3DS authenticated transactions add a stronger authentication step that helps reduce card not present fraud, while non-3DS transactions lack that added verification layer. The article states that non-3DS transactions have twice as much CNP fraud as 3DS authenticated transactions. For merchants, the trade-off is clear: stronger authentication can reduce abuse, but may also introduce more friction.
How 3DS Changes the Fraud Picture for Card-Not-Present Payments
The key difference is that 3DS authenticated transactions add a payer verification step before the authorisation decision, so the transaction carries stronger evidence that the cardholder was involved. For fraud teams, that changes the expected loss profile: it can reduce unauthorised card-not-present abuse, but it can also shift the customer experience toward more challenge events and abandoned checkouts. The distinction matters because fraud risk is not just about whether a payment succeeds, but about how confidently the merchant can trust the transaction.
That trust signal is why 3DS is usually treated as a risk-reduction control rather than a universal guarantee. A 3DS flow can still be abused through account takeover, phishing, or manipulated enrolment conditions, and some non-3DS payment flows remain legitimate low-friction options where the merchant accepts the residual exposure. For background on how authentication and control objectives are structured in broader security practice, NIST Cybersecurity Framework 2.0 is a useful reference, even though it is not payment-specific. In practice, many teams discover the fraud impact of weaker authentication only after chargeback patterns and authorisation losses have already started to diverge.
What Changes Operationally When 3DS Is Present
In operational terms, 3DS changes both the fraud signal and the checkout flow. The merchant, issuer, and card network gain an additional assertion about the transaction, which can improve confidence in the “customer present” claim for remote purchases. That does not remove fraud, but it changes where the risk sits. Instead of relying only on card data, device context, velocity checks, and downstream dispute handling, the merchant can use authenticated transactions as part of a layered decision model.
For fraud teams, the practical question is not whether 3DS is “better” in the abstract, but where it should be used. High-risk baskets, unusual shipping destinations, first-time buyers, and geographies with elevated abuse often justify stronger step-up treatment. Lower-risk repeat customers may tolerate a lighter path if the business accepts the residual fraud exposure. The implementation challenge is balancing conversion against protection, because too much friction can suppress legitimate sales while too little leaves the merchant exposed.
- Use 3DS as a trust signal, not as a substitute for fraud monitoring.
- Compare fraud rate, approval rate, and checkout abandonment together rather than in isolation.
- Treat chargeback reductions and customer friction as linked outcomes, not separate metrics.
- Keep issuer response, exemption handling, and dispute trends under review so the control does not become stale.
Where this breaks down is in environments with weak identity assurance upstream, poor fraud telemetry, or transaction mixes that are too diverse for a single authentication policy to perform well.
When the Difference Matters Most, and When It Does Not
Tighter authentication often increases friction, so organisations have to balance fraud reduction against conversion loss and support overhead. The distinction between 3DS and non-3DS is most meaningful when card-not-present fraud is a material cost driver, when disputes are frequent, or when the merchant needs stronger liability or evidence positioning. It is less meaningful in low-risk, low-value, or highly trusted transaction paths where the business has already accepted the residual exposure.
One common mistake is to treat all non-3DS payments as equally risky and all 3DS payments as equally safe. That is not how fraud risk behaves in practice. The real edge cases are hybrid: compromised accounts, legitimate customers using weak devices, fallback flows after authentication failure, and cross-border transactions where issuer behaviour changes. Industry guidance is not fully uniform on how aggressively to push 3DS in every segment, so the right policy often depends on the merchant’s fraud model, customer base, and tolerance for checkout friction. The more valuable question is whether the authentication step is reducing net loss after the cost of added abandonment is included.
For teams comparing options, the meaningful decision is not “3DS or no 3DS” in the abstract, but which transaction classes deserve stronger authentication and which can remain on a lower-friction path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the technical controls, while PCI DSS v4.0 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 6 — Access Control Management | 3DS adds stronger access verification for remote card payments. |
| Recommendation — Apply Control 6 to strengthen authentication paths for higher-risk payment flows. | ||
| NIST CSF 2.0 | PR.AC-7 — Users, Devices, and Other Assets Are Authenticated and Authorized | 3DS is an authentication control that changes trust in card-not-present transactions. |
| RS.MA-1 — Incident Management | Fraud outcomes should be tracked as part of response and measurement. | |
| Recommendation — Use PR.AC-7 to require stronger authentication where payment risk justifies it. Track fraud and dispute trends so payment controls can be tuned against real loss. | ||
| PCI DSS v4.0 | 8 — Identify Users and Authenticate Access to System Components | Payment fraud risk is directly tied to authentication strength in card transactions. |
| Recommendation — Align payment authentication decisions with PCI DSS authentication requirements. | ||
Practitioner Guidance
What to verify: Measure 3DS outcomes by fraud loss, approval rate, and abandonment together. A control that lowers chargebacks but depresses conversion may still be the wrong choice for some merchant segments.
Decision rule: Treat 3DS as a selective risk control for higher-exposure transactions, not as a blanket answer for every payment. If the fraud signal is weak or the customer base is highly repeat-driven, a narrower deployment is often more effective than universal enforcement.
What practitioners underestimate: The most important comparison is often not authenticated versus non-authenticated in isolation, but the quality of the fallback path when authentication fails. Weak fallback handling can erase much of the benefit.
Practitioner takeaway: The right policy is the one that lowers net fraud cost after friction, abandonment, and dispute handling are all counted together.
Related resources from NHI Mgmt Group
- What is the difference between step-up authentication and continuous fraud monitoring in digital transactions?
- What is the difference between shadow AI usage risk and non-human identity risk?
- What is the difference between single-instance SaaS and multi-tenant SaaS for CIAM?
- What is the difference between RaaS and SOAP for Workday integration in identity workflows?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
