3D Secure overview
3D Secure (3DS) is an authentication standard for online card payments that adds an additional verification step for supported payment flows.
3D Secure (3DS) is a security protocol that adds an additional verification step for card payments to prevent the fraudulent use of credit cards in card-not-present transactions. It is commonly used to support payment security requirements such as Strong Customer Authentication (SCA) in markets where additional verification is required.
3D Secure 2, or 3DS2, is an updated version of the original 3DS protocol and uses dynamic authentication methods such as biometrics and token-based authentication.
How 3DS2 works
Depending on the payment service providers (PSP) and the issuing bank, 3DS2 can complete during the payment flow without additional customer action (frictionless) or can require the payer to complete an additional verification step (challenge) before the payment proceeds.
When additional verification is required, the payer completes the authentication step provided through the supported payment flow before the payment continues.
3DS2 helps support secure online card payment flows and helps merchants meet SCA and PSD2-related requirements when used with supported payment service providers.
3DS2 in Modernized Zuora Payments
Zuora supports two options for handling 3DS2:
- Through supported PSP connections. PSP's support and configuration requirements can vary by integration. It is the same as Zuora has handled in its past Zuora Payments integrations and can limit the ability to route transactions between providers.
- Through agnostic 3DS2 providers, for example, Xendit 3DS, Checkout.com 3DS, PicPay 3DS, which allows merchants to dictate exactly when and under which conditions to callout to a 3DS2 provider. This enables complete control of the 3DS flow and enables seamless transitions between PSPs. Note:
Commercial contracts with these providers are handled outside of Zuora.
Some PSP connections also provide configuration options related to 3DS behavior. However, the issuing bank still determines whether authentication is required for a given transaction.
Implementation considerations
When planning a 3DS rollout, confirm how your payment gateway integration supports 3DS2 and follow the setup guidance for that integration. The option you select will affect how you must set this up. If you intend to route card transactions between PSPs then you will likely prefer the agnostic 3DS2 provider approach.
If your payment gateway recommends specific authentication-related settings or amounts, verify that your Zuora configuration and merchant account support that setup.