3D Secure

The name “3D” is derived from the three different parties (domains) involved in the authentication process:

• Acquirer: The environment of the merchant (the airline or travel agency) and their bank in which the transaction details get entered.
• Issuer: The environment of the bank (the entity that issued the credit card) of the cardholder.
• Interoperability: This is the infrastructure (provided by payment schemes like Visa/Mastercard) that allows the Acquirer and Issuer to talk to each other to verify the transaction.

For years, 3D Secure was despised by the travel industry because it destroyed conversion rates.

• 3DS 1.0 (The Pop-Up Era): The old version directed the user to a separate pop-up window in which the user had to remember a static password. It was clunky and not mobile-friendly, and many travelers abandoned their booking.
• 3DS 2.0 (The Frictionless Era): The modern version is based on massive data exchange (device ID, location, spending history) for background verification of identity. If the data appears safe, the transaction is cleared without the user doing anything. If the transaction in question appears to be risky (e.g., booking a flight from a new device in a different country), the bank challenges the user with a simple check of their biometric (FaceID) or One Time Password (OTP) sent to the customer via SMS.

The best selling point for a travel merchant to use 3D Secure is the liability shift.

In case of a typical credit card transaction, if a fraudster used a stolen credit card to purchase a plane ticket, the airline will receive a chargeback and lose the money. However, if the transaction is made with the use of 3D Secure, the liability for fraud changes from the Merchant (airline) to the Issuer (bank).

Even if the card does turn out to be stolen, the airline still has the money, and the bank is left to absorb the loss since the bank is the one who authenticated the user.