3D Secure

Topics covered on this page

3D Secure 2

3-D Secure adds another level of protection to both merchants and cardholders. With the service enabled, chances of fraud is reduced significantly as each transaction is authenticated with a second factor authentication provided by the card issuing bank (OTP or SMS token).

3-D Secure is mandatory for certain business types. Our fraud analysts will determine whether it is necessary to enable the service on your account based on your business’s risk profile.

3-D Secure Authentication user view

3-D Secure is advantageous for merchants offering the following services:

Flight tickets
Mobile topup
Game money, digital money, prepaid cards
Digital goods such as music, movies and software
Any online content where fraud and chargebacks occur frequently

When to consider enabling 3-D Secure?

Business has lost many chargebacks and is unable to provide proof of delivery
Experienced many cases of fraud
Business does not require recurring payment, and would like to have more protection against fraud

The only disadvantage of enabling 3-D Secure is that cardholders will be redirected to a bank page for every purchase. Thus, merchants will not be able to do automatic/recurring payments. However, the Customer API can be used so that cardholders do not have to re-enter their card details in every time. All they’ve got to do is authenticate with 3-D Secure whenever payment is made.

3-D Secure Redirection Flow

Learn more on how to implement 3-D Secure.

You can easily identify charges that are blocked by our fraud system on the dashboard, the status will be marked failed fraud check.

3D Secure 2

Using 3D Secure 2...

sequenceDiagram participant ch as Cardholder participant ms as Merchant App/Omise SDK participant mc as Merchant server participant om as Omise API participant ac as Bank ch-->>ms: Submit credit card data ms->>om: Token request om->>ms: Token response ms->>mc: Charge request (merchant's endpoint) mc->>om: Charge request om->>mc: Charge response mc->>ms: Return authorize_uri ms->>om: Authentication request with authorize_uri om->>ac: Authentication request ac->>om: Authentication response om->>ms: Authentication response alt Is 3DS v1 ms->>om: Redirect to Omise API om->>ac: Redirect to the bank site ch-->>ac: Submit authentication data ac->>om: Return result om->>ms: Redirect back to the merchant app ms->>ch: Show authentication result else Is 3DS v2 [Frictionless authentication] ms->>ch: Show authentication result else Is 3DS v2 [Challenge authentication] loop Send challenge request until challenge authentication is completed ch-->>ms: Submit authentication data ms->>ac: Challenge request ac->>ms: Challenge response end ms->>ch: Show authentication result end