3ds Protocol

Understanding the 3DS Protocol

This guide explains how 3D Secure 2.0 works behind the scenes and why it's designed the way it is.

What is 3D Secure 2.0?

3D Secure 2.0 is the latest version of the authentication protocol that makes online payments more secure. Unlike the older version that always interrupted customers with pop-ups, 3DS 2.0 is smart enough to work invisibly most of the time.

The Two Authentication Flows

Frictionless Flow: The Invisible Shield

When it happens: Most transactions What customers see: Nothing - the authentication is completely invisible How long it takes: Nearly instant (no delay)

How Frictionless Flow Works

1. Customer starts checkout - They click "Pay" on your website

2. Data collection - Your system automatically gathers 100+ data points including:

   • Device information (screen size, timezone, browser)
   • Purchase history with your business
   • Shipping vs billing address comparison
   • Transaction patterns and amount
   • Time of day and location

3. Issuer analysis - The customer's bank uses machine learning to analyze risk factors:

   • Is this device recognized?
   • Is the purchase amount typical?
   • Does the location make sense?
   • Are there any suspicious patterns?

4. Instant decision - The bank approves or declines within milliseconds

5. Transaction completes - Customer never knows authentication happened

Why Frictionless Works

• Rich data: 100+ data points give banks enough information to make confident decisions
• Machine learning: Banks use AI to detect legitimate vs suspicious patterns
• Device recognition: Returning customers on known devices are low-risk
• Behavioral analysis: Normal shopping patterns are easy to identify

Challenge Flow: When Extra Verification is Needed

• When it happens: Rare - Occurs when the card issuer cannot automatically verify the transaction through 3D Secure risk checks.
• What customers see: Additional verification screen
• How long it takes: 30-60 seconds

When Challenge Flow Triggers

• New customers using your website for the first time
• Unusual amounts significantly higher than normal purchases
• New devices or browsers not seen before
• Suspicious patterns detected by the bank's algorithms
• High-risk merchants in certain industries

Challenge Flow Process

1. Risk assessment - Bank determines additional verification is needed

2. Challenge method selection - Bank chooses verification method:

   • SMS/Email OTP: One-time code sent to customer's registered contact
   • Biometric: Fingerprint or face scan through mobile banking app
   • PIN entry: Customer enters their banking PIN
   • Mobile app: Push notification to banking app

3. Customer verification - Customer completes the chosen challenge

4. Authentication result - Bank confirms identity and approves/declines

5. Transaction completes - Customer returns to your checkout

Risk-Based Decision Making

The power of 3DS 2.0 lies in its intelligent risk assessment:

Low-Risk Indicators

• Returning customer with purchase history
• Recognized device and browser
• Normal purchase amount for customer
• Consistent shipping address
• Typical time of day for purchases

High-Risk Indicators

• First-time customer
• New or unusual device
• Large purchase amount
• Mismatched shipping/billing addresses
• Unusual time or location

Technical Implementation

For Merchants

• Send rich data: Provide as many data points as possible
• Handle both flows: Your system must support frictionless and challenge paths
• Optimize for mobile: Ensure challenge screens work well on mobile devices
• Monitor performance: Track authentication rates and customer experience

For Customers

• Frictionless: No action required - shopping experience unchanged
• Challenge: Simple, secure verification when needed
• Mobile-friendly: Optimized for modern devices and payment methods

Benefits of 3DS 2.0 vs Old 3DS

Aspect	Old 3DS (1.0)	New 3DS (2.0)
Customer Experience	Always interrupted checkout	95% invisible
Mobile Support	Poor	Excellent
Data Shared	Minimal	100+ data points
Authentication Methods	Basic password	Multiple options
Approval Rates	Lower	Higher

Common Misconceptions

"3DS Always Causes Cart Abandonment"

Reality: Modern 3DS 2.0 is invisible 95% of the time. When implemented correctly, it actually increases conversion by reducing false declines.

"Customers Don't Like Extra Steps"

Reality: Customers appreciate security when explained properly. The key is making it seamless when possible and quick when necessary.

"3DS is Too Complex to Implement"

Reality: With proper SDKs and APIs, 3DS integration is straightforward. The complexity is handled by the authentication infrastructure.

---

Key Takeaway: 3DS 2.0 is designed to be invisible to customers while providing maximum security for merchants. The goal is authentication without interruption.