The 3D Secure liability shift moves responsibility for a fraudulent online card transaction from the merchant to the card-issuing bank, but only when the transaction was properly authenticated under 3DS2, only for fraud-type chargebacks, and only if the merchant can produce the authentication data when the dispute arrives. Miss any of those conditions and the loss stays with the merchant.
Since Visa and Mastercard discontinued support for the original 3DS1 protocol in October 2022, only 3DS2 authentication carries the shift today.1Visa. Visa Will Discontinue Support of 3-D Secure 1.0.2 If you are still running a legacy integration, you get no protection at all.
Which Authentication Outcomes Actually Shift Liability
Not every 3DS attempt produces a shift. What matters is the authentication status the issuer returns and the Electronic Commerce Indicator (ECI) value that goes with it.
Fully Authenticated
When the issuer confirms the cardholder’s identity, the transaction comes back as fully authenticated. Visa marks this ECI 05; Mastercard uses ECI 02. The merchant did everything required, the issuer verified the customer, and fraud liability sits with the issuer.
Attempted Authentication
Sometimes the issuer does not participate or its system is unavailable. The transaction then comes back as attempted (ECI 06 for Visa, ECI 01 for Mastercard), and the liability still shifts because the merchant did its part.2Mastercard Payment Gateway Services. Liability Shift With 3-D Secure American Express applies the same principle for SafeKey: issuers that do not support the program may still bear fraud liability on an attempted transaction.3American Express. SafeKey 2.0 Frequently Asked Questions
Frictionless Flow Still Counts
A frictionless authentication, where the issuer approves silently without challenging the cardholder, still carries the shift. The issuer evaluated the risk and decided no challenge was needed, and the resulting approval is treated as a fully authenticated 3DS2 transaction.
The Exemption Trap
There is one easy way to lose the shift on a transaction you thought was protected. If the merchant or acquirer explicitly requests an SCA exemption and the issuer grants it, liability stays with the merchant. The issuer silently approving a frictionless flow on its own initiative is a different thing from the merchant asking to skip authentication. Only when the issuer independently applies an exemption does the issuer keep the liability.
What the Shift Does Not Cover
The protection is narrower than many merchants assume. It applies to fraud chargebacks and nothing else.
Non-Fraud Chargebacks
3D Secure gives you zero protection against disputes for items not received, goods that do not match the description, duplicate charges, or processing errors. The authenticated cardholder really did place the order; the issue is fulfillment or merchant conduct, not identity theft. Defend these the usual way, with tracking data, delivery confirmation, and refund records.
Recurring and Merchant-Initiated Charges
Subscription renewals, installments, and other charges the merchant initiates after signup generally do not carry the shift.4Elavon. 3RI Overview The cardholder is not present, so there is no one to authenticate. The original signup transaction can be authenticated and shifted; the automated billings after it cannot.
Mail and Telephone Orders
MOTO transactions happen outside the web-based environment that 3DS requires, so the shift does not apply to them.
The Evidence You Must Capture
When a fraud chargeback hits an authenticated transaction, winning the dispute is almost entirely about producing the technical data that proves authentication occurred. Four fields matter:
- Electronic Commerce Indicator (ECI), which shows the authentication outcome. ECI 05 (Visa) or 02 (Mastercard) means fully authenticated.
- Cardholder Authentication Verification Value (CAVV), a cryptographic value generated during authentication. Without it, there is no proof authentication actually happened.
- Directory Server Transaction ID (dsTransID), the unique identifier for the 3DS2 authentication session. The older XID field from 3DS1 is no longer in use.
- Transaction timestamp, tying the authentication to the specific purchase.
Capture and store all four at the time of every transaction. When a dispute comes in, your acquirer forwards the data to the network to enforce the shift. Visa gives merchants 30 days to respond with evidence,5Visa. Visa Claims Resolution – Efficient Dispute Processing for Merchants and Mastercard runs on a similar timeline. Payment processors often impose tighter internal deadlines, so build in a buffer.
The most common way merchants lose winnable disputes is simply failing to log the authentication data at the time of the sale. Once it is gone, it is gone. No reconstruction will replace a missing CAVV. Make the capture automatic in your payment flow.
How Fraud Programs Can Take the Shift Away
Here is the surprise for merchants with elevated fraud rates: the networks can revoke liability shift protection entirely, even on transactions that were properly authenticated.
Visa’s Fraud Monitoring Program (VFMP) flags merchants whose fraud activity exceeds network thresholds. Once a merchant is in the program, Visa allows issuers to recover fraud losses through dispute condition 10.5, which overrides the standard 3DS liability shift. The override applies for every month the merchant stays in the program and continues for three months after the merchant stops processing.6Visa. Updates to Visa Fraud Monitoring Program Standard Timeline and Dispute Condition 10.5 Liability Shift Rules
Mastercard’s Excessive Fraud Merchant program flags merchants who, in a single month, cross all of the following lines: at least 1,000 Mastercard transactions, at least $50,000 in fraud chargebacks under reason codes 4837 and 4863, a fraud-to-sales ratio of 0.50% or higher, and 3DS processing volume below 10% in non-regulated countries (or below 50% in regulated ones). Monthly fines escalate from $500 in month two to $100,000 by month 19. To exit, a merchant must stay below every threshold for three consecutive months.
3DS is not a blank check. The networks treat it as one piece of a broader fraud management obligation, and merchants who lean on the shift while ignoring their fraud metrics eventually lose both.
Dispute Codes by Network
The core concept is consistent across networks, but the chargeback paperwork is not. If you process on multiple networks, know where each one files its fraud disputes.
Visa routes fraud-related card-not-present disputes under dispute condition 10.4.7Visa. Introduction of Monitoring Rule for Dispute Condition 10.4 A successful 3DS2 authentication stops the issuer from pushing those losses back through chargeback. Condition 10.5, the fraud-program override, is the separate carve-out described above.
Mastercard applies the same protection for reason code 4837 (no cardholder authorization) and reason code 4863 (cardholder does not recognize the transaction), which together account for most online fraud claims.8Mastercard. Chargeback Guide
American Express handles authentication through its SafeKey program, built on the EMV 3DS protocol. Confirmed authentication shifts fraud liability to the issuer, and attempted transactions can also qualify when the issuer does not support SafeKey. Amex expects merchants to keep fraud rates low and meet SafeKey’s data quality requirements to stay eligible.3American Express. SafeKey 2.0 Frequently Asked Questions Discover offers 3DS under the ProtectBuy brand and integrates through the same standard infrastructure.9Discover Global Network. 3DS ProtectBuy
Selling to European Cardholders
PSD2’s Strong Customer Authentication mandate primarily applies when both the acquirer and the issuer are based in the European Economic Area. If you are a U.S. merchant selling to European cardholders, the regulation technically does not apply because only one side of the transaction is in the EU. Many European issuers will decline unauthenticated transactions anyway, so implementing 3DS2 is often necessary just to get the sale through.
PSD2 also recognizes exemption categories. Low-value transactions under €30, and transactions cleared through transaction risk analysis up to €100, €250, or €500 depending on the acquirer’s fraud rate, can qualify.10Mastercard. PSD2 SCA Compliance and Exemptions The same rule from earlier applies: if the merchant or acquirer requests the exemption and the issuer grants it, the merchant keeps the fraud risk. If the issuer applies the exemption on its own, the issuer keeps the liability.