3D Secure Enrolment
3D Secure (3DS) is a cardholder authentication step. Some issuers enrol their card ranges and some do not, and a non-enrolled range simply completes authorisation without the extra challenge. This page explains the mechanism and how to check the status of a given BIN.
By Daniel Cross, Senior Payment Systems Analyst · Last updated: 2026-10-20
How 3D Secure enrolment works
3D Secure is a cardholder authentication step. When a card is enrolled, the issuer can require the holder to complete an additional verification during authorisation. Cards that are not enrolled complete authorisation directly. The difference is configured at the issuer and applies to a BIN range rather than to an individual card.
- Enrolment is set at the issuer and applies to a range of BINs
- Enrolled cards may be challenged with a password, OTP or in-app approval
- Non-enrolled ranges complete authorisation without the extra step
- The setting can change when the issuer reconfigures its portfolio
- The BIN status is a range-level property, not a card-level one
How to check the status of a card
The only reliable way to establish whether a particular card and merchant combination is challenged is to attempt an authorisation and read the response. A response that includes a 3DS challenge indicates enrolment for that combination at that time. Data providers publish inferred status, but it is always a snapshot.
- Attempt an authorisation and read the response
- A 3DS challenge in the response indicates enrolment
- Published status tables are snapshots and drift
- Status can differ per merchant category
- Issuer configuration is the source of truth
Enrolment and exemption
Low-value transactions, recurring charges and card-on-file payments are commonly exempted from the challenge even on enrolled cards, so that routine payments are not interrupted. Exemption rules are set by the issuer and vary by region and transaction type.
- Low-value transactions are frequently exempted
- Recurring and stored-credential payments are commonly exempt
- Exemptions are issuer-configured
- Rules differ by region and transaction type
- Exemption does not mean the card is unenrolled
Frequently Asked Questions
What is 3D Secure enrolment?
It is the issuer's decision to apply cardholder authentication to a range of BINs.
Does every card use 3D Secure?
No. Enrolment is configured per issuer and per range, and it changes over time.
How can I tell if a card is enrolled?
Only an authorisation attempt is conclusive. Published status tables are snapshots that drift.
Are exempt transactions still 3D Secure?
They are exempt from the challenge but the range may still be enrolled overall.
Why does the same card behave differently at different merchants?
Exemption rules and challenge behaviour depend on the merchant category and transaction type as well as the issuer.