You enter your card number on a website, press Pay, and a page from your bank appears asking for a one-time password. That page is 3D Secure at work. It's the moment the bank that issued your card checks that the person paying is really you, before it decides whether to approve the payment.
Most people only notice it when it goes wrong: the OTP doesn't arrive, the page times out, the app switch loses the payment. This guide explains what's happening in that step, how RBI's rules shape it in India, and what customers and merchants can do when it fails.
What 3D Secure is
EMV 3-D Secure (EMV 3DS) is a card industry protocol, maintained by EMVCo, that helps card issuers and merchants prevent card-not-present fraud: fraud in payments where the physical card isn't involved, as on websites and in apps. It gives the issuer a standard way to authenticate the cardholder during an online purchase, in a browser or in a mobile app.
Card networks offer it under their own brand names, but the idea is the same. Authentication (is this the cardholder?) happens first; authorisation (does the bank approve this payment?) follows. Our guide to how online card payments work explains authorisation, capture and settlement, which come after this step.
How the step works
Here's what happens between pressing Pay and seeing the result:
- 1Card details enteredOr a saved card token chosen
- 2Authentication requestTransaction, payment method and device details go to the issuer
- 3Issuer assesses riskUsing that data and its own checks
- 4Challenge or notOTP, app approval, biometrics or another method, where needed
- 5Result returnedAuthenticated, or failed
- 6AuthorisationOnly then is the payment itself approved or declined
EMVCo describes the data the merchant side sends as details about the transaction, the payment method and the device. That data is what lets the issuer judge risk before deciding how to authenticate you.
Frictionless and challenge flows
EMV 3DS has two paths. In the frictionless flow, the issuer judges the transaction low-risk from the data it received, and the customer simply clicks Buy and the payment proceeds. In the challenge flow, used for higher-risk transactions, the customer must authenticate, for example with a one-time passcode, knowledge-based questions or biometrics.
| Compared on | Frictionless | Challenge |
|---|---|---|
| What the customer sees | Nothing extra | An OTP screen, app approval or biometric prompt |
| When it's used | Issuer judges the payment low-risk, where rules allow | Higher-risk payments, or where rules require a second factor |
| Typical in India for domestic online card payments | Rare, because of RBI's two-factor rules | The norm |
Much of what you'll read about 3D Secure, especially from Europe and the US, focuses on making more payments frictionless. In India, RBI's rules require a second factor for most online card payments, so the challenge step is what customers usually see. Frictionless authentication matters more for Indian cards used abroad and for the exemptions RBI allows.
What RBI's 2025 rules require
RBI's Authentication mechanisms for digital payment transactions Directions, 2025, which issuers and other payment system participants had to comply with by 1 April 2026, set the ground rules for all digital payments, not just cards:
- Every digital payment must be authenticated by at least two distinct factors. The factors can be something you have, something you know or something you are, such as a password, SMS OTP, passphrase, PIN, card hardware, software token or biometrics.
- For card-not-present payments, at least one factor must be dynamic: created or proven for that transaction alone, as a one-time password is.
- Issuers may run additional, risk-based checks beyond the two factors, using behavioural and contextual signals.
- Issuers may offer customers a choice of authentication factors, and authentication and tokenisation services must be accessible to all applications and token requestors.
- If a loss arises from a transaction processed without complying with the directions, the issuer must compensate the customer in full.
The exemptions
The directions list cases where the second factor isn't required. Few of them apply to ordinary online shopping:
- Small-value contactless card payments at a shop.
- Recurring payments under a registered e-mandate, after the first one, within RBI's limits.
- Select prepaid instruments: those used for mass transit (PPI-MTS) and gift PPIs.
- NETC (FASTag) toll transactions.
- Small-value digital payments in offline mode.
- Travel bookings made with commercial or corporate cards through global distribution systems or IATA.
- Tap-and-pay UPI payments on NFC-enabled card machines.
The new check on overseas websites
Indian cards used on foreign websites have been a long-standing gap: many overseas merchants don't ask for an Indian bank's OTP. RBI's 2025 directions required card issuers, by 1 October 2026, to put in place a mechanism to validate non-recurring, cross-border card-not-present transactions, and to register their card BINs (the first digits that identify the issuer) with the card networks for this purpose.
For cardholders, this means a payment on an overseas website may now prompt a verification step from your bank that you didn't see before. For businesses abroad selling to Indian customers, it's a reason to support 3D Secure well in their checkout.
Saved cards, mobile apps and 3D Secure
Two situations change what the step looks like, without removing it.
- Saved cards. In India, a saved card is a token, not your card number: since October 2022 only card issuers and card networks may store the actual number. Creating a token needs your explicit consent, confirmed with an additional factor from your bank, which is why saving a card asks for an OTP. Paying later with that token is still a card-not-present payment, and RBI's exemptions don't include saved cards, so expect your bank to authenticate those payments too, unless they're recurring debits under a registered e-mandate.
