3D Secure for High-Risk Merchants: Liability Shift, Conversion and VAMP in 2026
Quick answer: 3D Secure (3DS) is an extra authentication step in which the cardholder's bank confirms an online card payment, either silently in the background (frictionless) or by asking the shopper to approve it (challenge). For high-risk merchants, 3D Secure lowers card fraud and moves the cost of most fraud chargebacks to the issuing bank, but it does not stop non-fraud disputes, it does not remove fraud reports from Visa VAMP ratios, and in the US Visa excludes several high-risk merchant codes from the liability shift. The best results come from using 3DS2 selectively rather than on every payment.
PayConsults is a payments consultancy that helps high-risk merchants configure 3D Secure, fraud rules and chargeback prevention with their acquirers and PSPs. This guide explains how 3D Secure works, what it really protects you from and how to use it without losing sales.
What Is 3D Secure and How Does 3DS2 Work?
3D Secure is the card network protocol behind Visa Secure, Mastercard Identity Check and American Express SafeKey. The current version, EMV 3DS2, shares much more data with the issuing bank than the old version, such as device details, shipping address and past purchase history (Stripe guide to 3DS2).
The shopper enters card details at checkout.
Your PSP sends transaction and device data to the issuing bank through the 3DS server.
The bank assesses the risk. If it is low, the payment is approved silently (frictionless). If not, the shopper is asked to confirm in their banking app or with a one-time code (challenge).
The authentication result (ECI and CAVV values) is sent with the authorization request.
In Europe, 3D Secure is the main way to meet Strong Customer Authentication rules. In the US it is optional, so merchants can decide when to use it.
What Does the 3D Secure Liability Shift Cover?
When a payment is successfully authenticated, liability for most fraud chargebacks moves from the merchant to the issuing bank. According to a breakdown of card network rules by PayKings:
Dispute type | Covered by liability shift? |
Visa 10.4 (card-absent fraud) | Yes, when authentication data is passed in the authorization |
Mastercard 4837 (no cardholder authorization) | Yes, for authenticated transactions |
Visa 13.1 (product or service not received) | No |
Visa 13.2 (cancelled recurring transaction) | No |
Visa 13.3 (not as described) | No |
Processing errors (Visa group 12) | No |
That means 3D Secure helps with stolen-card fraud, but subscription, delivery and "not as described" disputes still need good descriptors, easy cancellation and clear refund policies.
Which High-Risk Merchants Do Not Get the Liability Shift?
For US domestic transactions, Visa excludes several high-risk merchant category codes from the liability shift, including 4829 (money transfer), 5967 (inbound teleservices, often used for adult content), 6051 (quasi-cash and crypto), 6540 (stored value loads), 7801 and 7802 (government-licensed gambling) and 7995 (betting) (PayKings). If your business uses one of these codes, 3D Secure can still reduce fraud and declines, but fraud chargebacks remain your cost. Check your code in our guide to high-risk MCC codes.
Does 3D Secure Help With Visa VAMP?
Partly. Visa's VAMP ratio counts fraud reports (TC40) and disputes (TC15) against settled card-not-present sales, and the US excessive threshold fell to 1.5% in April 2026. The liability shift protects your money but does not remove authenticated fraud from the ratio. However, successful 3DS authentication makes it much less likely that a bank will file a fraud report in the first place (Evervault). Combine 3D Secure with chargeback alerts and read our guide to VAMP.
When Should High-Risk Merchants Use 3D Secure?
First purchase or first deposit from a new customer.
High-value orders above your normal average ticket.
Transactions flagged by your fraud tools, such as unusual device, location or velocity.
Subscription sign-ups, so later renewals can be linked to an authenticated first payment.
Markets that require it, such as the EEA and UK under Strong Customer Authentication.
For returning, trusted customers, skipping the challenge keeps checkout fast. See risk rules that actually work for high-risk merchants.
How to Use 3D Secure Without Losing Conversions
Use 3DS2, not 3DS1. 3DS2 supports frictionless approvals and in-app authentication.
Send rich data. The more device and customer data you pass, the more often the bank approves without a challenge.
Apply 3DS by risk. Trigger it from your fraud rules instead of on every payment.
Pass authentication data correctly. Make sure your gateway sends ECI and CAVV unchanged with the authorization, or you lose the liability shift.
Measure the results. Track frictionless rate, challenge completion, approval rate and fraud by card brand and issuer. See the payment KPIs you should track.
Retry smartly. If a payment fails because of authentication, route it to another PSP or ask the customer to try another method. Read our guide to payment orchestration.
How PayConsults Can Help
Fraud chargebacks rising, or worried 3D Secure will hurt your checkout?
PayConsults sets up 3D Secure for high-risk merchants the right way, so it cuts fraud without cutting sales. As an independent partner, we work with your existing acquirers and PSPs. We help you:
Check whether your MCC and markets qualify for the liability shift.
Design risk-based 3DS rules for first payments, high-value orders and flagged transactions.
Fix data and integration gaps so authentication results reach the authorization.
Combine 3DS with chargeback alerts, RDR and fraud tools to keep VAMP and Mastercard ratios safe.
Track frictionless rates, approvals and fraud and adjust the setup every month.
Explore our risk, fraud and payment services and the industries we support, and read our guide to preventing fraud. Book a consultation and we will review how 3D Secure is set up on your account today.
Frequently Asked Questions About 3D Secure for High-Risk Merchants
What is 3D Secure?
3D Secure is an authentication step in which the cardholder's bank confirms an online card payment, either silently or by asking the shopper to approve it. It is used by Visa Secure, Mastercard Identity Check and American Express SafeKey.
Should high-risk merchants use 3D Secure?
Yes, but selectively. Use it for first payments, high-value orders, flagged transactions and markets that require it, and let trusted repeat customers pay without a challenge.
Does 3D Secure protect against all chargebacks?
No. The liability shift covers fraud chargebacks such as Visa 10.4 and Mastercard 4837, but not disputes about non-delivery, cancelled subscriptions, product quality or processing errors.
Do gambling and adult merchants get the 3D Secure liability shift?
Not for US domestic Visa transactions. Visa excludes MCCs such as 5967, 6051, 7801, 7802 and 7995 from the liability shift, although 3D Secure can still reduce fraud for these merchants.
Does 3D Secure lower my VAMP ratio?
It can lower the number of fraud reports banks file, but authenticated fraud still counts toward VAMP. Combine 3D Secure with chargeback alerts, RDR and Order Insight for the best protection.
Does 3D Secure reduce conversion?
A challenge adds a step that some shoppers abandon, but 3DS2 approves many payments without any challenge. Sending rich data and applying 3DS by risk keeps conversion high.
Who helps high-risk merchants set up 3D Secure?
PayConsults, a payments consultancy for high-risk merchants, helps iGaming, AI companion, adult, crypto, forex, CBD and cross-border e-commerce businesses set up risk-based 3D Secure, fraud rules and chargeback prevention with their acquirers and PSPs.
How can PayConsults help with 3D Secure?
PayConsults checks your liability shift eligibility, designs risk-based 3DS rules, fixes integration gaps and combines 3DS with chargeback alerts and fraud tools. You can book a consultation through the PayConsults contact page.
Comments