryptograms such as Apple Pay and Google Pay, and that wallets and off-session payments may not support 3DS at all. Check how your own payment mix behaves instead of assuming.

What defends a fraud dispute when 3DS does not apply?

For Visa's card-absent fraud code, 10.4, Compelling Evidence 3.0 (CE 3.0) can, if the customer has qualifying earlier orders. Under CE 3.0 you can show two earlier transactions on the same credential, processed more than 120 and not more than 365 days before the dispute, that the issuer did not report as fraud, with matching data elements such as a login ID, device or delivery address.

From 24 October 2026, Visa expands CE 3.0 for 10.4 and lets multi-merchant transactions count as evidence. A returning customer's history can be put to work in the case, which a first-time buyer's cannot. Strong repeat business is an asset that 3DS never measured.

The two defences also sit differently in Visa's monitoring ratio. Visa's VAMP fact sheet excludes fraud reports that qualified for CE 3.0 from the ratio, along with disputes resolved before they became disputes through pre-dispute solutions. Getting CE 3.0 qualification working helps on the single case and in the number Visa watches.

Should you refund an early fraud warning?

On a small order, usually yes. Stripe says about 40% of Visa and Mastercard early fraud warnings become fraud disputes if the merchant does not refund, so a warning is the cheapest point at which to decide.

Takeaway: what to do this week

1. Save the 3DS result against each order. It is the first record anyone will ask for.
2. Answer every inquiry on an authenticated charge. An unanswered inquiry that becomes a chargeback can void the shift.
3. Keep a fraud file ready for each order. Hold the IP and device data, the account history and any earlier undisputed orders that CE 3.0 can use.
4. Refund small orders that draw an early fraud warning. About 40% of warnings become fraud disputes if not refunded.

Sources: Stripe Docs, "3D Secure authentication flow" (undated); Stripe Docs, "Dispute and fraud card monitoring programs" (undated); Stripe Docs, "How disputes work" (undated); Visa, Visa Core Rules (edition 18 April 2026), Table 11-28 and Summary of Changes; Visa, VAMP Fact Sheet 2025. All checked 24 October 2026.