Glossary
Stripe 3D Secure
3D Secure (3DS) is the card-network protocol that lets a card’s issuing bank ask the cardholder to prove who they are before a payment goes through, which Stripe requests when regulation, your Radar rules, an API flag or the issuer itself calls for it.
Also called: 3DS
14-day free trial · card required · cancel anytime
Definition
3D Secure adds a step between “customer enters a card” and “issuer authorizes the charge”. The issuing bank decides whether to let the payment through silently or to challenge the cardholder with a one-time code, a banking app prompt or a biometric check. Customers know it by the network brands: Visa Secure, Mastercard Identity Check and American Express SafeKey.
In the EEA it is not optional. Stripe’s documentation says the Strong Customer Authentication (SCA) rules under PSD2, and similar rules in the UK, India, Japan and Australia, “might require using 3DS for card payments.” Everywhere else it is a fraud tool you can choose to use.
For a business, 3DS matters for three reasons: it can stop a checkout, it changes who pays for certain fraud chargebacks, and it is the reason a saved card that worked last month can fail this month with authentication_required when no customer is present to answer the challenge.
Key points
- +Stripe decides whether a payment needs 3DS from regulatory mandates, Radar rules, manual API requests, issuer soft declines and other criteria.
- +The issuer picks the flow. A frictionless flow completes with no customer input, and a challenge flow asks the customer to respond.
- +You can force a request with payment_method_options[card][request_three_d_secure] set to any (prefers frictionless) or challenge (prefers a challenge). Stripe cannot guarantee the preference.
- +The outcome is recorded on the Charge in payment_method_details.card.three_d_secure, including result and authentication_flow.
- +A successfully authenticated payment usually shifts liability for a fraud chargeback to the issuer. An approved SCA exemption, a merchant-initiated transaction or a Data Only flow gives no liability shift.
- +Off-session payments cannot complete a challenge. If the issuer insists, the payment declines with authentication_required and the customer has to come back to authenticate.
- +For subscriptions, an invoice payment that needs authentication leaves the PaymentIntent in requires_action, the invoice open, and fires invoice.payment_action_required.
When Stripe asks for 3D Secure
Stripe’s authentication-flow documentation lists the triggers: regulatory mandates, Radar rules, manual API requests, issuer soft declines and other criteria. In practice most accounts never set anything. The default is Radar requesting 3DS dynamically based on risk and regulatory need, and Stripe describes manual triggering as something “for advanced users integrating Stripe with their own fraud engine.”
If you do want control, Radar rules can request 3DS (Stripe says custom 3DS rules need Radar Plus), or the API can request it per payment. Setting request_three_d_secure to any asks for 3DS with a preference for a frictionless flow. Setting it to challenge asks for a flow where the customer must actively respond. Either way, Stripe notes it “can’t guarantee your preference because the issuer determines the ultimate authentication flow.”
Not every payment can use 3DS. Stripe names wallets and off-session payments as examples of transactions that do not support it.
Frictionless, challenge and the result field
Most of the time the customer never sees 3DS. In a frictionless flow the issuer approves the authentication from the data it already has. In a challenge flow the customer gets a prompt, such as a code sent to their phone.
After authentication, Stripe attempts the charge. Some non-authenticated outcomes still allow the charge to proceed: Stripe gives attempt_acknowledged as an example that leads to a charge. To see what happened on a specific payment, read the three_d_secure property on the Charge’s payment_method_details.card. Stripe populates it when the customer attempts to authenticate, with result giving the outcome and authentication_flow showing whether the issuer ran a frictionless or challenge flow.
That field is the one to check before you rely on the liability shift for a disputed payment.
SCA exemptions, and what they cost you
In the EEA, Switzerland and the UK, Stripe requests SCA exemptions on your behalf so customers are challenged less often. The documented ones are low value (under 30 EUR or 25 GBP, with issuer limits of 100 EUR cumulative or five transactions since the last authentication), transaction risk analysis for low-risk payments up to 250 EUR for EEA merchants or 220 GBP for UK and Swiss merchants, and merchant-initiated transactions on saved cards.
