3D Secure Authentication Market

What is the 3D Secure authentication market worth? USD 1.44 billion in 2025, and USD 4.10 billion by 2035. 3D Secure (3DS) authentication is the check in which a merchant’s 3DS server asks the card issuer’s access control server (ACS) to confirm the shopper before a card-not-present (CNP) payment is authorised; the market covers the issuer, merchant and card-scheme fees for that check. Douglas Insights counts 36.8 billion 3DS authentications in 2025 at a blended USD 0.0391 each, which multiplies to USD 1.44 billion. Revenue compounds at 11.05% a year, a compound annual growth rate (CAGR) built from 12.4% volume growth and a 1.2% yearly price decline. The latest push came from the Reserve Bank of India (RBI), which issued its authentication directions for digital payment transactions on 25 September 2025: two factors on digital payments from 1 April 2026, and an issuer check on cross-border CNP card payments by 1 October 2026. The study belongs to the Douglas Insights banking, financial services and insurance practice and follows the published research methodology.

How much does one 3DS authentication cost an issuer, a merchant and a card scheme in 2025?

One 3DS authentication earned the value chain a blended USD 0.0391 in 2025, shared between the issuer’s ACS, the merchant’s 3DS server and the scheme directory. Douglas Insights expects that blend to fall 1.2% a year, reaching USD 0.0347 per 3D Secure authentication by 2035, as bank and processor volumes earn deeper tier discounts.

The issuer slice is the largest, about USD 0.0163 per authentication on our segment split. Douglas Insights puts hosted ACS contracts for mid-sized banks between USD 0.008 and USD 0.025 per authentication, depending on volume tier. Stripe charges USD 0.12 per standalone 3DS attempt, USD 0.03 per attempt on custom pricing and nothing extra on standard pricing. The merchant-side slice averages only USD 0.0107, because the largest payment service providers run their own 3DS servers.

Card schemes take about USD 0.0058 per authentication for directory services, risk scoring USD 0.0040 and mobile software development kit (SDK) work USD 0.0022. Frictionless approvals cost less to serve than step-ups, and acquirers now bundle 3DS into card pricing. Cheaper per check. Many more checks.

Which 3DS component makes the money: the access control server, the 3DS server or the directory?

Issuer access control server (ACS) services lead 3D Secure authentication with 41.7% of 2025 value, USD 600.0 million, because every request must be answered by the issuer.

Issuer access control server (ACS) services reach USD 1.56 billion by 2035 at 10.0% a year; banks pay per authentication and per enrolled card, and the ACS hosts the step-up screens. 3DS server and merchant plug-in services hold 27.4%, USD 394.3 million, earned by gateways that package each checkout request through a 3DS server or merchant plug-in (MPI). Directory server and scheme authentication services take 14.9%, USD 214.4 million, for routing run by Visa, Mastercard, American Express, JCB and domestic schemes. Risk-based authentication analytics account for 10.3%, USD 148.2 million, the scores that let an issuer approve without a step-up. Mobile SDK and integration services close at 5.7%, USD 82.0 million, for in-app code and certification projects.

Risk-based authentication analytics grow fastest, at 15.4% a year to USD 620.7 million, because every frictionless approval needs a risk score and exemption rules reward issuers with low fraud rates. Directory services grow slowest at 8.9%. Segment values for 2035 sum to USD 4.12 billion, within 0.34% of the headline.

Why are 3DS authentication volumes climbing 12.4% a year?

3DS authentication volumes climb 12.4% a year because card-not-present payments keep growing and more countries mandate an issuer check. Four drivers supply 6.1, 3.2, 1.7 and 1.4 points of that volume leg, taking 36.8 billion authentications to 118.4 billion by 2035.

Online card growth supplies 6.1 points. Visa’s fiscal 2025 annual report, filed on 6 November 2025, reports 329 billion transactions on its brand, 258 billion of them processed by Visa, nearly 5 billion payment credentials and more than 16 billion tokens. Mastercard reports 175.5 billion switched transactions for 2025, up 10%, on 3.391 billion cards. Douglas Insights estimates 171.3 billion CNP card transactions worldwide in 2025, and 21.5% of them pass through a 3D Secure authentication request. E-commerce keeps taking share of card spend, so the CNP pool grows faster than card transactions as a whole.

Mandates add 3.2 points. The RBI directions of 25 September 2025 apply from 1 April 2026 and require that all digital payment transactions be authenticated by at least two distinct factors, one of them dynamic. Issuers must also validate non-recurring cross-border CNP card payments from 1 October 2026, which pulls foreign merchants selling to Indian cardholders into 3DS. Douglas Insights models India at 2.9 billion 3D Secure authentications in 2025, the fastest-rising national pool through 2030.

In-app and new message types add 1.7 points. The EMV 3DS mobile SDK puts the authentication inside a merchant app, and Data Only requests let a merchant send rich order data to the issuer without any cardholder screen. Douglas Insights tracks 2.1 billion Data Only messages in 2025, 5.7% of all 3DS authentications, priced lower but adding to the count. In-app checkout carries 28.8% of 3DS traffic in 2025 on our estimates, and its share gains about 1.5 points a year as wallets and super-apps move checkout into native code.

