You have just validated your cart, you are entering your bank details, and an additional screen asks you for a code received via SMS. This step is the 3D Secure protocol. It protects against fraud, but it also slows down the purchasing process. Some online sites operate without this verification, and understanding why (and how) changes the way we perceive the security of our payments online.
DSP2 Exemptions: why a payment without 3D Secure can remain legal
The European DSP2 regulation requires strong authentication for online card payments. Many consumers believe that the absence of 3D Secure automatically means a lack of security. It’s more nuanced than that.
In reality, the DSP2 provides several perfectly compliant strong authentication exemptions. A payment can go through without a 3D Secure screen while still adhering to the law, as long as certain specific criteria are met.
Among the cases provided for by the regulation, we find sites without 3D Secure to know that exploit these exemptions to streamline the shopping experience without violating the European directive.
- Low-value transactions (around 30 euros), subject to cumulative limits and a count of the number of successive transactions without authentication.
- Trusted beneficiaries, whom the cardholder has previously added to a whitelist with their bank.
- Recurring transactions, such as a monthly subscription, where only the first operation requires strong authentication.
- Real-time risk analysis (Transaction Risk Analysis), used by payment providers whose quarterly fraud rate remains below a threshold defined by Delegated Regulation (EU) 2018/389.
For the consumer, this means that a site without a 3D Secure screen is not necessarily suspicious. It may simply benefit from an exemption granted by its payment provider.
Online card fraud rates and the real role of 3D Secure
Have you noticed that card fraud regularly makes headlines in the media? Recent figures, however, show a trend contrary to what one might believe.
According to the Payment Security Observatory, fraud on card payments has reached a historically low level, with a rate of around 0.05% of the value processed. Between 2024 and 2025, the decrease is about 10%, directly attributed to the deployment of strong authentication 3D Secure 2 mandated by the DSP2.
This protocol has thus proven its effectiveness on a large scale. Sites that choose not to use it take a measurable risk, even if exemptions allow them to do so legally.
Who bears the risk in case of fraud without 3D Secure
When a merchant accepts a payment without strong authentication and fraud occurs, the financial responsibility falls on the merchant, not on the customer’s bank. This is the so-called “liability shift” mechanism provided by Visa and Mastercard networks.
In practice, the consumer remains protected: their bank must reimburse them in the case of an unauthorized transaction. The merchant, on the other hand, loses the merchandise and the amount of the transaction. This is why the majority of online shops activate 3D Secure, even when an exemption would be possible.
Online payment sites without 3D Secure verification: concrete cases
Some well-known platforms bypass 3D Secure transparently. Their common point: they use their own security systems in addition to or in place of the traditional banking protocol.
PayPal and electronic wallets
PayPal does not trigger 3D Secure at the time of payment on a merchant site. Authentication occurs beforehand, during the login to the PayPal account itself (password, two-factor authentication via the app). The merchant never sees the card details, which reduces the risk of data leakage.
The principle is the same for other electronic wallets. The buyer identifies once on the payment solution, then validates their purchases without going through a banking screen for each transaction.
Corporate cards and B2B transactions
Corporate cards benefit from a specific exemption in the DSP2. Purchases made with a card identified as professional can proceed without strong authentication. This exemption aims to simplify the supply flows of companies, where transaction volumes are high and amounts often recurring.
Subscriptions and recurring payments
Subscription services (streaming, software, online press) only trigger 3D Secure during the first payment. Subsequent charges, at the same amount, go through automatically. Only the first transaction requires strong authentication, with the following ones classified as recurring.
Concrete precautions for paying online without 3D Secure
The absence of 3D Secure does not mean the absence of protection, provided that a few simple measures are taken.
- Check that the site uses the HTTPS protocol (padlock in the address bar) before entering bank information.
- Prefer virtual single-use cards offered by most online banks, which limit the exposure of the actual card details.
- Activate real-time transaction notifications on the banking app to immediately spot any suspicious operations.
- Add trusted sites to the list of authorized beneficiaries with your bank, allowing you to benefit from the “trusted beneficiary” exemption without relinquishing control.
These reflexes compensate for the absence of the 3D Secure layer and maintain a satisfactory level of security for everyday online purchases.
The underlying trend remains clear: strong authentication has reduced card fraud to its lowest level in France. Exemptions to 3D Secure exist for practical reasons, not to weaken security. Understanding these mechanisms allows for more peace of mind when shopping online, knowing what really happens between clicking “pay” and validating the transaction.
