3DS authenticated transactions add a stronger authentication step that helps reduce card not present fraud, while non-3DS transactions lack that added verification layer. The article states that non-3DS transactions have twice as much CNP fraud as 3DS authenticated transactions. For merchants, the trade-off is clear: stronger authentication can reduce abuse, but may also introduce more friction.
Why 3DS Changes Fraud Risk More Than It Changes the Payment Itself
3DS adds an authentication step that changes the merchant’s fraud exposure profile, especially for card-not-present transactions. The key difference is not just whether a payment is approved, but whether the issuer has stronger evidence that the cardholder was involved. That shifts the risk balance toward lower fraud, but it can also increase checkout friction and abandonment.
For fraud teams, the practical question is whether the extra step is worth the reduction in abuse for the specific customer segment, cart size, and market. NHIMG’s Payment Fraud Guide is useful here because it places 3DS alongside other payment-fraud controls, including card-not-present fraud patterns, exemptions and liability shift.
Where 3DS and non-3DS Transactions Diverge Operationally
With 3DS authenticated transactions, the issuer can apply an authentication flow that helps separate legitimate cardholder activity from unauthorised use. Non-3DS transactions skip that extra verification layer, so the merchant relies more heavily on device signals, velocity checks, behavioural signals and post-transaction review to catch fraud.
That operational difference matters because fraud prevention is not only about stopping theft, it is also about reducing false approvals and limiting downstream chargebacks. In practice, 3DS is one control in a wider stack, not a substitute for risk scoring or order-level monitoring. Fraud Prevention Guide for Digital Businesses covers how rules engines, review queues and KPIs fit around that decision.
For merchants that operate in regulated European payment flows, the authentication step also sits close to the logic of strong customer authentication. PSD2/PSD3 Strong Customer Authentication Guide explains how exemptions, transaction risk analysis and audit evidence affect whether 3DS is used or bypassed.
What the Fraud Team Should Compare Before Treating the Two Flows as Equivalent
3DS and non-3DS transactions should be compared on fraud loss, approval rate, conversion impact and chargeback burden, not on fraud reduction alone. A transaction that is less exposed to card-not-present fraud may still perform worse overall if authentication prompts cause too many good customers to drop out.
The right comparison is segment-specific. High-risk baskets, first-time customers, unusual geographies and high-value orders often justify stronger authentication, while low-risk repeat customers may warrant a lighter touch. Fraud teams should also track whether non-3DS exposure is being shifted into manual review or post-settlement recovery rather than truly reduced.
The broader control choice belongs inside a disciplined fraud programme, not just at the checkout rule level. Fraud Prevention Maturity Model helps benchmark whether the organisation is measuring effectiveness, friction and loss together.
Risk and Threat Considerations
Non-3DS flows are more exposed to card-not-present abuse because the merchant has less authentication evidence at the point of sale. That creates a clearer path for stolen-card use, account takeover follow-on activity and chargeback losses, especially where other risk signals are weak or inconsistent.
Failure mechanism: Fraudsters exploit the weaker verification path in non-3DS transactions, then convert successful authorisations into disputes, refunds or repeated testing of stolen payment data.
Impact: Merchants can see higher fraud loss, more chargebacks, more manual review load and a higher chance that good customers face broad friction later in the funnel.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V10 — OAuth and OIDC | 3DS-related auth flows rely on strong identity assurance patterns. |
| Recommendation — Apply V10 to ensure payment authentication flows resist interception and abuse. | ||
| NIST SP 800-63 | AAL2 — Authenticator Assurance Level 2 | 3DS is an authentication-strength comparison that mirrors assurance trade-offs. |
| Recommendation — Use AAL2-type assurance targets to balance stronger authentication with checkout friction. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Fraud controls intersect with application flow design and verification logic. |
| Recommendation — Review payment flows for authentication checkpoints and abuse-resistant transaction handling. | ||
Practitioner Guidance
What to verify: Check whether 3DS is being applied where it most changes outcome, high-risk segments, suspicious geographies, unusual order values and first-time checkout attempts. The useful test is whether 3DS materially reduces fraud without suppressing acceptable conversion in that segment.
Decision rule: If the business can tolerate some friction, prioritise 3DS for the orders most likely to produce fraud or chargebacks. If conversion is highly sensitive, use targeted authentication and stronger post-auth controls rather than forcing every transaction through the same flow.
Practitioner takeaway: Treat 3DS as a risk-selection control, not a blanket guarantee, and judge it by the combined effect on fraud loss, approval rate and customer abandonment.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org