Voluntary use in the United States and Latin America adds the last 1.4 points. With no mandate, a US merchant sends 3DS on high-risk orders for the liability shift: a fraud chargeback on an authenticated transaction moves to the issuer. Our model puts North American 3DS penetration at 8.4% of CNP transactions in 2025, against 46.8% in mandated markets, so small gains there move billions of requests. The four drivers sum to the 12.4% volume leg, and the 1.2% price decline is netted against it.

What limits 3DS authentication volumes as SCA exemptions and payment passkeys spread?

Three restraints remove 3.7 points from 3D Secure authentication volume growth in the slower case, cutting it from 12.4% to 8.7% a year and leaving the 2035 value USD 1.40 billion lower.

Exemptions are the first, worth 1.6 points. Strong customer authentication (SCA) rules let a payment skip the step-up when it is low value, recurring or scored low risk by a transaction risk analysis (TRA) engine, and acquirers flag those exemptions in the authorisation instead of sending a 3DS request.

Payment passkeys and tokens are the second, worth 1.3 points. Mastercard’s 2025 annual report describes its Payment Passkey Service and states that about 40% of Mastercard transactions are now tokenised; a passkey inside a tokenised checkout carries proof without a separate 3DS round trip.

Checkout friction is the third, worth 0.8 points. Douglas Insights estimates that 25.6% of 3D Secure authentications in 2025 still end in a step-up, and merchants outside mandated markets switch 3DS off when abandonment outweighs fraud savings.

Who wins issuer ACS contracts and merchant 3DS server deals?

Visa leads 3D Secure authentication with a 16.4% share of 2025 value on Douglas Insights estimates, and the top three hold 38.9%. Scheme directories and the largest bank ACS platforms sit with Visa, Mastercard and Broadcom.

Visa owns CardinalCommerce, a merchant 3DS server and rules engine, and lists the Visa Consumer Authentication Service among its risk products. Mastercard holds 12.7% through Identity Check and its passkey service. Broadcom takes 9.8% with issuer ACS software inherited from CA Technologies and its Arcot platform. G+D Netcetera holds 6.1%: it says its 3DS services protect over 200 million cards across more than 1,000 European banks. Outseer earns 4.8% from a risk-based issuer ACS, and Entersekt 3.6% from a hosted ACS whose named clients include SEB Baltic. Stripe captures 2.3% on the merchant side, and Sydney-based GPayments 1.9% from licensed ActiveServer and ActiveAccess software. Shares are estimates built from authentication counts, client lists and list prices, since no vendor discloses 3DS revenue.

Where do 3DS authentications grow fastest, from Europe to Asia Pacific?

Europe leads 3D Secure authentication with USD 522.3 million in 2025, 36.3% of value, because SCA under Regulation (EU) 2018/389 has made 3DS the default on online card payments since 14 September 2019.

Asia Pacific is the fastest region at 14.60% a year, from USD 358.3 million to USD 1.40 billion, because India’s two-factor rule and cross-border CNP check add billions of authentications. Europe grows a mature 7.90% to USD 1.12 billion, since most eligible payments already pass through 3DS. North America holds USD 405.8 million and grows 10.60% on voluntary liability-shift use. Latin America is worth USD 90.7 million and grows 12.20%, helped by fraud-heavy cross-border e-commerce in Brazil and Mexico.

Middle East and Africa is the wildcard: USD 61.8 million growing 11.84% to USD 189.2 million, but one central-bank mandate of the Indian kind in a large Gulf card market would lift that path sharply. Douglas Insights expects Asia Pacific to overtake Europe as the largest 3DS region before 2035.

How often does a 3DS authentication pass as frictionless flow instead of a cardholder step-up?

About 68.7% of 3D Secure authentications in 2025, 25.3 billion, pass as frictionless flow on Douglas Insights estimates, approved by the issuer’s risk engine with no screen shown to the cardholder.

Challenge flow, the passcode, banking-app approval or biometric step-up, covers 25.6%, or 9.4 billion authentications. Data Only covers 5.7%, 2.1 billion messages that share order data without asking for authentication.

Browser checkout carries 71.2% of 3DS traffic and in-app checkout the remaining 28.8%. Card issuers, merchants and payment service providers each buy a different piece of the same 3D Secure authentication message.

Which PSD2 and RBI rules make 3DS authentication mandatory?

Two rule sets carry most of the 63.3% of 3D Secure authentications that mandates create: the EU second Payment Services Directive (PSD2) standards on SCA and India’s RBI directions.

Commission Delegated Regulation (EU) 2018/389 was adopted on 27 November 2017 and has applied since 14 September 2019. It requires two independent elements for remote card payments and sets exemptions, including payments up to EUR 30, across 30 European Economic Area (EEA) countries.

