3DS Authentication: What it is and How it Works for UK Businesses

Ever had a customer's online payment fail at the final hurdle, just as they’re about to complete a purchase? That extra security check is called 3D Secure (3DS), and while it can sometimes interrupt the checkout flow, it plays an important role in reducing fraud and protecting transactions.

For UK businesses, failed payments and fraud risks can directly impact revenue and customer trust. Understanding how 3DS authentication works—and why it’s required under regulations like SCA—can help you improve payment success rates while staying compliant.

In this guide, we've explained what 3DS authentication is, how it works step by step, and why it matters for UK businesses.

We've also explained how Wise Business can support businesses managing domestic and international payments.

Discover Wise Business 🔎

3DS authentication at a glance

What is 3DS authentication?

3DS, short for 3-D Secure, is a protocol used to authenticate card-not-present transactions. Card-not-present means that the customer is paying online or in another situation where the physical card is not inserted or tapped at a terminal.

During the 3DS flow, the merchant or payment provider sends transaction information to the card network and the cardholder's issuing bank. The issuer uses the available information to assess the transaction. If it can authenticate the payment without involving the customer, the payment can use a frictionless flow. If it needs more evidence, it can ask the customer to complete a challenge.

The exact screens and verification methods depend on the card issuer, payment provider, card scheme, device and transaction. A challenge might involve approving a prompt in a banking app, entering a one-time passcode or using a biometric check. The customer may also be redirected to an issuer page or shown an error if the authentication cannot be completed.

How does 3DS authentication work?

The customer-facing part of 3DS can be brief, but several parties exchange information in the background. The usual sequence is:

1. The customer starts an online card payment

The customer enters their card details at checkout and confirms that they want to pay. The merchant's checkout sends the payment request to its payment provider.

2. The payment provider starts an authentication request

The payment provider sends the transaction and checkout information needed for the 3DS flow through the relevant card network. The information can include details about the transaction, merchant, browser, device and customer journey. The exact data depends on the implementation and provider.

3. The card issuer assesses the transaction

The card issuer evaluates the information and decides whether it can authenticate the customer without an additional interaction. This is a risk decision made within the issuer's authentication flow. It is not a promise that the payment will be authorised.

4. The payment follows a frictionless flow or a challenge flow

In a frictionless flow, the customer may not see a separate authentication screen. The issuer returns an authentication result and the payment can continue to the next stage.

In a challenge flow, the customer must complete an additional step. They might approve the transaction in their banking app, enter a one-time passcode or use another method supported by their issuer. A challenge can fail if the customer cannot complete the step, the details do not match or the issuer declines the authentication.

5. The authentication result returns to the payment flow

The payment provider receives the result and passes it to the merchant's checkout or payment system. The merchant can then follow its configured rules for submitting, completing, declining or reviewing the payment.

6. The payment is authorised separately

Authentication and authorisation are related but different. Authentication is about checking the cardholder. Authorisation is the issuer's decision about whether the payment can proceed. A successfully authenticated transaction can still be declined for another reason, such as insufficient funds, a blocked card or a fraud decision.

What is the difference between a frictionless flow and a challenge flow?

A frictionless flow is designed to authenticate a payment without asking the customer to take a visible extra action. This can reduce interruption at checkout, although the customer may still see normal payment-processing messages.

A challenge flow asks the customer for additional evidence or approval. It can provide the issuer with another way to check the payment, but it also adds a step that the customer must understand and complete. If the challenge is unclear, unavailable or unsuccessful, the customer may abandon the checkout or contact their bank.

Businesses cannot assume that they can choose a frictionless result for every transaction. The issuer and payment rules determine whether a challenge is needed. The merchant can improve the experience by using a provider that supports the relevant 3DS version, passing accurate checkout data, displaying clear failure messages and giving customers a sensible route to contact their card issuer.

3DS1 vs 3DS2: what is the difference?

