Payments glossary
3-D Secure 2 (3DS2)
3-D Secure 2 (3DS2) is the card schemes' online authentication protocol. It lets the customer's bank verify a card payment using risk data - or a fingerprint, face scan or app approval - instead of static passwords, and shifts fraud liability from the merchant to the issuing bank.
How 3DS2 works at checkout
When a customer pays by card, the merchant's payment provider sends a bundle of risk signals - device data, address, transaction history patterns - to the customer's issuing bank. The bank makes one of two choices. In the frictionless flow, the risk data is enough: the bank authenticates silently and the customer notices nothing. In the challenge flow, the bank asks the customer to confirm - typically a push notification in their banking app or a biometric check, replacing the old static-password pages.
Why 3DS2 replaced 3DS1
The first version of 3-D Secure (the "enter your password" pop-up era) was notorious for abandoned checkouts: unfamiliar iframes, forgotten passwords and mobile-hostile screens. 3DS2 was designed around exactly those failures - it carries ten times more risk data so banks can skip the challenge for most transactions, and when a challenge is needed it uses the bank's own app instead of a password nobody remembers.
What merchants should ask their payment provider
Two questions separate good 3DS2 implementations from box-ticking ones: what share of transactions go through the frictionless flow, and how quickly challenge outcomes come back. On LekkaPay, 3DS2 is built into both the gateway and merchant-account models with the frictionless path prioritised - security that does not cost you the sale.
Frequently asked questions
Does 3DS2 hurt checkout conversion?
Done properly, no. 3DS2's frictionless flow lets the issuing bank approve low-risk payments using background risk data, so most customers never see a challenge screen. Conversion problems come from implementations that force a challenge on every transaction.
Is 3DS2 mandatory in South Africa?
South African issuing banks widely enforce 3-D Secure on card-not-present transactions, and acquirers generally require it in merchant agreements. Practically, an online card payment in South Africa should be assumed to need 3DS2.
What is the liability shift?
When a payment is authenticated with 3-D Secure, liability for fraud-related chargebacks generally shifts from the merchant to the card's issuing bank. Without authentication, "it wasn't me" fraud disputes usually land on the merchant.
Last updated:
Payments without the jargon.
One integration, every way Africa pays - we'll handle the acronyms.