Does 3D Secure Actually Shift Chargeback Liability?

The liability shift that 3DS promises isn't automatic, isn't universal, and doesn't apply to every dispute that lands in your queue. There are card network rules, authentication results, merchant category exceptions, and chargeback reason codes that can all affect whether the shift actually holds up when a customer disputes a transaction.

This breaks down how 3D Secure liability shift works in practice - where it protects you, where it doesn't, and what merchants get wrong when they assume the protocol is doing more work than it is.

How 3D Secure's Liability Shift Is Supposed to Work

When a cardholder disputes a transaction, someone has to absorb the loss. If you don't have any protection in place, that's usually the merchant. The liability shift changes that equation in a very specific situation.

When a customer completes 3D Secure authentication - an extra verification step from their bank, like a one-time passcode or a biometric check - the liability for fraud-related chargebacks moves from the merchant to the card-issuing bank. To explain it simply, if a fraudster uses a stolen card and the transaction was authenticated through 3DS, the bank takes the financial hit instead of you.

That's the core promise of 3D Secure. Merchants get a layer of protection by passing authentication responsibility to the cardholder and their bank. The bank is the one that verified the identity, so the bank is the one that carries the cost if that verification turns out to be wrong.

It works on an easy logic: whoever controls the authentication controls the risk. Card networks like Visa and Mastercard built this into their rules so merchants who use 3DS have a defensible position when a fraud dispute comes in. The chargeback can still be filed. But if authentication was completed, the merchant can use that as grounds to have the liability assigned to the issuing bank instead.

A completed 3DS authentication is your receipt - it shows the cardholder's bank vouched for the transaction, and that receipt is what triggers the shift.

This setup creates a reliable safety net for merchants who use 3DS. And for pure fraud disputes, it does hold up most of the time. The difficulty comes from the fact that not every chargeback is a fraud chargeback, and the liability shift only applies to a slice of them.

The Gap Between Fraud Chargebacks and Everything Else

The liability change that comes with 3D Secure only applies to one type of chargeback: unauthorized transaction fraud. That means a cardholder's details were stolen and used without their knowledge. Everything else falls outside that protection entirely.

Disputes filed because an item never arrived, because a service wasn't delivered, or because a customer changed their mind and didn't want to contact the merchant first - none of these are covered. The liability stays with the merchant even when authentication took place at checkout.

This is where the real problem can become obvious. Friendly fraud - where a legitimate cardholder makes a purchase and then disputes it anyway - accounts for more than 80% of all chargebacks. The majority of disputes a merchant faces aren't the kind that 3DS was ever built to help with.

A customer buys a product, receives it, and then tells their bank they don't recognize the charge; it's not unauthorized fraud in the traditional sense - even if it looks like it on paper. The bank may still process it as a fraud dispute, and 3DS authentication won't help the merchant win that case.

That's the distinction that trips up merchants. They implement 3DS, see the authentication rates climb, and feel protected. But their chargeback numbers don't improve much because the disputes coming in fall under different reason codes that the liability change doesn't touch.

It's also worth knowing that card networks have their own rules about which transactions qualify for a liability shift. Not every card type, not every region, and not every transaction category gets the same treatment. A merchant selling online goods in one country may have a different experience than one selling physical products in another.

The technology works as advertised - just for a much narrower slice of the problem than most merchants know when they first set it up.

When 3DS Authentication Fails or Gets Bypassed

Even when 3DS is active, it does not necessarily succeed. Global 3DS success rates sit around 82%, with frictionless authentication happening on roughly 58% of transactions. That leaves a real slice of purchases where the process either fails outright or never runs.

And when authentication does not succeed, the liability protection does not apply. The card networks are clear on this point - no successful authentication means no move of responsibility to the issuer.

But failed authentication is only part of the picture. There are also legitimate scenarios where 3DS gets skipped entirely, and this is where merchants can find themselves exposed without realizing it.

Certain transactions are exempt from 3DS altogether. Low-value transactions under roughly €30 in Europe can bypass the process, and so can merchant-initiated transactions like subscriptions billed without the cardholder present. Acquirer transaction risk analysis can also flag a payment as low-risk and skip authentication, and each of these exemptions has a different effect on who holds liability if a dispute comes in later.

