That Password Screen Is Mostly Gone. Here's What Replaced It.

Why 3D Secure 2 (3DS2) means a meaningfully better approval rate, and a real chargeback liability shift

That password screen you remember hating during checkout is mostly gone. In its place is a faster, smarter authentication protocol that most merchants have heard of but few have configured well. Here's what changed, and why it matters for your approval rate.

3DS1 Was A Conversion Killer

The original version of 3D Secure relied on static passwords, browser-only redirects, and had no real mobile support. Approval rates typically landed at 60-70%, with cart abandonment jumping 15-25% at the authentication step alone. Most merchants outside Europe simply turned it off rather than absorb that conversion loss.

3DS2 Replaces A Popup With Risk Data

The newer protocol takes a fundamentally different approach. Over 100 data points get passed to the issuer instead of a handful, and most transactions now authenticate silently in the background in under two seconds. Only the genuinely risky transactions receive a challenge screen at all, which is why well-implemented 3DS2 setups reach 85-95% approval rates.

 

The Liability Shift Is The Real Prize

Beyond the conversion improvement, there's a significant commercial benefit. When an issuer authenticates a transaction through 3DS2, fraud chargeback liability shifts to them, not the merchant. With Visa's VAMP and Mastercard's SMMP dispute thresholds both tightening this year, that protection is worth considerably more than it used to be.

Implementation Quality Is The Entire Game

Not all 3DS2 setups are created equal. The gap between a well-implemented and poorly-implemented configuration can run 5-15 percentage points of approval rate on the same volume. Sparse data submission or forcing unnecessary challenge screens quietly erases the gains the protocol is designed to deliver.

The Takeaway

Having 3DS2 turned on isn't the same as having it configured well. The merchants seeing the full benefit, higher approval rates and reduced chargeback liability, are the ones sending complete data and using risk-based authentication rather than defaulting to a challenge on every transaction.