2D Payments Without 3D Secure: Benefits, Risks, and Use Cases

The Conversion vs. Security Dilemma

In the world of online payments, every click counts. The final step (the payment itself) is the most critical. Yet, this is precisely where many merchants lose their customers. According to a recent study by the Baymard Institute, the average cart abandonment rate is close to 70%, with a long or complex checkout process being a major cause. At the heart of this process lies a double-edged sword: 3D Secure (3DS).

Implemented to secure online transactions through Strong Customer Authentication (SCA), 3DS is an effective barrier against fraud. However, it introduces an extra step, often creating friction. A redirect to the bank's website, entering a code received via SMS, validating through a mobile app... each of these presents an opportunity for a busy or hesitant customer to abandon their purchase. It's estimated that adding 3DS can lead to a conversion drop ranging from 5% to over 25%, depending on the industry and implementation.

Faced with this reality, the idea of accepting payments without 3D Secure (so-called "frictionless" or 2D payments) becomes appealing. Is it possible to bypass this security layer to streamline the purchasing journey? What are the rules imposed by the PSD2 directive? What are the real risks in terms of fraud and liability? This article is a comprehensive guide for merchants, payment managers, and integrators.

We will break down the mechanisms, legal exemptions, and relevant use cases, and show you how a smart payment gateway like Bridge Pay helps you find the perfect balance between an optimal user experience and controlled risk management.

Understanding 3D Secure and the "Frictionless" Logic

To fully grasp the challenges of 2D payments, it's essential to understand the fundamentals of 3D Secure and the regulations that govern it.

3D Secure: A Barrier Against Fraud

3D Secure (for "Three-Domain Secure") is a security protocol created by card networks Visa (Verified by Visa) and Mastercard (Mastercard SecureCode) to authenticate the cardholder during an online payment. The "three domains" involved are:

• The acquirer domain: the merchant's bank.
• The issuer domain: the customer's bank.
• The interoperability domain: the infrastructure that supports the 3DS protocol.

In practice, when a customer pays on a site using 3DS, they are redirected to their own bank's page to prove their identity. This proof is the Strong Customer Authentication (SCA), which, according to the Payment Services Directive 2 (PSD2) in Europe, must be based on at least two of the following three elements:

• Knowledge: something only the customer knows (password, PIN code).
• Possession: something only the customer possesses (mobile phone via SMS, banking app).
• Inherence: something the customer is (fingerprint, facial recognition).

The "Frictionless" Promise: The Invisible Payment

While security is enhanced, the user experience is complicated. This is where the concept of "frictionless" payment comes in. The goal is to remove this visible authentication step for the customer when the fraud risk is considered low enough. The transaction is then processed as "2D Secure," meaning without the intervention of the third domain (the issuer's for authentication).

For the customer, the experience is ideal: they enter their card details, click "Pay," and the confirmation appears instantly. For the merchant, the benefit is direct: the conversion rate increases, especially on mobile where speed is paramount.

The Legal Framework: PSD2 Exemptions to Strong Customer Authentication (SCA)

PSD2 made Strong Customer Authentication mandatory for most electronic payments in Europe. However, it also provided specific exemptions to avoid penalizing the user experience in low-risk contexts. Mastering these exemptions is key to offering "frictionless" journeys legally and in a controlled manner.

1. Low-Value Transactions (LVT)

This is the most common exemption. A transaction can be exempt from SCA if its amount is less than €30. However, limits apply to prevent abuse: the cardholder's bank will force authentication if the customer makes more than 5 consecutive transactions without SCA, or if the cumulative amount of these transactions exceeds €100.

2. Fixed-Amount Recurring Payments

For subscriptions (SaaS, streaming, monthly boxes...), SCA is only required for the first transaction (the initiation of the subscription). Subsequent payments, if they are for the same amount and to the same merchant, are considered "Merchant-Initiated Transactions" (MITs) and are exempt from SCA. This is a major use case for recurring revenue business models.

3. Transaction Risk Analysis (TRA)

This is the most powerful, but also the most complex, exemption. The acquirer (or the payment gateway like Bridge Pay) can request an SCA exemption if the transaction is deemed low-risk following a real-time analysis. To be eligible, the payment service provider must maintain a very low overall fraud rate, based on thresholds defined by the regulation.

For example:

This is at the core of the value added by a gateway like Bridge Pay, whose advanced TRA engine helps maximize exemptions in full compliance.

4. Trusted Beneficiaries (Whitelisting)

Customers can add a merchant to their list of "trusted beneficiaries" with their bank. Once a merchant is "whitelisted," all future transactions to that merchant may be exempt from SCA. The challenge for the merchant is to encourage customers to take this action, which is done within their own bank's interface.

Benefits vs. Risks: The Great Trade-Off

Opting for 2D payments requires a clear-eyed analysis of the expected benefits versus the risks involved. There is no one-size-fits-all solution, but a balance to be struck based on your industry, customer base, and risk tolerance.