The trade-off is stated plainly in Stripe’s exemptions page: “When the customer’s bank approves an exemption request, liability shift for fraudulent transactions doesn’t apply.” The same goes for merchant-initiated transactions, where “neither a customer challenge nor a liability shift occurs,” and for Data Only flows, where no authentication request reaches the issuer.
So a smoother checkout and fraud-liability protection pull in opposite directions. A payment that skipped the challenge is a payment you still carry the fraud risk on.
Off-session payments and authentication_required
Subscriptions, usage charges and saved-card top-ups usually happen when the customer is not in your checkout. Stripe calls these off-session payments. SCA can still require authentication for them, even if the customer authenticated before.
Stripe’s approach is to authenticate once while the customer is present, by saving the card with a SetupIntent or with setup_future_usage on a PaymentIntent, and then flag later payments with off_session set to true. Payments made that way are marked as merchant-initiated transactions, which need a mandate (an agreement from the customer to be charged later). Exemptions are not guaranteed, though, and Stripe warns that off-session payments “might still require authentication by the bank.”
When the bank does insist, the payment fails with the authentication_required decline code. The fix is to bring the customer back on-session: Stripe’s guidance is to use the declined PaymentIntent’s client secret so the customer can authenticate. If the issuer returns authentication_required on a payment that was already authenticated successfully, Stripe says the customer needs to contact their card issuer.
What a stuck renewal looks like in Stripe Billing
On a subscription, an authentication failure leaves three objects in a waiting state. The PaymentIntent is requires_action, the invoice is open, and on a new subscription the subscription is incomplete. Stripe sends invoice.payment_action_required to tell you authentication is needed.
Stripe can chase the customer for you. In the Billing automatic collection settings, “Send a Stripe-hosted link for customers to confirm their payments when required” emails the customer a link to a Stripe-hosted page where they can authenticate, and a second setting sends reminders until they confirm or the payment expires.
For the books, nothing is collected until the customer completes the step. The renewal is an invoice the customer owes, not revenue in your Stripe balance, and it should sit in Accounts Receivable rather than be treated as paid. The money, the fee and the payout entry only exist once invoice.paid fires.
How a renewal waiting on 3D Secure shows up with Acodei
With Acodei’s Invoice Sync, a paid-plan feature, the QuickBooks invoice is created when the Stripe invoice is finalized, and the payment is created and applied to that invoice when the Stripe invoice is paid.
A renewal that is waiting on authentication is a finalized, open Stripe invoice. So with Invoice Sync on, it appears in QuickBooks as an open invoice in Accounts Receivable, and it is only marked paid once the customer authenticates and Stripe reports the invoice paid.
Want to see this on your own Stripe data?
Start a free trial14-day free trial · card required · cancel anytime
Frequently asked questions
What is 3D Secure on Stripe?
3D Secure (3DS) is an authentication step run by the card’s issuing bank. Stripe requests it when regulation, your Radar rules, an API request or the issuer calls for it. The issuer then either approves silently (a frictionless flow) or asks the cardholder to confirm with a code, an app prompt or biometrics (a challenge flow).
Does 3D Secure protect me from chargebacks?
Partly. Stripe says that when a cardholder disputes a successfully authenticated payment as fraudulent, liability typically shifts to the card issuer. It does not stop the dispute from being filed, and it does not apply when an SCA exemption was approved, when the payment was a merchant-initiated transaction, or when a Data Only flow was used.
Why did a saved card fail with authentication_required?
The issuer wanted the cardholder to authenticate, and an off-session payment has no customer present to do it. Stripe’s guidance is to bring the customer back on-session and use the declined PaymentIntent’s client secret so they can authenticate. Saving the card with a SetupIntent and flagging later payments as off-session reduces how often this happens, but Stripe notes exemptions are not guaranteed.