India’s RBI directions of 25 September 2025 take effect on 1 April 2026 and keep seven exemptions, among them small contactless payments and recurring e-mandates. Issuers register their bank identification numbers with card networks for the cross-border CNP check due on 1 October 2026. The UK, Japan and Australia run similar regimes that can require 3D Secure authentication.

How far has EMV 3DS 2.3.1 displaced the 2.1 and 2.2 message versions?

Version 2.2 still carries about 81.3% of 3D Secure authentication messages in 2025 on Douglas Insights estimates, with 2.3.1 at 11.2% and 2.1 at 7.5%, because issuers upgrade only when schemes retire older versions.

EMVCo, the scheme-owned body behind the Europay, Mastercard and Visa (EMV) specifications, published EMV 3DS 2.3.1 on 29 September 2022, adding data for Secure Payment Confirmation (SPC), out-of-band (OOB) support and a bridging extension for 2.1 and 2.2 products. Outseer reported in 2021 that 46% of its European 3DS transactions ran on EMV 2.x, against 37% in the Americas.

Does 3DS authentication cut card fraud, and by how many times in the EEA?

Card fraud in the EEA ran 10 times higher when the counterpart sat outside the area, where 3D Secure authentication is not mandated. The European Banking Authority (EBA) and European Central Bank (ECB) published that finding in their joint payment fraud report on 1 August 2024.

The same report put EEA payment fraud at EUR 4.3 billion in 2022 and EUR 2.0 billion in the first half of 2023, and found lower fraud rates on SCA-authenticated card payments by value and count.

What if India’s AFA model is copied, and what is 3D Secure authentication worth in 2035?

In the base case 3D Secure authentication reaches USD 4.10 billion in 2035, on 12.4% yearly growth in authentications and a 1.2% yearly price decline, with volume rising to 118.4 billion authentications.

The slower case assumes exemptions and payment passkeys pull traffic away from the ACS, so the 2035 figure stops at USD 2.71 billion. The faster case assumes more central banks copy the additional factor of authentication (AFA) rule India applied from 1 April 2026 under its directions of 25 September 2025, lifting the total to USD 5.53 billion. One extra point of yearly authentication growth lifts the 2035 base to USD 4.48 billion, a gain of USD 380.2 million. Published forecasts run from about 10.66% to 13.3% a year; our 11.05% sits in the lower third because we net a falling price per authentication against volume.

Douglas Exclusive: the 3DS mandate atlas

The 3DS mandate atlas is a Douglas Insights model built from 61 jurisdictions and 248 inputs that sorts every 3D Secure authentication by the legal reason it exists. Inputs cover card counts, CNP transaction estimates, mandate status and exemption rules.

Mandated jurisdictions, the 30 EEA countries plus the UK, India and Japan, carry 63.3% of authentications while holding only 29.1% of CNP transactions. Penetration there is 46.8%, against 11.1% in the 28 voluntary jurisdictions led by the United States, Canada, China, Brazil and Mexico.

The finding: growth in 3D Secure authentication no longer depends on Europe. Each 1 point of extra penetration in the voluntary tier adds 1.22 billion authentications, worth about USD 47.5 million at the 2025 price.

Methodology: what receipts sit under the 36.8 billion 3DS authentication count?

Our receipt multiplies 171.3 billion CNP card transactions by 21.5% 3DS penetration to reach 36.8 billion authentications, then multiplies 36.8 billion by USD 0.0391 to reach USD 1.44 billion.

The model covers 61 jurisdictions, 5 regions, 5 segments, 3 authentication flows and 8 named vendors, from 248 data points: scheme transaction counts, card counts, mandate dates, exemption rules, list prices and 6 published growth rates.

Three cross-checks follow. Segment values for 2035 sum to USD 4.12 billion, 0.34% above the headline. A published 2025 value of USD 1.35 billion sits 6.2% below our figure. G+D Netcetera’s 1 billion yearly 3DS and Giro transactions equal 6.8% of the 14.7 billion European authentications in our model, close to its 6.1% share. Multiplying 1.124 by 0.988 and subtracting 1 returns the 11.05% revenue rate. Related security spending is tracked in the Industrial Cybersecurity and OT Protection Market and Connected Vehicle Cybersecurity Market reports, and legacy card platforms in the Mainframe Modernization Services Market report.

Sources

1. Reserve Bank of India Authentication mechanisms for digital payment transactions Directions, 2025 (2025)
2. EUR-Lex, Publications Office of the EU Commission Delegated Regulation (EU) 2018/389 on strong customer authentication (2018)
3. EMVCo EMV 3DS 2.3.1 release (2022)
4. European Banking Authority EBA and ECB joint report on payment fraud (2024)
5. US SEC EDGAR Visa Inc. Form 10-K, fiscal 2025 (2025)
6. US SEC EDGAR Mastercard Inc. Form 10-K, 2025 (2026)
7. Stripe Stripe pricing: 3D Secure fees (2026)
8. Stripe 3D Secure authentication documentation (2026)