Online sellers lose money to chargebacks twice: once when the sale reverses and again when a rising dispute ratio makes the processor nervous. The tools to stop both are mostly already in the gateway and mostly off by default. This page explains 3D Secure, what a chargeback really costs, and the settings that keep the ratio down.
How 3D Secure 2 works
- The customer enters a card on your checkout.
- Before authorization, the gateway sends transaction and device details to the card network’s directory server, which contacts the cardholder’s bank.
- The bank scores the risk. For most transactions it returns an authentication silently (a “frictionless” flow). For some it challenges the customer through their banking app or a one-time code.
- Authenticated transactions carry a flag through authorization. If a fraud chargeback (reason code “fraud, card-not-present”) is later filed on an authenticated transaction, the liability sits with the issuer, not with you.
Version 2 replaced the pop-up passwords of the original protocol. Frictionless rates are high for domestic consumer cards with a good history; challenges concentrate on new cards, high amounts, unusual locations and high-risk merchant categories.
What liability shift does and does not cover
| Chargeback reason | Covered by 3DS liability shift? |
|---|---|
| Fraud: cardholder says they did not make the purchase | Yes, when authenticated |
| Friendly fraud: cardholder made it but disputes anyway under a fraud code | Usually yes, because the authentication record is your evidence |
| Product not received | No |
| Product not as described, defective | No |
| Duplicate charge, wrong amount | No |
| Recurring charge cancelled | No |
3DS is a fraud tool. The non-fraud reason codes are answered by operations: tracking numbers, delivery confirmation, clear terms, fast refunds, and easy cancellation.
What a chargeback costs
| Cost | Typical |
|---|---|
| Reversed transaction | The full amount |
| Goods or service | Already delivered, rarely recovered |
| Processor chargeback fee | $15 (Stripe, WooPayments) to $35 (some merchant accounts) |
| Staff time to respond | 30 to 60 minutes each |
| Dispute ratio impact | Counted against you whether you win or lose |
The ratio is what escalates. Visa and Mastercard monitoring programs start around 0.9% to 1% of transactions (with a minimum count), add monthly fines that grow with time in the program, and can end in termination. A merchant doing 1,000 transactions a month is in trouble at 10 chargebacks.
The settings that prevent most chargebacks
- AVS and CVV required. Decline mismatches on address and code. Cheap, effective, and needed for the best card-not-present interchange anyway.
- 3D Secure on. For everything, or by rule: above a ticket size, for new customers, for international cards, for high-risk product categories.
- Clear billing descriptor. The name on the customer’s statement should be your business name as they know it plus a phone number. “NDP*SVCS 8005551212” causes disputes; “Nextdoor Payments 213-934-8686” does not.
- Order confirmation and shipping notifications with the same name and a way to contact you.
- Refund fast and without argument on small amounts. A $40 refund costs less than a $40 chargeback with a $25 fee.
- Dispute alerts. Visa and Mastercard alert services (Verifi, Ethoca) notify you of a pending dispute so you can refund before it becomes a chargeback. Available through most gateways or processors for a per-alert fee.
- Velocity rules. Block repeated attempts from one card, IP or email in a short window. Gateway fraud suites do this.
Fighting the ones you get
Respond to every dispute with the evidence the reason code asks for: the 3DS authentication record and AVS/CVV match for fraud codes; tracking with signature for not-received; the product page and terms for not-as-described; the cancellation policy and the customer’s acceptance of it for recurring disputes. Win rates for well-documented merchants are meaningfully higher than the industry average, and the evidence is mostly automatic if the gateway and shipping tools are set up.
Which gateways
accept.blue: 3D Secure, fraud scoring and rules, Amex routing, tokenized vault. NMI and USAePay: 3DS and a fraud rules suite. Fluidpay: WatchDog rules and machine-learning scoring, 3DS. Authorize.net: Advanced Fraud Detection Suite with velocity and geographic filters; 3DS through the Accept Hosted and API integrations.
We enable AVS, CVV and 3DS rules on every online account we board and set the descriptor with you before the first transaction. High-risk categories that need more than that are covered on the high-risk gateway page.