3DS 2.0 Enabling Frictionless Authentication Without Compromising Security

For over two decades, the 3D Secure protocol has added an extra layer of protection to online card-not-present transactions.

It has also kept merchants safe from fraudulent chargebacks by checking the cardholder’s identity at the time of payment through the issuing bank.

Even though it protects both merchants and customers, the procedure has led to a love/hate relationship between users and the 3DS protocol.

The Problems with 3DS 1.0

3DS 1.0 added security but it also added friction. Customers were often redirected to a separate authentication page. This broke the checkout flow. Plus, it created confusion.

Many users did not recognize the issuer’s authentication screen. Some assumed it was a phishing attempt. Trust dropped at the worst possible moment: payment.

The experience was not built for mobile. Layouts were not responsive. Moreover, authentication pages loaded poorly on smartphones. The process was the same for most transactions.

• Low-risk payments were treated like high-risk ones. 
• There was limited risk-based intelligence.
• Data sharing was minimal
• Issuers had fewer data points to assess transaction risk.

This led to more step-up authentication than necessary.

The result?

• Higher cart abandonment.
• Lower conversion rates.
• A checkout experience that felt interrupted and outdated.

Security was strong but the user experience suffered.

The Solution is 3D Secure 2.0

EMVCo addressed these issues with the introduction of 3DS 2.0. The updated protocol includes mobile SDKs, allowing merchants to embed authentication directly into their apps rather than redirecting users. It also supports non-payment authentication use cases and aligns with PSD2 Strong Customer Authentication (SCA) requirements.

What is Risk-Based Authentication?

Risk-based authentication is the process of evaluating how risky a transaction is before deciding whether additional verification is required.

3D Secure 2.0 improves risk-based authentication by enabling the exchange of significantly more data during a transaction. This includes device information, transaction history, customer behavior patterns, and other contextual details.

The issuer uses this additional data to determine whether the transaction can be approved frictionlessly or if step-up authentication is necessary.

If the issuer detects that a user with no transaction history is using a new card, it may classify the transaction as high risk and trigger authentication.

On the other hand, if the card is already on file and the customer has a consistent purchase history, the transaction may be approved without additional verification.

Risk-based evaluation typically considers factors such as:

• Transaction value
• Customer tenure (new or existing)
• Transaction history
• Behavioral patterns
• Device information

By analysing these variables in real time, 3DS 2.0 ensures that authentication is applied only when the risk justifies it.

How Does this Promote Frictionless Flow?

So, the question is, how does 3DS2.0 promote frictionless transaction flows? It does so through many layers.

3DS 2.0 vs 3DS 1.0 – Quick Comparison

Here is a quick comparison to help you understand better: 

3DS 1.0

• Redirect-based
• Poor mobile support
• Limited data sharing
• Static authentication
• Higher friction

3DS 2.0

• In-app authentication
• Mobile SDK support
• 100+ data elements
• Risk-based decisions
• Frictionless flow possible

Conclusion

3DS 2.0 changes the balance between security and convenience. It protects payments. But it does not interrupt every transaction.

Low-risk purchases move smoothly. High-risk ones get stronger checks.

Customers see fewer unnecessary challenges and merchants see fewer drop-offs. It also supports modern regulatory requirements like PSD2 SCA.

In today’s checkout experience, speed matters. So does trust. And 3DS 2.0 delivers both.