On Stripe, 3D Secure is an extra authentication step on a card payment. The cardholder enters card details, the issuer may finish the check without a prompt, or the issuer may require a challenge such as a one-time code. Stripe can start the step when a regulation, an issuer soft decline, or Stripe's own rules call for it. You can also request it through Radar or the API, but Stripe says its APIs cannot turn 3D Secure off, and the issuer chooses the final flow. The WooCommerce Stripe extension documents support on checkout and on the pay-for-order page. Successful authentication does not guarantee liability shift. Stripe also says some payments, including some wallets and off-session payments, do not support 3D Secure. Your provider has to say which of its rules apply to the account. Confirm who is authorized to manage any supported authentication setting; provider and issuer requirements still apply. Describe the work you need. Prism will confirm scope, responsibilities, fees, and terms before work begins.
For: An owner or authorized representative of a research-use-only peptide business whose card checkout may ask the cardholder to authenticate.
Updated 2026-09-21
Where the extra step sits
Stripe's authentication guide shows three moments. The customer enters card details. The issuer assesses the payment and can complete 3D Secure there. If the issuer requires it, the customer completes another step. Stripe.js can show that step in a modal, or the integration can redirect or use an iframe. Stripe says you cannot restyle the issuer's screen to match the store. The issuer controls the fonts and colors.
In the Payment Intent flow Stripe documents, a required authentication moves the PaymentIntent to requires_action. Authenticated success leads Stripe to attempt the charge. Failure moves it to requires_payment_method, so a different payment method is needed, or 3D Secure can be tried again by reconfirming. Some other results, such as attempt_acknowledged, can still proceed to a charge. Stripe says an Indian e-mandate is an exception: anything but authenticated is treated as failure.
The charge's three_d_secure result is how you later see whether authentication was attempted and how it ended. This page is about that journey. It is not the place to interpret an address or security-code result, and it is not a diagnosis of one failed order.
Who decides that the step runs
Stripe says it triggers 3D Secure automatically when regulations such as Strong Customer Authentication require it, when an industry guideline such as the Credit Card Security Guidelines in Japan applies, when an issuer requests it with a soft decline, or when certain Stripe optimizations apply. Its overview says SCA under PSD2 in the EEA, and similar regulations in the UK, India, Japan, and Australia, might require 3D Secure, and that 3D Secure is optional in other regions. That is Stripe's description of regulation. It is not a Prism country list and not a finding that your business must use the step.
You can add Radar rules, if your Stripe plan includes the control Stripe describes, or set request_three_d_secure on a PaymentIntent, SetupIntent, or Checkout Session. The value any prefers a frictionless flow. The value challenge prefers a prompt. Stripe says it cannot guarantee the preference, because the issuer decides. Providing the parameter overrides dynamic Radar rules for that payment. It does not override Stripe's mandatory authentication rules, and it cannot switch 3D Secure off.
An exemption is one reason Stripe gives for not requiring the step. This page does not list exemption amounts or thresholds. Ask the provider which exemptions, if any, it will apply. Another provider's checkout can behave differently. Do not copy a Stripe rule onto an account that is not Stripe.
What the WooCommerce extension adds, and what wallets do not replace
WooCommerce's Stripe extension page says the extension supports 3D Secure on the checkout page and on the pay-for-order page. It also points to Stripe test cards and the extension's test mode. It does not say that support means every order will show a challenge, and it does not say the extension decides liability.
Stripe's authentication guide says not every transaction supports 3D Secure. Wallets and off-session payments are the examples it gives. A wallet button is a separate compatibility question. Offering the button does not mean 3D Secure ran, and a 3D Secure challenge does not mean a wallet is available.
If authentication is not available for the card, or an error occurs during it, Stripe says the payment proceeds normally. That sentence is about the payment continuing. It is not a statement that the payment is approved for fraud purposes.
Liability shift is not a promise
Stripe's authentication guide says successful 3D Secure authentication does not guarantee liability shift. It says liability shift can be expected for successfully authenticated payments that later receive eligible fraud disputes, and that it is not guaranteed for any specific payment or dispute. A charge.succeeded event only confirms that the payment succeeded. A three_d_secure result of authenticated only confirms that authentication succeeded. An electronic commerce indicator can help assess eligibility and does not guarantee the shift. Card-network rules and the facts of the dispute decide the outcome.
