A Smoother Experience, Coupled With Rising Online Fraud, Sparks Interest in 3-D Secure

Once widely disparaged as an unwieldy fraud solution, 3-D Secure is back on the radar screens of risk managers at major online merchants and card issuers. Improvements in the 15-year-old technology, combined with surging e-commerce fraud, are driving the renewed interest, experts say.

“Two-and-a-half years ago, zero U.S. online merchants among the top 50 were using 3-D Secure, but we’ll end the year with 40 using it,” predicts Alasdair Rambaud, a former American Express Co. executive who is now senior vice president for merchant services at CardinalCommerce Corp., a Mentor, Ohio-based vendor of authentication solutions for e-commerce.

Issuing banks, too, are looking more favorably at the technology. “I do think we are seeing a renaissance in 3-D Secure in general, as more and more issuers move to risk-based authentication, and more dynamic forms of stepped-up authentication,” notes Julie Conroy, research director at Boston-based research firm Aite Group, via e-mail.

In a sense, 3-D Secure is the e-commerce version of EMV, which has been rolling out in U.S. stores for at least the past six months. In its original form, 3-D Secure sought to thwart online fraud by requiring consumers to enter a PIN or password while in the process of checking out on merchants’ sites. But merchants complained that the process took too long and put off consumers by redirecting them to a separate page or pop-up screen. The integration work merchants had to perform was also an early impediment. After years of resistance by merchants, many issuers gave up on the technology.

Some market segments, such airlines and online travel agencies, are still wary of 3-D Secure, adopting it sparingly and only in cases where risk analysis appears to warrant it, according to a recent survey.

Now, however, rising adoption of EMV is already driving up online fraud rates, sparking broad new interest in 3-D Secure. Card-not-present fraud in the U.S. market is expected to hit $4 billion this year, up 25% from 2015 and a hefty 43% increase just since 2014, according to Aite.

Another reason for the renewed interest is that the consumer experience has improved in recent years. While some issuers and vendors still enforce the old PIN/password routine, many have converted to so-called risk-based authentication, which relies on a range of user and device characteristics, as well as one-time passwords and text messages, to establish whether buyers are who they say they are. “The old days of user names and [static] passwords are gone,” Rambaud tells Digital Transactions News. “Our customers really like the solution.”

Word of this change, however, appears to be one of the payments industry’s best-kept secrets, with many merchants and issuers still regarding 3-D Secure as a “four-letter word,” according to a report Conroy and Aite released last month to detail the advances vendors and the card networks have made in the solution.

Further improvements are on the way. Early last year, EMVCo began work on what is now called 3-D Secure 2.0, which among other things will allow the solution to work in mobile apps. A revised draft of the new specification appeared last month and issuers could begin implementing the new version by year’s end, according to Rambaud. Visa Inc., which pioneered 3-D Secure and offers it under the Verified By Visa name, is one of six global networks that control EMVCo.

Experts expect the introduction of version 2.0 to lend further momentum to 3-D Secure. “I think [3-D Secure] 2.0, with its goal of bringing additional data elements into the mix, will also result in improvements that further improves adoption,” Conroy tells Digital Transactions News.

In the meantime, 3-D Secure offers two other advantages that haven’t changed since the technology first hit the market. As with EMV in physical stores, merchants that use 3-D Secure can shift fraud liability to issuers. And, unlike the case with EMV, 3-D Secure comes with a reduction in interchange. This varies, but typically ranges from 20 to 22 basis points, Rambaud says.

The shift in sentiment toward 3-D Secure is already quickening, Rambaud says, as EMV’s rollout pushes more criminals into card-not-present channels. “The market is changing very fast,” he notes. “The pace of change has accelerated in the past three months.”