Exemption Type	Authentication Required?	Liability Stays With Merchant?
Low-value transaction (under ~€30)	No	Yes
Merchant-initiated transaction	No	Yes
Acquirer TRA exemption	No	Yes
Issuer-applied exemption	No	No - issuer takes it on

The pattern here is worth noting. When the merchant or acquirer triggers the exemption, the merchant retains the liability - it's only when the issuer decides to waive authentication on their end that the responsibility moves away from the merchant.

A merchant running subscriptions or relying on TRA exemptions to cut back on checkout friction is also accepting liability on every one of those transactions. Understanding issuer fraud monitoring can help merchants anticipate how their transaction patterns are being evaluated on the other side.

The Rules That Can Strip Your Liability Shift Away

Even a clean, authenticated 3DS transaction doesn't guarantee you the liability shift forever. There are program-level rules that can pull that protection away from merchants who hit fraud thresholds - and most merchants don't know this until it's too late.

Visa runs a program in the U.S. that monitors fraud on 3DS transactions specifically. If your fraud volume on those transactions reaches $75,000 and your fraud rate hits 0.9%, Visa can revoke your liability shift privileges entirely. That means every 3DS transaction you process loses its protection - even the ones that authenticated without any problem. Learn more about how the Visa Fraud Monitoring Program works and what triggers it.

This creates a contradiction. The more you use 3DS as a fraud tool, the more exposed you become to hitting those thresholds if fraud still gets through. At that point, the protection disappears right when you'd want it most.

There's also a compliance deadline to keep in mind. Visa has a mandate taking effect in April 2026 that will require merchants to pass data fields during 3DS authentication. Incomplete data submissions could result in losing the liability shift on those transactions, so it's worth confirming that your payment stack will be ready for that. Transactions that fail this check may also fall under reason code 12.7: Invalid Data.

Trigger	Threshold	Consequence
Visa 3DS fraud volume (U.S.)	$75,000 in fraud on 3DS transactions	Liability shift privileges revoked
Visa 3DS fraud rate (U.S.)	0.9% fraud rate on 3DS transactions	Liability shift privileges revoked
Missing 3DS data fields (Visa mandate)	Non-compliance from April 2026	Liability shift lost on affected transactions

Both threshold conditions need to be met together - not just one. But for high-volume merchants processing lots of authenticated transactions, hitting both at once isn't as unlikely as it sounds. Understanding your chargeback threshold is essential before you reach that point.

What Chargeback Data Actually Shows About 3DS Usage

Only 9.9% of disputed transactions had 3DS enabled at the time of the chargeback, according to data from Chargeback.io; it's a remarkably low figure for a tool that's been positioned as a frontline defense against fraud-related disputes.

That low adoption rate could mean a few things. Some merchants hold back because they worry that adding an authentication step will cause customers to abandon their purchase. Others may have technical integration gaps that make 3DS harder to deploy across their full transaction flow. Some merchants have also weighed the evidence and concluded that 3DS alone won't protect them the way the payment networks recommend it will.

The widespread cost of chargebacks has been estimated at $243 billion, and that number is rising. If 3DS were a reliable fix, you'd expect adoption to be far higher than 9.9% among disputed transactions. The difference between what 3DS is supposed to do and what merchants are actually doing with it seems like a disconnect that goes beyond friction fears.

It's also worth mentioning what the data doesn't show. A low usage rate in disputed transactions doesn't automatically mean 3DS is failing merchants who use it. Some of the disputes may have come from transactions where 3DS was bypassed, or where exemptions applied, or where the conditions from the previous section stripped the liability protection away entirely. Strong Customer Authentication rules also introduce additional variables that affect when 3DS is required versus optional.

What the data does confirm is that 3DS is not being used as a blanket answer. Merchants are making calculated choices about where to apply it, and disputes are still happening at scale. That reality shapes how any helpful conversation about chargeback outcomes has to go from here.

3DS Is a Layer, Not a Lifeline

Before doubling down on 3DS or upgrading to the latest version, it's worth auditing the chargebacks you are actually receiving. If the bulk of your disputes are coming from categories that authentication does not cover, more friction at checkout will cost you conversions without meaningfully improving your win rate. The investment may still make sense as part of a layered strategy. But it should follow the data, not precede it.

Ultimately, 3D Secure is one tool among many - helpful, but not universal. The merchants who fare best in disputes tend to be the ones who understand what each layer of their fraud and payments stack does and what sits in the gaps. That understanding is harder to come by than any single technology, and it's worth more in the long run.