3DS2 is the newer version of the protocol and was designed for modern online and mobile payment journeys. Compared with older 3DS implementations, it can support a richer exchange of transaction and device information and can work with more types of checkout experience. These capabilities can help the issuer make a more informed authentication decision, but the result still depends on the provider, issuer, card scheme and transaction.

3DS1 commonly used a more visible redirect-style customer experience. 3DS2 can support both frictionless authentication and challenge experiences such as an in-app approval, although the exact experience is controlled by the implementation and issuer.

The practical question for a business is usually not just which version is named in a provider's documentation. Check whether the provider supports the card schemes and customer markets you serve, how it handles challenge failures, what data it passes, how it reports authentication results and what happens when a customer cannot complete the flow.

Why do businesses use 3DS authentication?

It adds an authentication step to online card payments

Stolen card details may not be enough to complete a payment when the issuer asks the customer for an additional verification step. 3DS therefore gives the issuer another signal to use when assessing a card-not-present transaction. It should be combined with the merchant's wider fraud controls rather than treated as a complete fraud-prevention programme.

It can support payment-liability decisions

Authentication results can affect how certain card-scheme rules treat a fraudulent transaction or chargeback. The outcome depends on the scheme, transaction type, exemption, authentication result and the applicable provider rules. A business should not describe 3DS as a blanket transfer of liability or assume that every authenticated payment is protected from a chargeback.

It can help businesses meet authentication requirements

UK payment service providers may need to apply SCA to certain electronic payments, subject to the relevant rules and exemptions. 3DS is one method that can be used to authenticate online card payments, but it is not synonymous with SCA and it is not automatically required for every transaction.

It provides a familiar verification route for some customers

Customers may recognise a banking-app approval, one-time passcode or biometric prompt. Clear explanations at checkout can make the step easier to understand. Avoid telling customers that the payment is guaranteed to succeed after they complete 3DS, because the issuer can still decline the payment at the authorisation stage.

How can a business make 3DS checkout smoother?

The best approach is to treat authentication as part of the whole checkout rather than as an isolated security screen.

• Work with a payment provider that supports the card schemes, countries and devices relevant to your customers.
• Send complete and accurate transaction, browser and customer information where your provider supports it. Missing or inconsistent data can affect the issuer's assessment.
• Explain that the customer might need to approve the payment through their bank. Keep the wording short and make it clear which organisation the customer should contact if the verification does not work.
• Make the challenge usable on mobile and desktop devices, and test it with the main browsers and payment journeys your customers use.
• Give the customer a clear error message and a clear way to retry or use another payment method. Do not ask them to repeat a payment without explaining what happened.
• Monitor authentication attempts, challenge completion, payment declines, abandonment and chargebacks separately. A change in one metric does not explain a change in the others.
• Check your provider's rules for exemptions, recurring or merchant-initiated transactions and stored-card payments before changing authentication settings.

---

If you are reviewing the wider checkout journey, we recommend reading our guides on how to take payments online, ecommerce payment processing and chargeback prevention.

---

Are there fees for 3DS authentication?

There is no single 3DS price for every business. A payment provider might include authentication in its card-processing pricing, charge a separate authentication or platform fee, or apply different pricing by market and payment method. Check the provider's current pricing and contract terms for authentication, failed payments, refunds, disputes, currency conversion and payout fees.

Compare the total cost against your payment volume and customer journey. A cheaper headline processing rate may not be cheaper if it comes with higher platform, dispute, currency or payout costs.

Where Wise Business fits after a 3DS checkout

3DS authentication is normally handled by the merchant's card-payment provider. Once they've collected an online payment, eligible businesses can use Wise Business to receive supported international payments using local account details in 8+ currencies and convert between currencies at the mid-market rate with low, transparent fees.

That can be useful when a business sells internationally and needs to manage the money received after checkout. It does not replace the payment provider's fraud checks, 3DS setup or customer-payment flow.

Wise Business offers a free Essential plan for basic spending and transferring. If you need to receive money, set up direct debits, or generate invoices, you'll pay a one-time £50 setup fee to unlock the Advanced features.