The Concrete Benefits of a "Frictionless" Strategy

• Increased Conversion Rate: This is the most direct benefit. By removing a step, you reduce cart abandonment. A gain of 5 to 10 conversion points on eligible traffic segments is a realistic estimate.
• Improved User Experience (UX): A fast and seamless payment process enhances customer satisfaction and loyalty. This is especially true for impulse buys or mobile purchases.
• Optimized One-Click Payments: "Frictionless" is the key to offering a true one-click purchase experience to registered customers, turning loyalty into recurring, smooth transactions.

Risks You Should Never Underestimate

The main risk is simple: fraud. But its consequences are multiple.

The "Liability Shift": Transfer of Responsibility

This is the most important concept to understand.

• During a transaction with successful 3D Secure, liability in the event of a fraud dispute (e.g., "I did not authorize this payment") is transferred to the customer's bank (the issuer). This is the liability shift. The merchant is protected against this type of chargeback.
• During a transaction without 3D Secure (2D), the liability lies with the merchant. If a payment is disputed for fraud, the merchant incurs the chargeback: they lose the sale amount and often have to pay penalty fees.

An aggressive "frictionless" strategy without adequate fraud management tools can therefore quickly become very costly. A chargeback rate exceeding 1% can even lead to the suspension of your payment account by the card networks.

Bridge Pay: Your Partner for Smart Frictionless Payments

The choice isn't binary between "all 3DS" and "zero 3DS." The modern approach is to use dynamic logic that applies 3D Secure only when necessary. This is precisely the philosophy of Bridge Pay: we give you the tools to accept a maximum number of "frictionless" payments while controlling your risk exposure.

A Dynamic and Customizable TRA Engine

Our strength lies in our Transaction Risk Analysis (TRA) engine. By analyzing over 200 data points in real time (purchase context, customer history, device data, amount, etc.), our system can calculate a risk score for each transaction. Based on this, we dynamically apply the best strategy:

• Low risk: The transaction is accepted without 3DS (via TRA exemption). The journey is smooth, and conversion is maximized.
• Moderate or uncertain risk: The transaction is sent through a classic 3D Secure flow. Security is prioritized.
• High risk: The transaction is blocked before even being sent for authorization, protecting you from known fraudsters.

Fine-Grained Exemption Management

With Bridge Pay, you don't just comply with regulations; you master them. Our dashboard allows you to define custom rules. For example, you can decide to systematically apply 3DS for all payments over €200, or for payments from certain geographic areas deemed riskier, while letting our TRA engine optimize other transactions. You stay in control while benefiting from our expertise.

Bridge Pay Expert Tip

Start with a conservative approach. Enable TRA exemptions on a limited segment of your traffic, for example, for your most loyal customers or for carts of a moderate amount. Analyze the impact on your conversion and fraud rate for a month. If the results are positive, gradually expand the scope. This A/B testing method allows you to optimize your revenue without taking excessive risks.

Comparison Table: 3D Secure vs. 2D Payment (via TRA)

To quickly visualize the differences, here is a summary table of the two approaches.

FAQ: 2D Payments and 3D Secure

Is it legal not to use 3D Secure?

Yes, it is completely legal as long as the transaction falls under one of the exemption cases provided by PSD2 (low value, TRA, recurring payment, etc.). Using a compliant payment gateway like Bridge Pay ensures that these exemptions are applied correctly.

Who is liable for fraud on a payment without 3DS?

The merchant is liable. This is why it is crucial to only disable 3DS when the risk is deemed very low by a powerful risk analysis tool. Otherwise, the costs associated with chargebacks can quickly become unsustainable.

Can I decide which transactions should go through 3DS?

Absolutely. This is the principle of "dynamic routing." A solution like Bridge Pay allows you to create custom rules (e.g., based on amount, country, or customer history) to decide in real time whether a transaction should be subject to strong authentication or not.

What is a good fraud rate to aim for to benefit from the TRA exemption?

To benefit from the broadest TRA exemptions (up to €500), your payment provider must maintain a fraud rate below 0.01%. This is a very ambitious target that requires advanced scoring and machine learning tools, which are at the core of Bridge Pay's technology.

My industry is considered "high-risk." Can I still use 2D payments?

Yes, but with extreme caution. For high-risk industries, an even more powerful TRA engine is necessary. Bridge Pay has recognized expertise in these sectors, with risk models specifically trained to identify complex fraud, allowing you to find an acceptable balance between conversion and security, even in challenging contexts.

Balance is the Key to Success

Navigating the world of payments without 3D Secure is a balancing act. On one side, there's the promise of a perfect customer experience and a higher conversion rate. On the other, the tangible risk of fraud and liability shift. Ignoring the potential of "frictionless" is leaving money on the table. Adopting it without a robust risk strategy is opening the door to significant financial losses.

The solution lies in a smart, dynamic approach. By understanding and leveraging PSD2 exemptions, and especially by relying on cutting-edge risk analysis technology, you can offer the best of both worlds. Payments become seamless for the vast majority of your legitimate customers, while security barriers are automatically raised against suspicious attempts.

At Bridge Pay, we do more than just process payments. We provide you with the intelligence and tools to optimize every transaction. Our platform is designed to turn regulatory and security complexity into a growth opportunity for your business.

Ready to optimize your payment funnel without compromising on security? Discover how our TRA engine can increase your revenue. Create your Bridge Pay account today or contact our experts for a personalized demo.