3D Secure 2 and SCA under PSD2: exemptions, liability shift and conversion

What is 3D Secure 2 and how does it relate to SCA?

Strong customer authentication is a legal requirement: under PSD2, a payment initiated by the payer online must be confirmed with two independent factors, and the authentication code must be dynamically linked to the amount and the payee. 3D Secure 2 is the technical standard, maintained by EMVCo, that card networks use to meet it. Shoppers see it under scheme brands such as Visa Secure, Mastercard Identity Check, American Express SafeKey and Cartes Bancaires FAST'R.

The first version of 3D Secure sent every shopper to a bank password page. Version 2 exchanges more than 100 data elements about the device, the order and the account, so the issuer can approve most payments without showing anything and reserve a challenge, usually a banking app confirmation, for risky ones. It also supports native app flows, which the old protocol did not.

What is PSD2 and what does it require of merchants?

PSD2, Directive (EU) 2015/2366, is the EU's second Payment Services Directive. It was adopted in 2015 and member states have applied it since January 2018. It regulates payment service providers rather than shops, but two of its rules shape every online checkout in the EEA: strong customer authentication and regulated access to payment accounts.

For merchants, the main requirement is SCA. The detailed rules sit in Delegated Regulation (EU) 2018/389, which has applied since September 2019: most online card payments by EEA cardholders must be confirmed with two of three factors (knowledge, possession, inherence), and card schemes meet this through 3D Secure 2. The legal obligation falls on the issuer and the acquirer, not on the shop, but the merchant carries the result: a payment the issuer declines for missing authentication is a lost sale. Exemptions such as low value, transaction risk analysis and merchant-initiated transactions, covered below, reduce how often shoppers are challenged.

PSD2 also requires banks to give licensed third parties access to payment accounts through secure interfaces, often called access to account (XS2A) or the PSD2 API. Account information services read balances and transactions with the customer's consent, and payment initiation services start a bank transfer from the customer's account. Payment initiation is what powers Pay by Bank checkouts, which are covered in our Pay by Bank guide.

PSD2 is being replaced. In June 2023 the European Commission proposed PSD3 together with a directly applicable Payment Services Regulation (PSR), which tighten fraud rules and open banking interfaces; our PSD3 guide tracks what changes for merchants. Until the new rules apply, PSD2 and the SCA RTS remain the rules your PSP follows.

When is SCA required, and which payments are out of scope?

SCA applies to electronic payments initiated by the payer when both the issuer and the acquirer are in the EEA; the United Kingdom applies the same rules through its own version of the RTS. For an EU web shop this covers nearly every first card payment, every one-off checkout and every change to a stored card mandate.

Several transaction types fall outside the obligation entirely, which is different from an exemption: no authentication is legally required, but the issuer can still decline. Flag these correctly in the authorisation message, because a wrong flag is a common cause of the soft decline "SCA required".

• Merchant-initiated transactions (MIT): subscriptions with variable amounts, delayed charges and no-shows, provided the mandate was set up with SCA
• Mail order and telephone order (MOTO) payments, where card details are not entered by the shopper online
• One-leg-out payments, where the issuer or the acquirer is outside the EEA; SCA applies on a best-effort basis
• Payments initiated by the payee from a direct debit mandate, such as SEPA Direct Debit

Which SCA exemptions can merchants use?

Exemptions are optional: the acquirer or the issuer may apply them, and the issuer always has the final word. If it refuses an exemption, it returns a soft decline (response code 1A at Visa, 65 at Mastercard) and the payment must be retried with authentication. The table summarises the exemptions in Delegated Regulation (EU) 2018/389 that matter for online sales.

Transaction risk analysis is the most valuable one for merchants with low fraud, because it covers baskets up to €500. The rate that counts is the fraud rate of the PSP that applies the exemption, calculated over 90 days, so an acquirer with a clean portfolio can request it on your behalf.

How do the frictionless flow and the challenge flow work?

