3D Secure payment integration is a security protocol used on e-commerce sites to prevent card fraud by verifying the cardholder through a third party. Supported by Visa, Mastercard and American Express, this system blocks unauthorised transactions by confirming the customer's identity through their bank during checkout. Correct integration both improves security and has a positive effect on conversion rates.
What Is 3D Secure and How Does It Work?
3D Secure (3DS) is an authentication process that takes place between three parties: the cardholder's bank (the issuing bank), the merchant's bank (the acquirer) and the card network (Visa, Mastercard). During payment, the customer proves their identity with an OTP (one-time password) sent by their bank or with biometric verification. If this process is completed successfully the payment is approved; otherwise the transaction is declined.
- Issuing Bank (Issuer): The institution that manages the cardholder's account and carries out the authentication.
- Acquirer Bank: The bank that provides the merchant's payment infrastructure.
- Card Network: The organisation that operates protocols such as Visa's Verified by Visa or Mastercard's SecureCode.
- Access Control Server (ACS): The issuing bank's authentication server; the OTP or biometric check is carried out here.
- MPI (Merchant Plug-In): The component integrated on the merchant side that initiates the 3DS flow.
Key Differences Between 3DS1 and 3DS2
The first-generation 3DS protocol (3DS1) redirected the customer to a separate pop-up window for every transaction, which both harmed the user experience and caused mobile compatibility problems. 3DS2 (EMV 3DS) is an advanced protocol standardised by EMVCo in 2019 that largely resolves these problems.
The Advantages of 3DS2
Compared with 3DS1, the 3DS2 protocol sends more than 100 additional data points (device fingerprint, location, transaction history), allowing banks to assess risk more intelligently. For low-risk transactions the customer is not asked for additional verification; this feature is known as the "frictionless flow". As a result, the average payment completion rate can increase by 10-15%. For high-risk or uncertain transactions, the "challenge flow" kicks in and an OTP or biometric verification is requested.
The PSD2 Directive and Mandatory 3DS Compliance
The European Union's PSD2 (Payment Services Directive 2) has made Strong Customer Authentication (SCA) mandatory for all merchants operating in Europe. In Turkey, the BDDK (Banking Regulation and Supervision Agency) has introduced regulations, backed by comprehensive guidance, that make 3DS integration mandatory for banks. For this reason, ensuring your e-commerce site is 3DS-compliant is both a legal requirement and critical for customer trust.
How to Set Up 3D Secure Integration
For a 3DS integration to be set up successfully, you first need to clarify your payment infrastructure and your bank agreements. Integration is generally carried out in one of two ways: a ready-made integration through a payment service provider (PSP), or direct API integration.
Step-by-Step Setup Process
In the first step, obtain the 3DS MPI access details (MerchantID, ACS URL, transaction keys) from your acquirer bank or your PSP. In the second step, set up the test environment (sandbox) and simulate sample transaction flows. In the third step, complete the server-side API integration: send the payment initiation request, redirect to the ACS URL and receive the authentication result via your callback URL. In the fourth step, test the error scenarios (timeout, incorrect OTP, card limit). Finally, carry out a security audit before going live and make sure your SSL certificate is up to date.
3DS Compatibility with Turkish Banks
The major banks in Turkey (İş Bankası, Garanti BBVA, Yapı Kredi, Akbank, Ziraat Bankası) offer their own 3DS infrastructures. If you work directly with these banks, you need to study each bank's technical documentation carefully, since the MPI endpoint and parameters may differ for each one. Turkish PSPs such as İyzico, PayTR and Payu abstract this process away, allowing you to work with multiple banks through a single API.
The Effect of 3DS on Conversion Rate and Customer Experience
An incorrectly configured 3DS integration can increase basket abandonment rates. The mandatory redirect screen in 3DS1 in particular causes conversion losses of up to 20% among mobile users. With 3DS2, the frictionless flow comes into play and this rate can be reduced significantly. In addition, 3DS integration lowers chargeback (dispute) rates; after a successful authentication, liability shifts from the merchant to the bank (liability shift), which protects the merchant from financial risk.
- Frictionless Flow: In low-risk transactions the customer completes the payment without any extra step, and conversion increases.
- Challenge Flow: In high-risk transactions an OTP or biometric verification is requested, ensuring security.
- Liability Shift: With a successful 3DS authentication, chargeback liability passes to the bank and the merchant is protected.
- Fraud Reduction: Thanks to the authentication layer, card fraud attempts are largely blocked.
Technical Integration: The 3DS Flow via API
In an API-based 3DS integration, a typical flow works as follows: the customer enters their payment details, your server sends an "authentication request" to the PSP or directly to the bank API, and the ACS server returns an "authentication response" containing the redirect information needed to authenticate the cardholder. Once the customer completes the authentication, a PARes (Payer Authentication Response) token is sent to the merchant's callback URL. You verify this token on the server side and finalise the payment with the "authorization" step. This entire flow must take place over HTTPS, and sensitive card data must never be stored on your own servers (PCI-DSS compliance).
Frequently Asked Questions
Is 3D Secure mandatory?
In Turkey, banks make 3DS mandatory under the framework of BDDK regulations. In Europe, the SCA rules under PSD2 require the use of 3DS or an equivalent strong authentication method. For international transactions, the policies of the card networks are decisive.
How do you migrate from 3DS1 to 3DS2?
Most modern PSPs support automatic migration to 3DS2. If you use a direct bank integration, you need to activate your bank's 3DS2 ACS endpoint and update your SDK to the current EMVCo standards. The migration process typically takes 1-3 weeks.
Does 3D Secure integration reduce conversion rates?
3DS1 can have a negative effect on conversion because of the extra steps; however, the frictionless flow feature of 3DS2 completes low-risk transactions without adding any friction for the customer. When configured correctly, conversion loss is minimised, and net profitability may even increase as chargebacks fall.
Which PSP is recommended for 3DS integration in Turkey?
For the Turkish market, İyzico and PayTR are strong PSPs that offer ready-made integrations with domestic banks. If you also process international transactions, Stripe or Adyen may be a good option with their 3DS2-compliant infrastructures. Commission rates, the quality of technical support and integration documentation should be the deciding factors in your choice.
Conclusion
3D Secure payment integration is a critical component that improves the security of your e-commerce site, reduces chargeback risk and reinforces customer trust. By migrating to the 3DS2 protocol you can offer a frictionless payment experience while significantly reducing your fraud rates. Get in touch with Toserof Tech. for your e-commerce integration projects.
