3-D Secure liability shift
explained.

What 3-D Secure is

EMVCo describes EMV 3-D Secure as a protocol that lets issuers authenticate cardholders for card-not-present payments. The merchant sends transaction, payment and device data to the issuer, which then chooses:

• Frictionless flow: low-risk payments are approved after the issuer's risk analysis, with no extra step for the shopper.
• Challenge flow: higher-risk payments ask the cardholder to verify, for example with a one-time passcode or biometrics.

EMVCo recommends version 2.2 or higher. Card brands market it as Visa Secure, Mastercard Identity Check and American Express SafeKey. Stripe notes major card brands no longer support 3-D Secure 1.

When liability shifts

• Successful authentication: Stripe says liability shift can be expected for successfully authenticated payments that later receive eligible fraud disputes, but it is not guaranteed for any specific payment.
• Network requires 3DS but the issuer can't do it: Stripe notes liability can still shift when the issuer's 3DS provider is down or the card isn't enrolled, even though the cardholder didn't authenticate.
• Equivalent cryptograms: in some cases Apple Pay and Google Pay payments carry similar protection, per Stripe.

When it does not

• Non-fraud disputes. "Not received", "not as described", cancelled recurring and credit-not-processed disputes follow the normal process. 3DS proves who paid, not that you delivered.
• Authentication failed, unsupported or errored. Stripe notes liability generally does not shift when no successful authentication took place.
• Excessive fraud. Stripe lists enrollment in a card network fraud monitoring program as a reason liability shift may not apply.
• Excluded industries. Stripe gives Visa examples: wire transfers and money orders, non-financial institutions offering foreign or non-fiat currency, and stored-value card purchase or load.
• Downgrades and missed matches. Liability can be downgraded after authorization, or the network's dispute systems can miss it, in which case you still need to respond with the authentication data.
• Ignored inquiries. Stripe warns that not responding to an inquiry on a 3DS payment can lead to a "no-reply" chargeback that may invalidate the liability shift.

A worked example

A $650 laptop bag order scores as risky, so the merchant requests 3DS. The issuer challenges, the cardholder approves in their banking app, and the payment succeeds. A month later the cardholder files a fraud dispute. Because the payment was successfully authenticated, liability typically sits with the issuer, and processors such as Stripe add the authentication result and ECI to the evidence if a dispute does arrive. If the same customer later claims the bag never arrived, 3DS does not help: tracking does.

Using 3DS well

• Request 3DS for risky orders (new customers, high value, mismatched addresses) rather than every order, unless regulation such as Strong Customer Authentication in Europe requires it.
• Keep the authentication result, ECI and transaction ID with the order for evidence.
• Remember that early fraud warnings can still arrive on authenticated payments.

How Verdikx helps

Verdikx is a fraud, chargeback and dispute platform for e-commerce and SaaS merchants, made by Verdikx LLC. Verdikx's evidence checklist includes a "Payment authorization (AVS / CVV / 3-D Secure)" item, and processor records such as Stripe's 3-D Secure result are added to the packet when the processor reports them. Drafts state the authentication result as reported by the processor, without claiming it proves the cardholder authorized the payment. Order screening on Growth and Pro flags risky Shopify orders before fulfillment, which helps you decide when step-up authentication is worth the friction. See order screening.