With Wise Business, you can:

• 🌍 Send money to 70+ countries and pay overseas invoices at the mid-market exchange rate with low, transparent fees and no hidden exchange rate markups (product availability varies by region)
• 📥 Receive payments in 24 currencies and counting
• 💵 Get local account details for 8+ currencies, including USD and EUR, to let your customers pay in a currency they know and trust - convenience for them and peace of mind for you
• 💰 Hold money in 40+ currencies
• 🔁 Convert currencies anytime at the mid-market exchange rate with low, transparent fees
• ⚡ Use the batch payments tool to create and send up to 1,000 payments in a single transfer
• 👥 Run payroll and make international payments for up to 1,000 employees all over the world - including paying suppliers using local payment methods like ACH, SEPA, and Faster Payments
• 💳 Get business debit cards with 0.5% cashback for you and your team to keep track of team expenses and spend all over the world, with real-time visibility and categorisation. See full cashback terms and conditions
• 🏢 Manage cash in 55+ currencies across international offices from a single business account and move money between business accounts in seconds (exact speeds can vary depending on individual circumstances and may not be the same for all transactions)
• 🧾 Connect and sync every business transaction to your favourite accounting software, including Xero, Quickbooks, and more
• 🔐 Create your own payment approvals process to manage your team better with customised access for different team members, roles and permissions
• 📑 Create custom professional invoices and schedule invoice payments for future dates
• 📈 Earn variable returns on GBP, USD and EUR with Wise Interest (Capital at risk, growth not guaranteed. Your money is at risk if governments default or interest rates go negative. Rates vary by country and currency. Rates are variable. Visit Wise Interest to find out more)
• 🔗 Create payment links and QR codes to get paid easily (Card payment acceptance for new Wise Business customers is currently unavailable. Payment methods subject to eligibility and availability.)
• ⚙️ Automate payouts with the Wise API (comes with 24/7 customer support, a sandbox account to test integrations, API tokens, and clear documents on how to implement and make the most of our API)

Make the wise choice when selecting a business account for your domestic and global needs.

Be Smart, Get Wise.

Register for Wise Business ✍️

**Investments are not guaranteed, and your capital is at risk.

Wise is an Electronic Money Institution (EMI), so features like Interest and Stocks may be covered by the Financial Services Compensation Scheme (FSCS). For standard cash balances, we safeguard your funds to meet regulatory obligations.

In the UK, Interest and Stocks are provided by Wise Assets, the trading name of Wise Assets UK Ltd, which is authorised and regulated by the Financial Conduct Authority (FCA number 839689).

We do not provide investment advice, and taxes may apply. If unsure, seek qualified financial advice. Full fund information is available on our website.

Frequently asked questions about 3DS authentication

What does 3DS stand for?

3DS stands for 3-D Secure. It is a protocol used to authenticate a cardholder during an online card payment.

Is 3DS authentication the same as 3D Secure?

Yes. 3DS is the shortened name for 3-D Secure, and 3DS authentication describes the cardholder-checking part of the protocol.

Why did my customer have to complete a 3DS challenge?

The card issuer may have decided that it needed additional evidence or customer approval before completing authentication. The issuer's rules, the transaction information, the payment method and the applicable authentication requirements can all affect the result.

Does 3DS authentication prevent all fraud?

No. 3DS is one authentication and fraud-risk tool. An authenticated payment can still be declined, disputed or affected by other fraud and payment risks.

Is 3DS mandatory in the UK?

3DS is not automatically mandatory for every UK card payment. Certain payments may be subject to SCA, and 3DS is one technical method that can help a provider meet authentication requirements. Exemptions and the relevant payment rules can apply, so businesses should confirm the position with their payment provider and compliance adviser.

Sources:

1. 3D Secure payments | Stripe Documentation
2. Authenticate with 3D Secure | Stripe Documentation
3. 3D Secure: your guide to safer transactions | Visa
4. Strong Customer Authentication | Financial Conduct Authority

Sources last checked on 1st September 2026