Payment fraud and 3-D Secure

Payment fraud in an online store is an attempt to obtain goods or money using someone else's card data, by deceiving the customer, or through a dishonest payment dispute. 3-D Secure (3DS) is a protocol by which the issuing bank additionally verifies that the card is being used by its owner.

In plain words

A card online works without physical presence: the store sees neither the card nor the face. So the parties exchange data, and the bank assesses the risk. EMVCo, the organization that maintains the standard, describes it this way: the merchant passes the bank data about the transaction, the payment and the device; the bank assesses the risk and either approves the purchase or asks for confirmation. For many purchases everything happens without extra steps ("clicked Buy and the payment went through"), while riskier ones require confirmation: a one-time code, a question or biometrics (EMVCo).

This is how EMV 3DS works. Version 2.1 supports the EU's strong customer authentication requirements (PSD2), but EMVCo recommends considering 2.2 and newer for optimal capabilities (same source).

What is happening in Ukraine

According to National Bank of Ukraine (NBU) data for 2025 (published April 2026), the number of fraudulent card transactions fell by 5% to 256 thousand, while losses grew by 24% to UAH 1.4 billion; the average amount of one transaction rose by 30% to UAH 5,536. 83% of cases happened online, and online transactions accounted for 91% of all losses. Social engineering was responsible for 90% of losses: customers themselves handed fraudsters their card data, passwords or confirmation codes (Mind.ua citing the NBU).

This is an important conclusion for a store: most losses in Ukraine are linked not to cards being "hacked" but to a person being tricked into confirming a payment or giving out a code themselves. Protection against this lies mainly with banks and customer education, but a store can avoid collecting unnecessary data and avoid asking for codes in chats or emails. Note: the NBU figures cover all card fraud, not only online stores.

Main types of fraud for a store

• Payment with a stolen card. The owner sees the charge, disputes it, and the money goes back to them: the store loses the goods and pays for the dispute.
• Card testing (carding). Bots run through data on the payment page, checking which cards work. Protection: attempt limits, bot checks, see bots and scraping.
• Account takeover. Guessing other people's passwords to buy with a saved card or bonuses.
• "Friendly" fraud. A real customer disputes a payment even though they made the purchase themselves. There are no open primary figures that could be verified.
• Cash on delivery fraud. An order to someone else's address or phone number, refusing to collect it. It isn't card fraud, but it is also a loss; see cash on delivery.

What 3-D Secure does and doesn't do

3DS shifts part of the verification to the bank, which knows its customer. The benefit according to EMVCo: better fraud prevention, fewer false declines and a smoother checkout (EMVCo). A risk-based approach means some customers pass through without any extra steps.

What it doesn't do: it doesn't protect against a situation where the customer was tricked into giving out a code themselves, and it doesn't remove the store's need to watch for suspicious orders. The terms of liability shift for disputes depend on the payment system's rules and the contract with the bank; check with your acquirer.

Practical minimum

1. A payment page from a provider with 3DS enabled (usually this is a setting in the contract and the provider's account).
2. Don't store card data; see PCI DSS.
3. Order review rules: very large amounts, new customers with a large cart, different billing and delivery addresses, many failed payment attempts in a row. Confirm suspicious ones by phone.
4. Limits on payment attempts and bot protection.
5. A clear product description, return terms, and the store's name on the statement: some disputes arise because the customer doesn't recognize the charge.
6. Collect proof of delivery (a Nova Poshta waybill, confirmation of receipt) to answer a dispute.
7. Two-step login for customer accounts or notifications about sign-ins from a new device.

Common mistakes

• Turning off 3DS to "avoid losing conversion". Risk-based 3DS lets some customers through without steps, while turning it off leaves the risk with you. Work through this with your provider on your own data.
• Blocking everything by rules. Filters that are too strict cut off honest customers.
• Asking a customer to send a photo of the card or a code in a messenger.
• Not looking at your own data: you have to count your share of disputes and declines yourself.

FAQ

What is 3-D Secure? An additional check of a purchase by the issuing bank: if there is risk, the customer confirms the payment with a code, in the bank's app or with biometrics (EMVCo).

Does the customer always see the 3-D Secure window? No. For many transactions the check happens invisibly, and a prompt appears only when the risk is higher (EMVCo).

How can you reduce fraud in a store without losing conversion? Use risk-based 3DS, attempt limits, and review rules only for risky orders, not all of them.

What percentage of card fraud in Ukraine is linked to social engineering? According to NBU data for 2025, 90% of losses (Mind.ua).

Related terms

• Payment methods for an online store in Ukraine
• PCI DSS in plain words
• Cash on delivery and unclaimed parcels
• Checkout
• Bots and price scraping in an online store

Sources

• EMVCo, EMV 3-D Secure — emvco.com/emv-technologies/3-d-secure
• Mind.ua за даними НБУ, Шахрайства з картками стало менше, але збитки зросли до 1,4 млрд грн, 17 квітня 2026 — mind.ua/news/20303926-shahrajstva-z-kartkami-stalo-menshe-ale-zbitki-zrosli-do-14-mlrd-grn-nbu