How do I force 3D Secure on a Stripe payment?
Set payment_method_options[card][request_three_d_secure] on the PaymentIntent, SetupIntent or Checkout Session. Use any to prefer a frictionless flow or challenge to prefer a challenge. This overrides dynamic 3DS Radar rules for that payment, but the issuer still decides the final flow.
How should an invoice waiting on 3D Secure be recorded in QuickBooks?
As an unpaid invoice. Until the customer authenticates, no money has reached your Stripe balance, so the amount belongs in Accounts Receivable. Record the payment only when Stripe reports the invoice paid.
What customers say about running Stripe through Acodei
“If you're testing out all the different Stripe/QuickBooks integration apps right now, let me save you some time. This one is the best one by far.”
“Works well and is really helpful for massive transactions. The support is really fast and helpful. 100% recommended.”
Related reading
- Stripe Decline Code
- Stripe PaymentIntent
- Stripe SetupIntent
- Stripe Radar
- Stripe Dispute
- 3D Secure and chargeback liability
More glossary terms
- Undeposited Funds
- Stripe Balance Transaction
- Available vs Pending Balance
- Stripe Dispute
- Stripe Dispute Evidence
- Stripe Fee
- Stripe Balance Adjustment
- QuickBooks Credit Memo
- Stripe Tax
- QuickBooks Tax Code
- Stripe Reserve
- Stripe Tax Rate
- Stripe Fee Credit
- Stripe Credit Note
- QuickBooks Product/Service Item
- Stripe Payout
- QuickBooks Sales Receipt
- QuickBooks Bank Deposit
- QuickBooks Transfer
- Stripe Authorization Hold
- QuickBooks Refund Receipt
- QuickBooks Payment
- QuickBooks Expense
- QuickBooks Journal Entry
- Stripe Financial Account
- Holding Account
- Accounts Receivable
- Bank Feed
- Deferred Revenue
- Stripe PaymentIntent
- Stripe Checkout Session
- Stripe SetupIntent
- Stripe PaymentMethod
- Stripe Charge
- Stripe Refund
- QuickBooks Invoice
- QuickBooks Class Tracking
- QuickBooks Location Tracking
- QuickBooks Project
- QuickBooks Closing Date
- Stripe Invoice Line Item
- Stripe Proration
- Stripe Invoice Status
- Stripe Shipping Rate
- Stripe Transfer
- Stripe Mandate
- Stripe on_behalf_of
- Stripe Invoice Item
- QuickBooks Estimate
- Stripe Invoice Payment
- Stripe Invoice Payment Settings
- Stripe Billing Meter
- Stripe Invoice Template
- Stripe Price
- Stripe Subscription Schedule
- Stripe Subscription Item
- QuickBooks Recurring Transaction
- QuickBooks Sub-Customer
- QuickBooks Audit Log
- QuickBooks Bank Rule
- Stripe Subscription Status
- Stripe Mixed Interval Subscription
- Stripe Trial Settings
- QuickBooks Payment Terms
- Stripe Pending Update
- QuickBooks Tags
- QuickBooks Credit Card Credit
- QuickBooks Vendor Credit
- QuickBooks Bill
- QuickBooks Delayed Charge
- Stripe Billing Mode
- QuickBooks Billable Expense
- Stripe Customer Cash Balance
- QuickBooks Purchase Order
- QuickBooks Opening Balance
- QuickBooks Account Type
- QuickBooks Sales Tax Center
- Stripe Webhook
- Stripe Metadata
- Stripe Outbound Payment
- Stripe Received Credit
- Stripe Outbound Transfer
- Stripe Inbound Transfer
- Stripe Received Debit
- Stripe Payout Method
- Stripe Financial Account Transaction
- Stripe Financial Address
- Stripe Application Fee