The same guide says that if the card does not support 3D Secure, or authentication errors, liability does not generally shift, because authentication did not succeed. It also lists cases where the shift might not apply, including some fraud-monitoring programs and some industries Visa has exempted. Those examples are Stripe's, and Stripe says they are not a complete list. A non-fraud dispute, such as goods not received, follows the ordinary dispute process.
You can ask the provider, in writing, whether 3D Secure is available on your account, who can request it, and how that provider describes liability. You cannot decide the issuer's challenge. Prism can help you describe the checkout question. Any authentication implementation must be within an agreed, authorized scope. It does not guarantee liability protection or account approval. Scope, fees, and terms are discussed before a consultation becomes work.
Authentication questions for the provider
Use this before you change a checkout setting. Quote the provider's written answer rather than filling a row from this summary. Worksheet entries are not submitted by this worksheet or saved by this site. Use only non-sensitive summaries; do not enter credentials, government identifiers, card or bank-account numbers, private receipt links, or customer details.
Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.
Authentication questions for the provider. The last column is for temporary notes.
Question
What Stripe or the WooCommerce extension documents
Who can answer it for your account
Your record
Does this checkout support 3D Secure?
What Stripe or the WooCommerce extension documentsThe WooCommerce Stripe extension says it supports 3D Secure on checkout and on the pay-for-order page. Another plugin needs its own page.
Who can answer it for your accountThe extension list and the provider. Leave blank for an unnamed plugin.
When will a challenge appear?
What Stripe or the WooCommerce extension documentsStripe starts 3D Secure for documented regulatory, issuer, and Stripe reasons. The issuer decides whether the customer sees a challenge. Stripe cannot guarantee a frictionless or challenge preference.
Who can answer it for your accountThe provider's settings for this account, not a test on one card.
Can we turn it off?
What Stripe or the WooCommerce extension documentsStripe says its APIs cannot manually turn 3D Secure off. Mandatory rules still run if you also request it.
Who can answer it for your accountThe provider. Do not assume a store setting overrides the issuer.
What does failure do to the order?
What Stripe or the WooCommerce extension documentsStripe moves a failed authentication to requires_payment_method. The customer needs another payment method, or the payment can be reconfirmed.
Who can answer it for your accountThe order status and the provider's payment record together.
Did authentication run on a past payment?
What Stripe or the WooCommerce extension documentsStripe records the result on the charge's three_d_secure property when the customer attempted authentication.
Who can answer it for your accountThat charge in the provider dashboard. Do not paste the card number here.
Does a wallet replace this step?
What Stripe or the WooCommerce extension documentsStripe says some wallet and off-session payments do not support 3D Secure. The wallet button is a separate check.
Who can answer it for your accountThe integration in use. A visible button is not an authentication result.
Does success shift liability?
What Stripe or the WooCommerce extension documentsStripe says successful authentication does not guarantee liability shift for any specific payment or dispute.
Who can answer it for your accountThe provider, in writing. Do not treat an approval of the payment as a liability result.
Which regulatory requirement applies?
What Stripe or the WooCommerce extension documentsStripe says SCA and similar rules in named regions might require 3D Secure, and that it is optional elsewhere. Another provider may describe the duty differently.
Who can answer it for your accountThe provider and qualified counsel. This page does not decide the duty.
These are temporary notes. Leaving or reloading this page may clear them. The consultation form does not include these entries.
Limits
A Prism consultation can help you organize the facts and discuss the website or processing question. The payment provider decides eligibility, pricing, reserves, and whether an account is opened or closed.
Successful authentication, a successful charge, and an electronic commerce indicator do not guarantee liability shift.
This page does not diagnose one failed authentication and does not state exemption amounts.
Stripe 3D Secure overview — checked 2026-09-21. 3D Secure adds an authentication layer. The issuer might request a password, one-time code, or biometric check. Stripe says SCA and similar regulations in the EEA, UK, India, Japan, and Australia might require it, and that it is optional in other regions.
Stripe 3D Secure authentication flow — checked 2026-09-21. Stripe documents when it starts 3D Secure, the issuer's control of the flow, PaymentIntent statuses, the inability to turn 3D Secure off through the API, wallet and off-session exceptions, and the statement that successful authentication does not guarantee liability shift.
Prism solutions — checked 2026-09-21. The provider decides eligibility and account terms. Prism discusses scope, fees, and terms before work and does not publish an authentication setting.
Request a consultation
Describe the business and this specific question. Prism follows up by email to discuss fit and scope. An inquiry is not a processing application or an approval.