Does 3D Secure stop fraud? What it does well, and the gap it leaves

3D Secure confirms that the person paying online is the cardholder. It does that job well, and it is a large part of why stolen card details are harder to use online than they once were. 0Fraud is built to work alongside it, not to replace it.

What 3D Secure protects against

• Stolen card details used by someone who isn't the cardholder.
• Online payments where the merchant needs strong customer authentication.
• Liability: an authenticated payment can shift fraud liability away from the merchant.

How well it performs

Ravelin's 2026 analysis of 3D Secure performance found authentication success rates of 95% in the UK and 88% in the United States, with rates varying widely by country. Authentication is now a routine, mostly successful part of paying online.

The gap: when the cardholder is real

Some of the most painful fraud today is carried out by the genuine cardholder. A caller posing as the bank talks them through a payment. Someone with remote access to their phone guides them to a checkout. Every authentication step passes, because it really is them.

That isn't a failure of 3D Secure. It answers the question it was designed for. Coached payments need a second question: is anyone pulling the strings?

Answering the second question

0Fraud's scam check runs on every payment, including ones that have already passed 3D Secure. It looks at the context around the payment, and when that context looks wrong, the cardholder gets a calm warning on their own phone while there's still time to stop. The signals are tuned with each issuer and never published.