E-commerce and payments
What is 3D Secure?
3D Secure is the bank authentication step where a customer confirms a payment, usually in a banking app. Under European and UK Strong Customer Authentication rules it is mandatory for most transactions, and it is where untested checkouts break.
Also called: SCA · Strong Customer Authentication · 3DS2
What it does to your flow
The payment is no longer a single request. It can be pending while the customer authenticates, it can be abandoned mid-challenge, and it can fail after apparently succeeding. A flow that assumes an immediate yes or no will produce orphaned orders.
What to test before launch
- A card that triggers a challenge and is authenticated successfully
- A challenge the customer abandons — does your pending order get cleaned up?
- A challenge that fails authentication
- A challenge completed after the browser has been closed
Exemptions worth knowing
Low-value transactions, recurring charges after the first, and trusted-beneficiary arrangements can be exempt. Providers apply these automatically where they can, which is another argument for hosted checkout over rolling your own.
Where this is covered in depth
A definition can only go so far. Stripe checkout integration, and the four failure modes nobody tests for covers this properly — 3 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.