3D Secure is becoming a core control for card-not-present fraud

At a glance

What this is: Sift argues that 3D Secure has moved from a payment safeguard to a core control for card-not-present fraud, especially where merchants must balance Strong Customer Authentication with conversion.

Why it matters: This matters because identity and fraud teams need to govern authentication signals, exemptions and challenge paths as part of payment risk, not treat 3D Secure as a static checkout add-on.

By the numbers:

• Remote-purchase fraud cost UK businesses over £722 million in 2024, according to Sift.

Context

Card-not-present fraud is a governance problem as much as a checkout problem. When the cardholder is not physically present, the merchant has to rely on authentication, risk signals and exception handling to decide whether a payment should be approved, challenged or declined. For UK merchants, that decision path sits at the intersection of payment fraud, customer experience and regulatory compliance.

3D Secure matters because it turns payment authentication into a risk-based control rather than a fixed password prompt. The article shows that this control is evolving toward richer data, frictionless approval and stronger step-up methods, which means fraud teams, payments teams and identity practitioners all need to manage the policy logic behind it, not just the payment gateway settings.

Key questions

Q: How should merchants govern 3D Secure exemptions without creating fraud gaps?

A: Merchants should treat exemptions as a controlled policy layer, not a convenience setting. Set clear thresholds for low-value, recurring and whitelisted transactions, then review whether each exemption improves approval rates without increasing chargebacks or fraud. The right balance is based on measured outcomes, not checkout speed alone.

Q: Why do card-not-present payments still need step-up authentication?

A: Card-not-present payments lack the physical and visual checks that exist in store, so the issuer has to infer legitimacy from context. Step-up authentication helps when risk signals are weak or inconsistent, because it adds higher-confidence proof before the transaction is approved. Without it, fraudsters can exploit thin evidence and legacy flows.

Q: What breaks when 3D Secure challenge flows are too aggressive?

A: Overly aggressive challenge flows increase abandonment, frustrate legitimate customers and can reduce completed sales even when fraud is falling. The control fails when every transaction is treated as suspicious, because authentication becomes a friction event instead of a risk decision. Effective tuning keeps step-up focused on the transactions that actually need it.

Q: Which matters more for payments teams, fraud reduction or customer friction?

A: Neither can be optimised in isolation. Fraud reduction that drives excessive friction can push customers away, while frictionless checkout without enough risk analysis increases loss exposure. Payments teams need a policy that measures approval rate, challenge rate, chargebacks and abandonment together, then adjusts authentication accordingly.

Technical breakdown

How 3D Secure uses risk-based authentication data

3D Secure 2.x works by sending transaction context from the merchant to the card issuer so the issuer can decide whether to approve silently or trigger a challenge. That context can include device signals, transaction history, location and behavioural patterns, which lets the issuer score risk before authorising the payment. This is not just a frontend prompt. It is a federated decision flow across issuer, acquirer and scheme infrastructure, with the issuer making the final authentication decision based on the evidence supplied.

Practical implication: merchants need to treat the quality of transaction data as part of their fraud control design, not a technical afterthought.

Why exemptions and challenge flows need policy governance

3D Secure is most effective when merchants can tune when to use frictionless approval, when to invoke challenge flows and when to apply exemptions such as low-value or recurring payments. Those decisions are operational policy choices, not one-time configuration settings. If exemptions are too broad, fraud exposure increases. If challenges are too frequent, abandonment rises and legitimate revenue is lost. The control therefore depends on calibrated rules, evidence trails and ongoing review of approval, challenge and chargeback outcomes.

Practical implication: teams should govern exemption logic as a live policy with thresholds, auditability and regular performance review.

Passkeys, delegated authentication and the next 3DS model

The article points to a shift away from static codes toward app-based approval, biometrics and passkey-style authentication. Secure Payment Confirmation, built on FIDO2/WebAuthn, reduces reliance on one-time passwords and makes challenges device-bound. Delegated authentication also changes the trust model by allowing some merchants or wallets to authenticate returning users directly. That makes 3DS less like a single protocol screen and more like a flexible identity workflow that can move between bank-led and merchant-led experiences while preserving liability shift.

Practical implication: payments and identity teams should plan for multiple authentication paths rather than assuming one universal challenge experience.

Threat narrative

Attacker objective: The attacker aims to authorise fraudulent online purchases while avoiding step-up authentication and shifting loss onto the merchant or issuer.

