Three-Domain Secure (3-D Secure)
PCIComplianceHubLast updated
An authentication protocol for online card payments that checks the cardholder with the card issuer before the transaction is authorised. The three domains are the acquirer side where the merchant sits, the issuer side, and the interoperability layer run by the payment brand that links them. It cuts card-not-present fraud; it does not change what PCI DSS asks of the merchant. The Council maintains separate PCI 3DS standards for the systems that run the protocol.
Applies to. No PCI DSS v4.0.1 requirement names 3-D Secure. It is the payment brands' cardholder authentication step for card-not-present transactions, run between the merchant's 3DS server or gateway, the brand's directory server and the issuer's access control server; in general payment practice it changes the merchant's fraud and liability position, not its PCI DSS scope, because the card data still flows through whatever payment page or gateway the merchant uses. The Council publishes separate PCI 3DS standards, a Core Security Standard for the entities that operate 3DS servers, directory servers and access control servers and an SDK standard for the mobile components, so a service provider running those systems is assessed against them as well as against PCI DSS where it handles account data.