In this guide · 7 sections
Short answer
3D Secure (3DS) asks the card issuer to confirm the buyer is the cardholder, usually by app approval or one-time code. If it succeeds, liability for fraud chargebacks typically shifts to the issuer. It does not cover "item not received" disputes. Use it on risky payments rather than every order.
What 3D Secure is, in plain English
3D Secure is a protocol run by the card networks. Stripe's 3DS documentation describes it as an added security layer that verifies the person making a purchase is the legitimate cardholder. When it is triggered, the issuing bank may ask the cardholder to authenticate with a password, a one-time code or biometrics. Customers know it as Visa Secure, Mastercard Identity Check or American Express SafeKey.
There are two ways it can play out:
- Frictionless flow: the issuer checks the data silently and approves without asking the customer anything.
- Challenge flow: the customer has to approve in their banking app or enter a code before the payment goes through.
In Europe, the UK, India, Japan and Australia, rules such as Strong Customer Authentication can make 3DS mandatory. Stripe notes it is optional in other regions, where you can use it to reduce fraud. Card issuers can also demand it for a specific payment by returning a soft decline.
The liability shift: what it covers and what it does not
This is the main business reason to use 3DS. Stripe's authentication flow page says that if a cardholder disputes a successfully authenticated 3DS payment as fraudulent, liability typically shifts from you to the card issuer. In practice you usually will not receive fraud-coded chargebacks on those payments.
| Situation | Liability shift? |
|---|---|
| 3DS succeeded, customer later claims the payment was fraud | Usually yes |
| Card does not support 3DS, or an error occurred, and the payment went through | Generally no |
| Network required 3DS but the issuer's 3DS service was unavailable | Can still shift |
| 3DS succeeded, customer says item not received or not as described | No; normal dispute process |
| Merchant in a card network fraud monitoring programme | May be lost |
Shopify's PSD2 and 3D Secure page adds that issuers can remove liability shift protection if a merchant has too many chargebacks, giving Visa's example of more than US$7,500 in fraudulent chargebacks in one month. For the full dispute process, see our Stripe dispute and chargeback guide.
Does 3D Secure reduce sales?
It can. Every challenge is a moment where a customer can fail, give up or get distracted. Stripe's Radar rules documentation says plainly that indiscriminate use of 3DS might lower conversion rates. Shopify says Shopify Payments is optimised to minimise 3DS and only uses it when the issuing bank requires it.
The balance depends on what you sell:
Request 3DS more often if
- You sell high-value or easily resold goods (electronics, gift cards, luxury items)
- You ship overseas to addresses you cannot verify
- You have already had fraud chargebacks
- Orders are large compared with your margin
Keep 3DS to a minimum if
- Orders are small and repeat customers dominate
- You sell services or bookings that are hard to resell
- Fraud chargebacks are rare for you
- Checkout drop-off is already a problem
A common middle ground is to request 3DS only on new customers, high-risk payments or orders above a set amount.
3D Secure settings in Stripe
Stripe already triggers 3DS when regulation requires it, when an issuer asks for it, or when certain Stripe optimisations apply. You can add your own triggers on top.
Check your Radar plan
Stripe's Radar pricing page lists Radar Lite at no extra charge on standard pricing, Radar Standard at S$0.08 and Radar Plus at S$0.10 per screened transaction (as of October 2026). Custom rules and adaptive 3DS need Radar Plus.
Decide when to request 3DS
Stripe's own examples include requesting 3DS for new customers, or when the Radar risk level is elevated and the amount is above a threshold such as US$25.
Add a matching block rule if needed
If you want to stop risky payments that cannot do 3DS, add a block rule. Stripe recommends not blocking wallets such as Apple Pay or Google Pay, which do not use 3DS in the same way.
Test before going live
Use Stripe's 3DS test cards in a sandbox to see both the challenge and frictionless flows on your checkout.
Watch results for a month
Compare checkout completion and fraud disputes before and after. Loosen or tighten the rule based on what you see.
Developers can also force 3DS per payment with the request_three_d_secure parameter (any or challenge). Most small shops are better off with Radar rules. See our Stripe fees guide for the wider cost picture.
Shopify Payments, HitPay and other gateways
Shopify Payments: Shopify says that if you use Shopify Payments or Stripe as your gateway, you are automatically using a 3D Secure checkout flow. It applies 3DS only when the issuing bank requires it. For extra control over risky orders, use Shopify's fraud analysis and review orders before fulfilling them.
HitPay: HitPay's public documentation, as checked in October 2026, does not describe a merchant setting for 3DS. Ask HitPay support how 3DS and liability shift apply to card payments on your account before relying on it. Our Shopify Payments vs HitPay comparison covers the other differences.
PayNow and wallets: PayNow transfers are authorised in the customer's own banking app and are not card payments, so 3DS and card chargebacks do not apply. Apple Pay and Google Pay use their own device authentication; Stripe notes they can sometimes carry a liability shift too.
Do it yourself or get help?
On Shopify Payments there is little to configure: 3DS is automatic. On Stripe, the default behaviour is a sensible start, and adding one or two Radar rules is a short job if you have Radar Plus. The harder part is choosing thresholds from your own order and dispute data.
3D Secure check-up
Our Online Payment Setup package (S$290) sets up Stripe or HitPay on your site, including fraud and 3DS rules suited to what you sell.
Frequently asked questions
Stripe's documentation says 3DS is required by regulation in places such as the European Economic Area, the UK, India, Japan and Australia, and is optional in other regions, where it is used to reduce fraud. Card issuers, including those in Singapore, can still require it on a specific payment, and gateways then trigger it automatically.
No. A successful 3DS authentication usually shifts liability for fraud-related disputes to the card issuer. Disputes for other reasons, such as product not received, not as described or cancelled subscriptions, follow the normal dispute process, and you must still respond with evidence. Liability shift is also not guaranteed for every payment.
Many 3DS checks use a frictionless flow, where the issuer approves based on data it already has without asking the customer anything. Some cards are not enrolled in 3DS, some payments are exempt, and wallets such as Apple Pay use their own authentication. Off-session payments such as recurring subscription charges often do not use 3DS.
You can request 3DS on payments using Radar rules or the request_three_d_secure API parameter, but custom Radar rules need Radar Plus. Stripe warns that requesting 3DS on every payment can reduce conversion. A rule for new customers, high-risk payments or larger amounts is usually a better balance.
Yes. Shopify's help centre says stores using Shopify Payments or Stripe automatically use a 3D Secure checkout flow. Shopify Payments is optimised to use 3DS only when the customer's issuing bank requires it, so most customers never see a challenge. Successfully authenticated payments are covered by the liability shift.