A Stolen Card Is Stopped Before It Becomes a Payment
With Evervault, a stolen card on Soap Payments is stopped before it ever becomes a payment.
Soap Payments and 3D Secure, powered by Evervault: every card payment is authenticated once before it reaches a processor, and that authentication carries over to whichever processor takes the payment.
What 3D Secure changes for merchants
What this means for merchants in gaming, prediction markets and entertainment:
- "I didn't make this purchase" disputes shift to the card issuer, not the merchant
- Fraud is stopped at the challenge screen, before a charge exists
- Card testing is blocked before a card is charged
- Apple Pay and Google Pay stay one tap
What is 3D Secure?
3D Secure (3DS) is an authentication step for online card payments. Before a payment is sent for authorization, the card issuer, the bank that gave the customer their card, gets a chance to confirm that the person paying is the real cardholder. It is the protocol behind Visa Secure, Mastercard Identity Check and similar programs from the other card networks.
The current version, 3DS2, shares far more data with the issuer than the original (device, browser and transaction details). That lets the issuer approve most genuine customers silently, in what is called the frictionless flow, and ask for proof only when something looks risky, in the challenge flow: a one-time code, a confirmation in the banking app, or a fingerprint or face check.
How 3D Secure works, step by step
- The customer enters their card at checkout.
- Before any charge exists, an authentication request goes through the card network to the customer's issuer.
- The issuer checks the request. A trusted customer passes without noticing; anyone else sees a challenge screen.
- When the issuer challenges a stolen card, it fails, so the payment never reaches a processor and there is nothing to dispute later.
- A successful authentication travels with the payment to the processor that authorizes it.
The 3DS liability shift, explained
Without 3D Secure, the merchant usually pays for a fraud chargeback: the customer says "I didn't make this purchase," the money is pulled back, and the merchant also pays a chargeback fee. When the payment was authenticated with 3DS, liability for that kind of fraud dispute generally shifts to the card issuer, because the issuer itself confirmed the cardholder.
The liability shift covers fraud claims. It does not cover every dispute: "the item never arrived" or "I want a refund" still need evidence from the merchant. For those, see how we automate chargeback representment with an AI agent.
What is card testing, and how does 3DS stop it?
Card testing is when fraudsters run stolen card numbers through a checkout, often in bulk and for small amounts, to find out which ones still work. Even when every attempt fails, the merchant pays for it: authorization fees, a spike in declines that processors notice, and fraud reports that count against the merchant's monitoring ratios.
Authenticating the card before it is charged closes that door. A tester holding only a card number can't pass the issuer's challenge, so the card never becomes usable on the merchant's account.
Why it matters now: Visa's new monitoring limits
Visa's new monitoring limits took effect in April, and acquirers are passing that pressure straight to merchants. Authenticating every payment up front is how Soap keeps bad payments out before they become disputes.
Visa's Acquirer Monitoring Program (VAMP) counts fraud reports and disputes together against a merchant's card-not-present volume. A merchant over the threshold faces fees and remediation plans, and its acquirer faces pressure too, which is why acquirers now look hard at every merchant's ratio. Fraud stopped at the challenge screen never becomes a fraud report or a dispute, so it never enters the ratio.
The result: Soap Payments's card chargeback rate runs under 0.3%, well below the 1.5% merchant threshold in Visa's VAMP program, which counts fraud reports and disputes together.
Does 3D Secure hurt conversion?
The old version of 3DS had a reputation for clunky pop-ups and abandoned carts. 3DS2 was built to fix that: most genuine customers go through the frictionless flow without ever seeing a challenge. Apple Pay and Google Pay stay one tap, because the wallet already confirms the customer on their own device.
Frequently asked questions
What is 3D Secure?
3D Secure (3DS) is a check run by the card issuer before an online card payment goes through. The cardholder confirms the payment, for example in their banking app, so a stolen card number on its own isn't enough to pay.
What is the difference between 3DS and 3DS2?
3DS2 sends the issuer much more information about the device and the transaction, so most genuine customers are approved without a challenge. The original 3DS challenged far more often, which cost merchants conversions.
Who pays for a fraud chargeback after 3D Secure?
When a payment was authenticated with 3D Secure, an "I didn't make this purchase" dispute shifts to the card issuer instead of the merchant.
Does 3D Secure stop card testing?
Yes, when cards are authenticated as they are saved. A fraudster with only a card number can't pass the issuer's challenge, so the card can't be used.
Does 3D Secure slow down Apple Pay or Google Pay?
No. Apple Pay and Google Pay stay one tap.
Thank you to the Evervault team for the infrastructure behind it.
Talk to the Soap team about 3D Secure for your checkout.