- Stripe Connected Account
- Stripe Destination Charge
- Stripe Separate Charges and Transfers
- Stripe Direct Charge
- Stripe Payment Method Configuration
- Stripe Dynamic Payment Methods
- Stripe Payment Method Rules
- QuickBooks Bundle
- Stripe Account Capability
- Stripe Merchant of Record
- Stripe Data Pipeline
- Settlement Currency
- Hosted Invoice Page
- Stripe Customer
- Stripe Product
- QuickBooks Home Currency
- QuickBooks Exchange Gain or Loss
- QuickBooks Trial Balance
- QuickBooks General Ledger Report
- QuickBooks Retained Earnings
- QuickBooks Profit and Loss Report
- QuickBooks Balance Sheet Report
- QuickBooks Account Register
- QuickBooks Reclassify Transactions
- QuickBooks A/R Aging Report
- QuickBooks Sales Tax Liability Report
- QuickBooks Sales Tax Payable
- Stripe Tax Transaction
- Stripe Tax Location Report
- Stripe Tax Summarized Export
- Stripe Tax Itemized Export
- Stripe Product Tax Code
- QuickBooks Vendor
- Economic Nexus
- Reverse Charge
- Stripe Statement Descriptor
- Stripe Taxability Reason
- Stripe Tax Filing Currency
- Stripe Tax Cross-Border Goods Option
- Stripe Tax Threshold Monitoring
- QuickBooks Uncategorized Income
- QuickBooks Sales by Product/Service Report
- QuickBooks Sales by Customer Report
- QuickBooks Group Tax Rate
- Form 1099-NEC
- SEPA Direct Debit
- Bacs Direct Debit
- Canadian Pre-Authorized Debit (PAD)
- Australia BECS Direct Debit
- Stripe PayTo
- Stripe Test Clock
- QuickBooks Customer Display Name
- Backup Withholding
- QuickBooks Multicurrency
- Form 1042-S
- Form W-8BEN
- Form W-9
- Form 8233
- Form 1042
- Form 1099-K
- Form W-8BEN-E
- Stripe Tax Behavior
- Stripe Customer Tax ID
- Form 945
- ITIN (Individual Taxpayer Identification Number)
- Form 1099-MISC
- Stripe Customer Tax Exempt Status
- EFTPS (Electronic Federal Tax Payment System)
- Tax Representative (Fiscal Representative)
- Nil Return
- Sales Tax Exemption Certificate
- EU One Stop Shop (OSS)
- Place of Supply
- Simplified Tax Invoice
- Input VAT (Input Tax)
- Streamlined Sales Tax (SST)
- Fixed Establishment (VAT)
- VIES VAT Number Validation
- E-Invoicing Mandate
- Tax Point (Time of Supply)
- Sales Tax Holiday
- Digital Services Tax
- VAT Invoice (Full Tax Invoice)
- Output VAT (Output Tax)
- VAT Bad Debt Relief
- Sales Tax Sourcing
- Gross Receipts Tax
- VAT Cash Accounting Scheme
- Reduced VAT Rate
- VAT Flat Rate Scheme (UK)
- VAT Annual Accounting Scheme (UK)
- EU VAT SME Scheme
- Making Tax Digital for VAT
- VAT Payments on Account (UK)
- Stripe Tax Registration
- Non-Established Taxable Person (NETP)
- VAT Group Registration (UK)
- Zero-Rated vs Exempt Supply
- Electronically Supplied Services (ESS)
- Zero-Decimal Currency
- UK VAT Registration Threshold
- QuickBooks Deposit Detail Report
- Payment Settlement Entity (PSE)
- QuickBooks Reconcile
- QuickBooks Bad Debt Write-Off
- Stripe Radar
- Stripe Smart Retries
- Stripe Decline Code
- QuickBooks Voided Transaction
- Stripe Minimum Charge Amount
- Stripe Preview Invoice
Ready to try Acodei?
Connect Stripe to QuickBooks Online in minutes and let the fees, refunds, and payouts land where your accountant expects them.
14-day free trial · card required · cancel anytime