Quick Answer
Yes, but only on the first charge. US subscription merchants should authenticate signup with 3-D Secure, save the card for off-session use, and bill every renewal as merchant-initiated. No new challenge.
Key Points
- Two-factor authentication is not mandated in the US, according to a 2019 Electronic Transactions Association Q&A, so 3-D Secure on subscriptions is a business choice.
- Datos Insights found in November 2023 that about 2.7% of North American card-not-present payments run through 3-D Secure, with fraud rates nearly six times higher.
- Chargebacks911's 2026 Chargeback Field Report puts friendly fraud at at least half of chargebacks, and 3DS does not prevent subscription confusion or unclear billing descriptors.
One authentication at signup, then renewals run on the stored card.
Most 3-D Secure advice is written for Europe. US subscription merchants face a different question: where does one authentication step earn its place in a billing cycle that may run for years?
My view is that it belongs on the signup charge, and the order of operations matters as much as the decision. Commenters in a 2025 r/stripe thread offered two fixes for failing subscription charges: save the card for off-session use, or have the customer pick a plan first and pay the first invoice to start the subscription. Both lead to the same setup. Below is how it works, what it misses, and what underwriters look for once your renewals start running.
Europe's PSD3 overhaul keeps strong customer authentication in place but does not expand it to every transaction. US subscription sellers face no mandate at all. That makes 3-D Secure a business decision here, not a compliance one.
My answer is simple. Authenticate the first charge. The research section below shows where that protection stops. Get the order wrong, and a 2025 r/stripe thread shows what happens: 3DS cards that pass verification at signup can still fail the moment the subscription charges them.
What does 3-D Secure actually do for a US subscription business?
3-D Secure lets the card issuer confirm the cardholder at checkout, and an authenticated order moves fraud liability off the merchant. In the US, using it is optional.
Before deciding where it belongs in your billing flow, work through three questions:
- Is the cardholder present right now? Only then can they complete a challenge.
- Is this the riskiest payment in the relationship? For most subscriptions, the first charge is.
- Would a challenge here cost revenue you already earned? On a renewal, it usually would.
The mechanics are simple. As Henry Ly's 2024 guide describes it, the merchant sends the transaction details to the issuer, the issuer checks whether the card is enrolled, triggers authentication if it is, and returns the result before authorization. He also notes that 3DS is "not mandatory for all online transactions."
The common assumption is that 3DS means a pop-up on every order. In the US, it rarely does. In a 2019 Electronic Transactions Association Q+A, Kevin Crockett of CardinalCommerce explained that two-factor authentication is not mandated in the US and that most US issuers run risk-based authentication, so step-up challenges were absent or very rare. Merchants using 3DS, he added, get liability protection on orders that turn into fraud.
Honestly, US merchants earned their distrust. Even a 3DS vendor has conceded that the first version's password pop-ups drove shoppers away, which is why address verification won out here on usability rather than security.
Our underwriting team made a related point in September 2026 about a different segment entirely: a processor isn't pricing the label on your business, it's pricing the shape of your payments. Subscriptions have a shape too, and it gets set at signup. That's how we approach merchant payment processing solutions for recurring billing businesses.
A review of 5 sources points the same way. Authenticate while the customer is there. Then get out of the way, which raises the real question: what happens to every charge after the first?
Where does 3-D Secure stop protecting a US subscription business?
In North America, about 2.7% of card-not-present payments run through 3-D Secure. Those authenticated payments carry far more fraud than the rest, which is the reverse of Europe's pattern.
The figures come from Datos Insights, a payments research firm, in a November 2023 report on card-not-present fraud and 3-D Secure. Mike Cassidy cited them in September 2026 on the blog of Signifyd, a fraud protection vendor. Datos found the same protocol producing opposite results on either side of the Atlantic.
Same protocol, opposite results
- North America: 3DS covers 2.7% of card-not-present transactions. Fraud rates on those transactions are nearly six times higher than on all card-not-present transactions.
- Europe and Australia: 3DS covers 25% to 50% of card-not-present transactions. Fraud rates on those transactions are three to six times lower than on all card-not-present transactions.
Datos Insights, November 2023, as cited by Signifyd, September 2026.
The research does not say why the US numbers run backward. One possible reason comes from a 2019 panel of authentication specialists hosted by the Electronic Transactions Association. Panelists said a merchant selling higher risk items may accept more friction "and in some cases even request it." If US merchants mostly send their riskiest orders through 3DS, those orders would look worse on paper. Cassidy adds a second problem: "for some issuers, orders arriving on the 3DS rails are immediately suspect." He warns that this suspicion could cost "a high preponderance of lost sales" and advises merchants to check each issuer's track record. Signifyd sells its own fraud protection, so it has a stake in how merchants judge 3DS. Even so, his caution matches the data.