The merchant's 3DS server, usually run by the PSP, sends an authentication request through the card scheme's directory server to the issuer's access control server. The issuer scores the request with the device, order and account data and answers in about a second.

If the risk is low, the payment is authenticated frictionlessly and the shopper sees nothing. Otherwise the issuer opens a challenge: a push confirmation in the banking app, a biometric check or a one-time code. Either way, the result and a cryptogram are passed to authorisation, so the issuer can see that SCA was performed.

1. Collect data The checkout gathers browser or app data, billing and shipping details and the shopper's account history.
2. Authenticate The 3DS server sends the request; the issuer replies frictionless, challenge or rejected.
3. Authorise The authentication result and cryptogram travel with the authorisation request to the issuer.

What is the 3D Secure liability shift?

When a payment is successfully authenticated with 3D Secure, the liability for fraud chargebacks, such as Visa reason code 10.4 or Mastercard 4837, moves from the merchant to the issuer. In most cases this also holds when the merchant attempted authentication but the issuer was not available.

The shift does not cover non-fraud disputes such as goods not received or not as described, and it is lost when an exemption is applied on the acquirer side: you gain conversion but keep the fraud risk. That is why merchants apply TRA selectively, for example to returning customers and low-risk baskets, and send the rest through authentication.

How does 3D Secure 2 affect checkout conversion?

Every challenge adds a step in which a shopper can abandon or fail, especially when the banking app is on another device. The EBA and the ECB reported in December 2025 that SCA-authenticated card payments remain less exposed to fraud, so the goal is not to avoid SCA but to challenge only where it pays off.

Conversion improves with complete data in the authentication request, correct transaction flags, a native app SDK instead of a web view, exemption requests through an acquirer with a low fraud rate, and an immediate retry with authentication after a soft decline. Measure frictionless rate, challenge success rate and authorisation rate per issuer country separately; one blended approval figure hides where shoppers drop out.

SCA and 3D Secure news: dated updates

Changes that affect how merchants authenticate card payments, newest first. We add entries when a regulator, EMVCo or a card scheme publishes something that changes merchant work. Last reviewed on 9 November 2026.

• 21 October 2026: the EU payment services package (PSD3 and the Payment Services Regulation) is still not formally adopted; Parliament's Legislative Observatory lists an indicative plenary date of 14 December 2026. Until the PSR applies, PSD2 and its SCA technical standards remain the law. Details in our PSD3 tracker.
• June 2026: EMVCo announced that from 1 July 2027 it will stop accepting approval test reports for 3DS products that support only protocol version 2.2.0; products must support 2.3.1 or higher. This concerns certification of 3DS components, not their use in production, and EMVCo plans to release version 2.4.0 of the specification in 2027.
• 23 April and 5 May 2026: the Council published the final compromise texts of PSD3 and the PSR, and Parliament's ECON committee approved them. The PSR keeps strong customer authentication and the card exemptions.
• 15 December 2025: the joint EBA and ECB payment fraud report found that SCA remains effective, especially for card payments. Reported fraud in the EEA reached €4.2 billion in 2024, up from €3.5 billion in 2023, and card fraud was 17 times higher when the payee was outside the EEA, where SCA is not legally required. New fraud increasingly targets exempted payments or manipulates customers into authenticating.
• 27 November 2025: the Council and the European Parliament reached a provisional agreement on PSD3 and the Payment Services Regulation.
• 24 to 30 September 2024: the card networks ended production support for EMV 3DS 2.1.0, with Visa Secure on 25 September and Mastercard Identity Check on 24 September 2024. Checkouts need 3DS 2.2.0 or later.

How do you add 3D Secure 2 through OrsunPay?

OrsunPay is a payment orchestration platform that connects you to licensed PSPs; it does not process or hold funds itself. Card details and the 3D Secure flow run with your connected PSP, so authentication, exemption requests and liability rules are those of your contract with that PSP. Smart routing and retries are live, and the RiskCogs anti-fraud module feeds risk scores and signals into routing and cascading rules, for example to retry a payment declined for missing authentication through a PSP that applies the exemptions you need.