EnterprisePaymentsPayment Processing

The Evolution of Payment Authentication: 3DS

PayPal Editorial StaffPayPal Editorial Staff

November 12, 2025

November 12, 2025

4 mins read

3D Secure (3DS) was introduced in the early 2000s as a groundbreaking payment authentication protocol to combat online fraud. Developed by EMVCo in collaboration with credit card networks like Visa and Mastercard, 3DS adds an extra layer of identity verification during ecommerce transactions, typically through two-factor authentication (2FA).

When 3DS is successfully applied to a transaction, the Issuer is responsible for verifying and authenticating the transactions. If the Issuer authenticates the 3DS transaction and it results in fraud, liability will be absorbed by the Issuer. If 3DS is not successfully applied to a transaction and fraud occurs, the merchant is responsible for any loss and fees.

Where is 3DS required to process online transactions?

As of August 2025:

  • European Economic Area (EEA): The PSD2 regulation requires Strong Customer Authentication (SCA) for most online transactions, and 3DS is a common method for meeting this requirement.
  • United Kingdom (UK): Following Brexit, the UK has adopted the SCA requirements of PSD2, thus requiring 3DS for compliance

While not required, the following countries do require additional customer authentication which are similar to SCA requirements:

  • Switzerland: Although Switzerland is not part of the EEA, its banks and payment systems often align with EU standards. While SCA is not strictly part of Swiss law, equivalent security mechanisms are enforced.
  • India: India does not follow PSD2, but the Reserve Bank of India (RBI) mandates two-factor authentication for card-not-present transactions. This is considered an equivalent to SCA.
  • Other Regions: Some countries such as Singapore, Japan, China, Australia, Canada, and the United States, have adopted enhanced security practices for payments processing. However, these do not include mandatory SCA and often rely on voluntary industry standards.

What results do we see with 3DS in the UK/EU vs the US?

Fast forward to 2025, 3DS has proven to be a powerful tool in mitigating fraudulent online activity in the UK and EEA. Recent data demonstrates that 3DS has successfully reduced $13.2 billion in fraudulent volume year-to-date. With ecommerce landscapes experiencing heightened threats, 3DS plays an instrumental role in safeguarding transactions worldwide.

That said, this enhanced security can come with trade-offs, especially in the US. Some shoppers can find the authentication process cumbersome, which can lead to cart abandonment . To address these concerns, 3DS 2.0 was introduced, offering streamlined authentication methods and frictionless experiences for trusted customers.

Even so, Issuers decision US 3DS volumes compared to their EEA counterparts. On average, when sending 3DS traffic to US Issuers, PayPal saw:

Increased Fraud Declines:

  • +4.5% in “Fraud Suspected” declines

Increased Issuer Declines:

  • +1.2% in “Declined - Call Issuer” declines
  • +0.7% in “Policy” declines

Choosing the Right Solution

The right approach depends on your business model and strategy. Some merchants may prioritize the protection that comes with issuer liability shift, while others may focus on keeping checkout as frictionless as possible or having more customization over fraud rules. The table below compares PayPal’s fraud and authorization tools, highlighting the capabilities they share and the unique benefits each provides.

How They Work

  1. 3DS Data Only

    • What it does: Leverage your existing 3DS framework to pass enriched transaction data to PayPal. PayPal will then real-time inject customized data directly to the Issuer authentication network in their preferred format, supporting higher Issuer approval rates.
    • How it works: 3DS Data Only uses advanced algorithms to assess transaction risk by sharing data between the business and the card issuer, including purchasing history, device ID, and behavior patterns. Authentication is handled in the background, without the need for shoppers to interrupt their checkout process.

  2. Chargeback Protection

    What it does: AI driven Chargeback Protection decisions risk on your behalf with full authorization and dispute reporting visibility via a merchant dashboard. Similar to 3DS, as PayPal is decisioning the risk if any disputes or chargebacks do result, PayPal will waive fees up to a % of monthly transaction volume.

    How it works: PayPal’s AI driven fraud intelligence and mitigation tools use digital identifiers to recognize customers and decades of learnings from suspected fraud events across its dual sided network to decision risk. No filter management or manual trend analysis required. Instead, your teams can focus on growing your business and serving customers.

    Learn More: https://www.paypal.com/us/cshelp/article/what-is-chargeback-protection-help608

  3. Fraud Protection Advanced

    • What it does: Fraud Protection Advanced supercharges your fraud strategy with AI driven fraud analysis within an intuitive dashboard, real time risk recommendations, custom fields, A/B testing and more. Allowing you to mitigate fraud, reduce dispute loss downstream and incrementally increase authorization rates.
    • How it works: PayPal’s AI driven fraud intelligence and mitigation tools use digital identifiers to recognize customers and decades of learnings from suspected fraud events across its dual sided network to decision risk. Fraud Protection Advanced decisions risk before they are sent to the Issuer, ensuring healthy traffic is being shared which incrementally helps to increase authorization rates, while helping to reduce fraudulent transactions and disputes downstream.

Related content

The content of this article is provided for informational purposes only. You should always obtain independent business, tax, financial, and legal advice before making any business decision.

If you accept cookies, we’ll use them to improve and customize your experience and enable our partners to show you personalized PayPal ads when you visit other sites. Manage cookies and learn more