None of this cancels the payoff at signup, where an authenticated order moves fraud liability to the issuer. Subscriptions keep billing after that moment, though, and a merchant's July 2025 post on a Reddit payments forum shows what can happen next. The merchant ran 3DS on a trial "billed at a symbolic amount," captured the payment right away and stored a token for later billing. When the paid plan started, the merchant reported "a high rate of failed payments" and suspected "card testing, abusive use of trials." Other forum members advised adding a fingerprinting tool to catch repeated attempts from one IP address and bot-like activity.
A single business wrote that account, with no figures attached, so it cannot show how common the problem is. It does show where authentication's job ends. 3DS confirmed a cardholder at a token price. It could not show whether that person meant to pay for the months that followed. Cassidy makes the general point: 3DS is "not a standalone solution for fraud prevention" and should sit alongside device fingerprinting and other checks.
Disputes reach even further past authentication. Europe offers the clearest view, because 3DS-based strong customer authentication became mandatory there.
Stolen-card fraud dropped sharply, and chargebacks filed by real customers grew. Amber the Chargeback Nerd, who writes a newsletter on disputes, cites Chargebacks911's 2026 Chargeback Field Report, which puts friendly fraud at "at least half of chargebacks." Chargebacks911 sells dispute management, so it has a stake in that figure. She also lists what 3DS does not prevent, and several items on that list are everyday subscription problems.
"Fraud didn't vanish. The signal just got clearer."
Amber the Chargeback Nerd, chargeback newsletter writer, 2026
| Dispute reason | Does 3DS on the signup help? |
|---|---|
| A fraudster uses a stolen card on the authenticated order | Yes. Fraud liability shifts to the issuer. |
| Subscription confusion | No |
| Unclear billing descriptor | No |
| Refund delays | No |
| Item not received | No |
| Intentional first-party misuse (friendly fraud) | No |
All three findings point the same way. 3DS settles one question well: whether the person paying at signup is the cardholder. A subscription then raises new questions every month. Will the renewal clear, did the customer mean to stay, and will they recognize the charge on their statement? In the US, issuers do not always welcome the authentication itself. The first charge is the right place for 3DS, and most of a subscription's remaining risk shows up in renewals and disputes. As a processor that boards subscription businesses, we see underwriters weigh that later stretch closely.
- Before you put every signup through 3DS, ask your processor for approval rates on 3DS orders and non-3DS orders, broken out by issuing bank where possible.
- Track the failure rate on the first paid charge after a trial separately from later renewals. If it spikes, look at signup signals such as repeated attempts from one IP address and bot-like behavior before you blame the banks.
- Ask whether your fraud screening at signup covers device and behavior signals, since 3DS was never meant to work alone.
- Sort your chargebacks by reason. Fraud claims on authenticated orders are where the liability shift applies. Subscription confusion, descriptor and refund complaints need fixes in billing and customer service.
How we checked this
We drew on a fraud vendor's 2026 analysis that cites Datos Insights research, a 2026 chargeback newsletter that cites an industry dispute report, a 2019 trade association panel on authentication, and one merchant's 2025 forum post. No figures in this section come from our own business. The Datos comparison dates from November 2023 and does not explain why US 3DS transactions carry more fraud. The European chargeback figures come from Signifyd's own network. The forum post is a single translated account with no numbers. Signifyd and Chargebacks911 both sell fraud or dispute services, and we process payments for subscription and high-risk businesses, so each of us has a stake. Still unknown: how often renewals fail after an authenticated trial across US merchants, and which US issuers treat 3DS orders with suspicion.
- Mike Cassidy, Signifyd, analysis of 3D Secure authentication, September 15, 2026.
- Amber the Chargeback Nerd, newsletter on 3-D Secure and disputes, July 27, 2026.
- Electronic Transactions Association, Q&A on ecommerce and EMV 3DS, July 11, 2019.
- Merchant post on r/PaymentProcessing, recurring payment failures after a 3DS trial, July 2, 2025.
How do you flag renewals as merchant-initiated so they don't fail?
Save the card for off-session use when the first charge is authenticated, then bill every renewal against that stored credential as a merchant-initiated charge, with no new challenge.
Getting authentication right isn't enough on its own. A merchant posting in r/PaymentProcessing in 2025 described a setup most of us would call correct: "The initial payment is processed using 3-D Secure, with immediate capture, and a token is generated for future recurring payments." They still reported "a high rate of failed payments when the subscription starts."
Order of operations is often the culprit. In a 2025 r/stripe thread, a developer's 3DS test cards saved fine and passed the verification dialog, then failed the moment a plan was selected and charged. Commenters offered two fixes: save the card with a SetupIntent and set future usage to "off_session," or flip the flow so the customer picks a plan first and pays the first invoice with the card they add.