- Mobile apps. Older 3D Secure flows opened a web page inside the app, which often broke on small screens or when the app lost focus. EMVCo's 2.x specifications support authentication inside apps as well as in browsers, so a well-built app checkout can show the bank's challenge natively, or hand over to the bank's own app for approval and come back.
Either way, the principle is the same: authentication proves it's the cardholder; the bank decides on the payment afterwards. Our card tokenisation guide covers how saved cards work on the merchant side.
Why the 3D Secure step fails
A failure at this stage is an authentication failure, not your bank declining the payment for lack of funds. The usual causes:
| What happened | Likely cause | What to do |
|---|---|---|
| The OTP never arrived | SMS delay, poor signal, or an old mobile number registered with the bank | Wait a minute and resend; check the number registered with your bank |
| Wrong OTP or OTP expired | A typo, or an older OTP used | Request a new OTP and enter it promptly |
| The bank's page didn't load or timed out | Network issue, or the issuer's authentication service was slow | Retry after a few minutes, or use another method |
| Payment lost after switching apps | Approving in the bank app broke the checkout session | Check whether you were debited before retrying |
| Blocked before the OTP step | Card not enabled for online or international use | Enable it in your banking app, then retry |
| Repeated failures | The issuer's risk checks flagged the payment | Contact your bank through its official channel |
If the authentication succeeded but the payment was still refused, that's a decline by your bank at the authorisation stage, with its own set of reasons. Our guide to payment declined errors covers those, and why online payments fail covers failures elsewhere in the chain.
For customers: making the step painless
A few habits cut most 3D Secure trouble:
- Keep the mobile number registered with your bank current. It's where OTPs go.
- If your bank offers in-app approval, set it up; it doesn't depend on SMS delivery.
- Enable online and, if you need it, international use for your card in your banking app before you shop.
- Never share an OTP with anyone, including someone who says they're from your bank. An OTP approves a payment from your account.
- Read the merchant name and amount on the authentication page. If they don't match what you're buying, stop.
For merchants: authentication is part of conversion
Every customer who abandons at the OTP screen is a lost sale, and many of those failures are recoverable. Your payment provider runs the 3D Secure integration, but these choices are yours:
- Use an integration that handles authentication cleanly on mobile, including app-based checkouts. EMVCo's 2.x specifications support both browser and in-app authentication, and it recommends version 2.2 or higher for the best functionality. Our guide to payment gateway integration compares the options.
- Don't mark an order failed while authentication is still in progress. Wait for the provider's final status.
- Track authentication failures separately from bank declines, by issuer, so you can tell a bank's OTP outage from your own checkout problem.
- Offer saved cards through tokenisation and UPI as alternatives; when one route's authentication is struggling, another often works.
Authentication is one layer in a wider set of controls. Our payment gateway security guide covers the rest, including what's your responsibility and what's your provider's.
Frequently asked questions
Is 3D Secure the same as the OTP?
The OTP is one way of completing 3D Secure. 3D Secure is the whole authentication step; the issuer can also use app approval, biometrics or other methods, and in a frictionless flow no challenge at all.
Why do some international websites not ask for an OTP?
Many overseas merchants haven't required the second factor that RBI requires for domestic online card payments. RBI's 2025 directions asked card issuers to have a mechanism to validate non-recurring cross-border card-not-present payments by 1 October 2026, so you may now see a verification step on overseas sites too.
Is my money debited if 3D Secure fails?
Usually not, because authentication comes before the payment is authorised. If you were debited anyway, the payment failed after the debit, and your bank must reverse it within RBI's deadline for card payments.
Who is liable if a payment goes through without a second factor?
Under RBI's 2025 authentication directions, if a loss arises from a transaction processed without complying with the directions, the card issuer must compensate the customer in full.
Go deeper
Official sources
- RBI — Authentication mechanisms for digital payment transactions Directions, 2025 (25 Sep 2025)RBI/2025-26/79. Two distinct factors; one dynamic for card-not-present; factor types including SMS OTP; risk-based checks; choice of factors and accessible authentication; full compensation for non-compliance; compliance by 1 April 2026; cross-border CNP validation and BIN registration by 1 October 2026; Annexure-1 exemptions.
- EMVCo — EMV 3-D SecurePurpose (preventing card-not-present fraud); frictionless and challenge flows; transaction, payment method and device data sent to the issuer; app and browser support; recommendation of version 2.2 or higher.
- RBI — Harmonisation of Turn Around Time and customer compensation for failed transactions (20 Sep 2019)Reversal deadlines for failed card payments.
Last reviewed . Examples, amounts and screens marked illustrative are not LILPE figures.
