When you run an e-commerce business in Aotearoa, accepting card payments online comes with the risk of fraudulent transactions and chargebacks. When a fraudster uses a stolen credit card to make an online purchase, the legitimate cardholder usually disputes the charge with their bank. In traditional online payment setups, the merchant bears the loss—losing both the funds and the dispatched goods.
Understanding 3D Secure 2.0 (3DS2) and how it operates within your payment gateway nz setup is essential for protecting your revenue and shifting chargeback liability away from your business.
Here is a straight up guide to how 3DS protection works and why it is vital for Kiwi merchants.
What is 3D Secure?
3D Secure is a global security protocol designed to authenticate online cardholders at the exact moment of checkout. You might recognise it by its card scheme brand names: Verified by Visa and Mastercard SecureCode.
When a customer enters their card details on your checkout page, 3DS communicates directly with the card-issuing bank to verify that the person making the purchase is the authorised cardholder.
While early versions (3DS1) often forced shoppers to remember static passwords or enter SMS PIN codes on pop-up screens, 3DS2 introduces a much smarter, frictionless experience. It evaluates risk data points behind the scenes. If a transaction is identified as low risk, the payment completes seamlessly without forcing the customer to navigate extra authentication steps.
What is the 3DS liability shift?
The single biggest commercial benefit of 3D Secure for online merchants is the liability shift.
Under standard non-3DS transactions (such as merchant-hosted 2-party checkouts), the merchant retains full financial liability for fraudulent chargebacks. If a stolen card is successfully charged on your site, the issuing bank will reverse the payment and deduct the funds directly from your account.
However, when a transaction undergoes 3DS authentication through a fully hosted (3-party) gateway, the liability for fraudulent chargebacks shifts away from your business and onto the card-issuing bank. Even if a fraudulent payment manages to pass through, the card issuer assumes the financial loss rather than the merchant.
3-party vs. 2-party: Where does 3DS apply?
In the Paystation ecosystem, 3D Secure protection is built directly into our fully hosted (3-party) payment pages:
- Fully Hosted (3-Party): When customers enter their card details on Paystation’s hosted page (or inside an embedded iframe on your website), 3DS authentication is automatically triggered. This gives your store maximum fraud protection while keeping your pci compliance scope to an absolute minimum.
- Merchant Hosted (2-Party): If you capture card details directly on your own website server via an API, 3DS security is not supported. Your business retains all fraud liability, and your site must meet much stricter PCI DSS compliance requirements.
(Note: Certain card types, such as Prezzy cards and specific commercial cards, are exempt from 3DS challenges).
Comprehensive security for Kiwi merchants
3D Secure is just one layer of Paystation’s security infrastructure. As a Level 1 PCI DSS Service Provider, Paystation encrypts all transaction data with SHA 256-bit SSL encryption. We also provide additional fraud mitigation tools—including CVV verification, IP blocking, and country-of-origin lookups—to keep malicious traffic away from your checkout.
Three simple steps to go live
Setting up a secure, 3DS-enabled payment gateway for your business is straightforward:
- Apply online: Complete a quick online application to trigger a development account immediately.
- Obtain your Merchant ID: Request a ‘Linked Gateway’ Merchant ID from your local bank (ANZ, ASB, BNZ, Kiwibank, or Westpac).
- Integrate and test: Use our developer resources and sample code (PHP, NodeJS, C#), test your setup against our Go-Live checklist, and start taking secure payments.