Here is the sequence I'd set up for any recurring billing credit card processing flow:
- Authenticate while the customer is present, at the first invoice or the card-add step.
- Save the credential for future off-session use in that same step, not in a later call.
- Create the subscription with the first payment, so the authenticated charge and the stored card are tied together.
- Send each renewal as a merchant-initiated charge on the stored credential. Don't re-prompt.
Even Europe, where strong customer authentication is law, lists fixed-amount subscriptions as a common exemption from repeat challenges. And when a customer can't pass a challenge and no exemption applies, the payment is usually declined. A US merchant challenging every renewal is being stricter than the EU requires. That's a lost renewal you chose.
| Approach | First charge | Renewals | Liability shift | Customer friction |
|---|---|---|---|---|
| 3DS on every charge | Authenticated | Challenged again, often with no customer present | Only on charges that complete authentication | Repeated; declines when a challenge goes unanswered |
| 3DS on first charge only | Authenticated, credential stored | Merchant-initiated on the stored credential | On the first charge | Once, at signup |
| No 3DS | Not authenticated | Merchant-initiated | None | None |
Some fraud vendors also suggest authenticating when a customer adds a payment method, with no charge attached. My advice is to use it sparingly and tell customers why the prompt appears. For customers whose cards keep declining at renewal, Seamless ACH bank payments can sit behind the card as a secondary rail, while card stays primary. Fewer failed renewals also means a cleaner billing history, and that is exactly what an underwriter reads first.
How do subscription businesses get approved for recurring billing merchant accounts?
Approval comes down to whether an underwriter can see a controlled billing pattern: authenticated signups, clean renewals, clear consent, and a dispute history that stays low month after month.
Authentication is part of that picture, but only part. In the same 2019 ETA Q+A, Google's Steve Klebe argued that when to step up a customer depends on product value and the merchant's current chargeback standing. I read that as a case for selective authentication. Blanket use isn't the goal.
If I were preparing a subscription business for underwriting, I'd want three things documented:
- Where authentication happens in the flow, and why it sits there.
- How renewals are flagged as merchant-initiated, and how failed ones are retried.
- How the customer agrees to recurring billing at signup.
A first-charge setup answers all three cleanly. It shows the riskiest payment was authenticated, the later ones were billed on a stored credential, and the customer said yes up front. That's a far easier story to tell than an unexplained closure.
If a Stripe or Shopify closure has already left a mark on your record, look at TMF/MATCH list merchant account approval before you reapply anywhere. SeamlessChex works with established businesses processing at least $25,000 per month, so the billing history you bring is part of the application.
Comparing processors? Ask each one where it expects 3DS to sit and how it treats merchant-initiated renewals. A vague answer is an answer.
What should US subscription merchants do with 3-D Secure next?
Treat signup authentication as settled and put your next effort into disputes, billing descriptors and trial design, because authentication alone won't settle your chargeback exposure.
It's often said that 3DS helps minimize chargebacks. True, but only for one kind. Chargebacks911's 2026 Chargeback Field Report puts friendly fraud at no less than half of all chargebacks, and 3DS does nothing about subscription confusion, unclear billing descriptors, or buyer's remorse.
A quick aside on trials. If you run a low-priced trial, I'd look hard at whether a pre-authorization for the trial amount serves you better than an immediate capture, since some merchants have already moved that way.
So treat first-charge 3DS as the floor. Clear descriptors, easy cancellation, and fast refunds do the rest of the work, and they're what keeps a recurring billing credit card merchant account healthy long after signup.
Frequently Asked Questions
What else do subscription merchants ask about 3-D Secure?
Most follow-up questions are about what 3DS cannot fix, why a signup authentication fails, and how fast a recurring billing business can get a new account.
Will 3-D Secure stop disputes on my subscription?
Not most of them. Amber the Chargeback Nerd lists what 3DS does not prevent, including Item Not Received claims, Not as Described complaints, and refund delays. Those are operational problems. They need clear fulfillment and a fast refund process.
Why would a customer fail authentication at signup?
Often for mundane reasons. An expired card, a new phone number that no longer receives the one-time code (OTP), or a technical problem at the issuing bank can each break the step. I'd give the customer a clear retry path before treating it as fraud.
How soon can SeamlessChex onboard a subscription business?
SeamlessChex offers same-day onboarding with no contracts for credit card processing, including subscription and high-risk businesses other processors turn away. Start through the SeamlessChex contact page.
Written by
Lily Flanigan
Operations Manager, SeamlessChex
Lily Flanigan is Operations Manager at SeamlessChex, a credit card processing and fintech payments platform recognized on the Inc. 5000, where she focuses on operations and process optimization.
Connect on LinkedInSeamlessChex works with established businesses processing a minimum of $25,000 per month.