1. Entry occurs when a criminal submits card-not-present transactions without the physical card or cardholder present, relying on weak checkout controls or stolen payment details.
2. Credential or identity abuse follows when the fraudster attempts to satisfy authentication with contextual signals, exemptions or legacy flows that the issuer or merchant accepts as low risk.
3. Impact is fraudulent authorisation, chargeback exposure and revenue loss, especially where merchants fail to tune challenge logic and exemption governance.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

3D Secure is now a governance control, not a checkout feature. The article makes clear that the value of 3DS depends on how well merchants govern risk signals, exemptions and challenge logic. That shifts the control from a payment plugin to a policy decision point that sits between fraud prevention and customer friction. For practitioners, the meaningful question is whether authentication policy is being actively governed or simply left to default settings.

Card-not-present fraud exposes an identity assurance gap, not just a payment gap. In online card flows, the merchant is rarely verifying a person directly. It is relying on the issuer to infer legitimacy from behavioural and contextual evidence, which means identity confidence is probabilistic and negotiable. Transaction assurance gap: when that evidence is too thin or too loosely governed, the control degrades into either false declines or preventable fraud. Practitioners should treat the gap as a measurable control weakness.

Frictionless approval and step-up authentication must be managed as a pair. Security programmes often treat customer friction as the enemy and fraud reduction as the objective, but the real control plane is the trade-off between them. The article’s emphasis on richer data, exemptions and newer challenge methods shows that 3DS governance is increasingly about precision, not maximum challenge rates. For payment and identity teams, the outcome to manage is not authentication volume but authentication quality.

Passkeys and delegated authentication will force merchants to rethink who owns trust. As 3DS moves toward biometric and device-bound approval, the trust anchor shifts across issuer, merchant and wallet. That has implications for fraud accountability, audit trails and incident investigation because the authentication decision may no longer sit in one obvious control point. Practitioners should map where trust is established, where it is delegated and what evidence survives each step.

Payment fraud controls are converging with identity governance. The article shows why transaction context, challenge orchestration and exemption policy are now part of the same control conversation as identity assurance. That matters because teams managing IAM, fraud and payments can no longer optimise these layers independently without creating blind spots. Practitioners should align fraud, identity and checkout governance around a shared authentication policy model.

What this signals

Transaction assurance gap: the article’s core lesson is that online card payments depend on confidence built from context, not certainty built from presence. That means payment, fraud and identity teams need shared governance over the signals that feed challenge decisions, especially as passkeys and delegated authentication reshape how proof is established.

Merchants that treat 3D Secure as a binary compliance checkbox will miss the real operational question: which transactions deserve silent approval, which deserve step-up and which should be exempted under tightly governed rules. The control has to be tuned continuously because fraud patterns, customer behaviour and authentication methods all change together.

For practitioners

• Tune exemption rules as policy, not default behaviour Set explicit thresholds for low-value, recurring and whitelisted transactions, then review how each exemption affects approval rates and fraud losses.
• Improve transaction data quality for issuer risk scoring Send device, account and behavioural context consistently so frictionless decisions are based on enough evidence to reduce unnecessary challenges.
• Test fallback paths for unsupported cards and edge cases Validate older 3DS versions, non-authenticated authorisations and retry logic so checkout does not fail silently for customers on legacy cards.
• Track challenge, approval and chargeback outcomes together Use one operational view to see whether authentication policy is reducing fraud without creating excessive abandonment or false declines.

Key takeaways

• Card-not-present fraud is still a major exposure for UK merchants, and 3D Secure has become the main control used to reduce that risk in online card payments.
• The practical issue is not whether 3D Secure exists, but whether exemption policy, challenge logic and transaction data are governed well enough to balance fraud loss and checkout friction.
• As passkeys and delegated authentication mature, payments security is becoming an identity governance problem as much as a payment-processing one.

Key terms

• Card Not Present Fraud: Card Not Present Fraud is payment fraud that happens when a card is used without the physical card being present. It typically occurs in online, mobile, mail order, or phone transactions, where attackers rely on stolen card data, account takeover, or social engineering to bypass authentication and complete unauthorized purchases.
• Strong Customer Authentication: A regulated authentication requirement that demands more than a single password or code. Under PSD2, it requires at least two factor types and must support the payment context, so the approval is tied to the specific transaction rather than a reusable login event.
• Frictionless authentication: An authentication experience designed to reduce user burden while preserving security controls. In practice, it depends on enrollment, recovery, support, and reporting workflows that users can actually complete without bypassing policy or calling for unsafe exceptions.
• Step-up Authentication: Step-up authentication is an additional verification step triggered when a session becomes higher risk or a user attempts a sensitive action. It is used to reduce exposure without forcing extra friction across every interaction, which makes it useful for runtime access governance.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners working across identity-led controls. It is a fit for security teams that need a stronger governance model for trust, authentication and lifecycle control.