How Liability Shift Works

Ask any payment professional what the #1 benefit of 3D Secure is, and most will say the same thing: liability shift. It's the mechanism that moves fraud chargeback responsibility from the merchant to the card-issuing bank. But the details matter, and many merchants either overestimate or underestimate what liability shift actually covers.

When a customer makes an online purchase and the transaction is authenticated through EMV 3D Secure, the fraud liability "shifts" from the merchant to the card issuer. Here's the step-by-step:

Customer initiates checkout on your site
Your 3DS provider (like PAAY) collects 150+ data points and sends an authentication request to the card issuer
The issuer's risk engine evaluates the data and either approves frictionlessly or triggers a challenge
Once authenticated, the transaction is marked with a 3DS authentication indicator
If a fraud chargeback occurs later, the issuer — not you — absorbs the loss

What Liability Shift Covers

Liability shift applies to fraud-related chargeback reason codes. These include:

Visa: Reason codes 10.1 through 10.5 (fraud-related disputes)
Mastercard: Reason codes 4837 (No Cardholder Authorization), 4840 (Fraudulent Processing), 4849 (Questionable Merchant Activity), 4871 (Chip/PIN Liability Shift)

These fraud-coded chargebacks represent more than 70% of all ecommerce disputed transactions (Source: GPayments, citing Visa and Mastercard reason code data). That's a massive portion of your chargeback exposure eliminated.

What Liability Shift Does NOT Cover

This is where misunderstandings happen. Liability shift does not protect against:

Product/service disputes: "The item arrived damaged" or "I never received my order"
Billing disputes: "I was charged twice" or "The amount is wrong"
Subscription cancellation disputes: "I cancelled but was still charged"
Quality disputes: "The product doesn't match the description"

These are customer service issues, not fraud issues, and they require operational solutions (better fulfillment, clear billing descriptors, easy cancellation flows).

Visa vs. Mastercard: A Key Difference

There's an important distinction between the two major networks when a card is not enrolled in 3DS:

Visa: If you attempt 3DS authentication and the card is not enrolled, Visa still provides liability shift. The merchant is protected.
Mastercard: If the card is not enrolled, liability stays with the merchant. No protection.

This difference means Visa transactions get broader protection through 3DS, while Mastercard protection requires the card to be actively enrolled (Source: GPayments).

3DS 1.0 No Longer Qualifies

Both Visa and Mastercard have deprecated 3DS 1.0. As of 2024, merchants must use EMV 3DS (version 2.1 or higher) to receive liability shift. If your integration is still on the old protocol, you're authenticating without protection (Source: Visa, September 2024; Mastercard, July 2024).

The Financial Impact

Consider the math: if fraud-related chargebacks make up 70%+ of your disputes, and each chargeback costs 2-3x the transaction amount (when you factor in fees, lost merchandise, and operational costs), then liability shift on authenticated transactions can transform your fraud economics.

Visa data shows that authenticated transactions have 45% lower fraud rates to begin with (Source: Visa). So you're not just shifting liability on existing fraud — you're also preventing a significant portion of it from occurring at all.

Getting Started

Liability shift activates the moment you start authenticating transactions through EMV 3DS. There's no waiting period, no qualification threshold. PAAY merchants typically go live in 3-5 days and start receiving liability protection on their first authenticated transaction.

to learn how PAAY can protect your business with 3DS liability shift.

How Liability Shift Works — and Why It's Your Most Powerful Fraud Defense