3D Secure Remains a Tough Sell in U.S. Even as Fraud Shifts Online

It has been difficult for the card brands' 3D Secure technology to find a following in the U.S., in part because of a lack of awareness, and in part because of the consumer friction the authentication process has caused in the past.

3D Secure was designed to add a layer of authentication to payment card use in e-commerce, but in its earliest deployments (dating back to 1999) it was seen as just one more password for consumers to struggle with. At worst, the pop-up password request would frustrate consumers into abandoning a purchase.

In recent years, 3D Secure has been updated with risk-based technology and dynamic data, while also giving merchants more control over when and how the extra authentication is requested.

Today, 3D Secure still faces issues with distribution, with a narrow range of choices for independent sales organizations and merchants to integrate 3D Secure from a certified merchant plug-in seller in the country. CardinalCommerce is the one major player.

Online checkout provider PAAY, based in New York City, hopes to change that by building on its recent certification to offer ISOs and merchants Verified by Visa and MasterCard Secure, the card networks' branded versions of 3D Secure.

The number of transactions moving through 3D Secure is rising globally, and the U.S. is likely to follow this trend as more e-commerce merchants see an uptick in fraud shifting away from the physical point of sale.

"It's requiring a lot of re-education, because 3D Secure is about a 17-year-old program that was cumbersome when you needed merchants and consumers both to enroll," said Yitz Mendlowitz, co-founder of PAAY.

The card brands expected merchants to push adoption of 3D Secure to cardholders during the dial-up Internet age, where the e-commerce process was already much slower than it needed to be. This turned merchants against the process, even though those who deployed 3D Secure would shift fraud liability back to the card issuer.

Many merchants have already made up their minds about 3D Secure based on their earlier frustrations with it.

"My members are very much aware of how 3D Secure works, but still have a bad taste in their mouths following their initial exposure when it was first introduced," said Mark Horwedel, CEO of the Merchant Advisory Group.

CardinalCommerce is a Merchant Advisory Group sponsor and has often marketed the improved 3D Secure product to group members, Horwedel said. Many of the group's board members are deploying 3D Secure through Cardinal, he added.

But merchants who don't want to dip their toes in the 3D Secure waters again have come up with other alternatives or opted for something like Accertify's transaction screening. Acculynk's online PIN pad has also gained favor with online and digital merchants in the past few years.

It's still unclear whether merchant attitudes will change toward 3D Secure based on shifting fraud trends.

"They are likely somewhat reluctant to buy-in to another iteration of 3D Secure without some real convincing," Horwedel said. "Other members have mentioned the system challenges a much higher percentage of shoppers than advertised."

But the way PAAY sees it, the merchant benefits the most when all transactions are screened, even if a small percentage call for extra authentication.

"Our theory is that merchants should attempt to authenticate all transactions and run them through 3D Secure," Mendlowitz said. In doing so, e-commerce merchants will enjoy a liability shift and lower interest rates because the screening would result in fewer chargebacks, Mendlowitz added.

But Mendlowitz is not naive about what his company faces in trying to convert merchants to become supporters of the safety measure. "Merchants don't believe it is true with the risk-based measures, until we show them how it actually works and how the transactions come through," he added.

PAAY has concentrated on developing a smoother online checkout procedure for the past few years, after initially looking to launch a mobile wallet, a concept it plans to revisit in the future.

As EMV standards governing body EMVCo, of which PAAY is a technical advisor, works on the 3D Secure 2.0 release, Mendlowitz predicts the card brands will initiate a stronger marketing push for merchants to deploy it.

"There is less barrier for entry into 3D Secure for merchants than there was for the EMV upgrade," Mendlowitz said. "It's literally just a plug-in and it helps your business and saves you money."

Still, whether it is the card brands, PAAY or CardinalCommerce singing the praises of 3D Secure, the merchants may not be eager to listen.

"The networks would do well to include merchants in the design stages of products they intend merchants to use," Horwedel said. "It would help avoid some of the miscues of the initial version of 3D Secure."

For reprint and licensing requests for this article, click here.
Analytics Data security
MORE FROM AMERICAN BANKER