What is 3DS and what does it mean to be a 3DS Assessor?

In this article, we explain what 3DS is, why organisations might be interested in it and what it means for Securious to be a qualified 3DS Assessor.

What is 3DS?

3DS stands for ‘3 Domain Secure’ and is an authentication standard devised by EMVCo. It’s for Card Not Present transactions so isn’t applicable to face-to-face transactions. It’s designed to authenticate and give confidence to the bank that the person submitting card details is actually the cardholder with as little friction as possible as it learns about the cardholder’s transaction behaviour

It does this in a number of different ways. For example, if you use your card to buy something on Amazon from your home computer and you do this quite often, it will recognise that this is normal behaviour for the cardholder. There’s some clever AI working behind the scenes that will detect, for example, that it’s during normal daytime hours, from the same IP address as usual, and not a suspicious amount of money. If something seems out of the ordinary – perhaps you order from a different location and device at an abnormal time- a window may pop up asking for a two-factor authentication code.

Organisations enable 3DS as a security metric to verify the cardholder’s identity. You may get sent a text message, or be given part of your email from which you have to confirm the rest. Once the bank does this, it could still be someone with the cardholder’s information but it’s a lot less likely for them to be in possession of the person’s phone and/or email information.

What are the benefits of 3DS?

A lot of Card Not Present fraud is big money for attackers. Nearly all eCommerce platforms use 3DS now because it gives them peace of mind – every transaction is a verified, authenticated transaction but at the same time the process is made as easy as possible for the end customer to avoid you losing business that way.

You may get a charge for choosing to have it but you won’t get chargebacks and you won’t get fraudulent activity because payments are, in theory, legitimate.

What does it mean to be 3DS qualified? Are there a lot of 3DS assessors?

There are 3DS assessor in the UK, but not many at all.

What we do as 3DS Assessors is work with the companies that are offering a 3DS service to clients. Because organisations with e-commerce websites, for example, aren’t going to be operating a 3DS system themselves – it works essentially like a plug-in for them. So we work a level up, with whoever is providing that 3DS system, assessing the technical environment and making sure it’s secure.

Interested in 3DS?

If you want to find out more about 3DS and how we can ensure you’re compliant, get in touch using the contact form below