3DS Data Only

Overview

3DS Data Only is a business-friendly approach that enables merchants to share rich customer and transaction information with card issuers through the EMV 3DS ecosystem, without requiring customer authentication. It helps improve the issuer's ability to assess risk and may contribute to higher authorization rates and a smoother customer experience, while preserving a frictionless checkout journey. However, because no authentication occurs, merchants generally do not benefit from authentication-based liability shift.

For organizations focused on growth, conversion optimization, and customer experience, 3DS Data Only can be a valuable addition to their payment strategy.

What is 3DS Data Only?

3DS Data Only is a feature within the EMV 3-D Secure ecosystem that allows merchants to submit enhanced transaction data to card issuers without performing a cardholder authentication.

Unlike a traditional 3DS transaction, the customer is not asked to:

Enter a one-time passcode (OTP)
Approve a transaction in a banking app
Answer security questions
Complete a challenge during checkout

Instead, the merchant shares valuable information about the transaction, customer, and device, allowing the issuer to leverage this data when making its authorization decision.

In simple terms, 3DS Data Only provides issuers with more information, without asking customers to do anything extra.

Why Was 3DS Data Only Created?

Historically, merchants have had to balance two important objectives:

Reduce Fraud: Issuers need enough information to distinguish legitimate transactions from fraudulent ones. Additional data improves risk assessment and fraud detection.

Maximize Conversion: Every additional step in the checkout process can increase cart abandonment and reduce sales. Frictionless experiences generally result in better conversion rates.

3DS Data Only helps achieve both goals by allowing merchants to provide issuers with richer transaction intelligence while preserving a seamless customer experience.

Who Is 3DS Data Only For?

3DS Data Only is particularly valuable for merchants that prioritize conversion, customer experience, and transaction approval rates. Typical use cases include:

Subscription Businesses: Customers make recurring payments and are already known to the merchant.
Card-on-File Merchants: Customers have previously stored their payment credentials.
Digital Commerce Businesses: Merchants with high transaction volumes and a strong focus on checkout optimization.

Merchants with Established Fraud Controls

Organizations that already have mature fraud prevention capabilities and want to enhance authorization performance through richer issuer data sharing.

Business Benefits of 3DS Data Only

Higher Approval Potential: Richer transaction data gives issuers the confidence to approve more legitimate purchases, reduce false declines, and protect revenue.

Business Impact:

Faster, smoother checkout
Fewer false declines and lost sales
Stronger fraud and risk decisions
More approvals and revenue

Frictionless Customer Experience: Customers complete purchases with no passwords, codes, app approvals, or challenge screens.

Sharper Fraud Intelligence: Issuers still receive valuable insights to strengthen fraud and risk decisions, even without cardholder authentication.

Customer-Centric by Design: 3DS Data Only lets businesses use the 3DS ecosystem while keeping the buying journey fast, convenient, and customer-first.

📘
No Authentication-Based Liability Shift
A key difference between traditional 3DS and 3DS Data Only is liability. Because the customer is not authenticated through 3DS, the merchant generally retains responsibility for fraud-related chargebacks that would otherwise qualify for liability shift under a successful 3DS authentication flow. Organizations should evaluate this trade-off as part of their fraud and risk management strategy.

Minimum Requirements to use 3DS Data Only

Note that while implementation requirements may vary by payment provider, issuer, and card network, organizations typically need:

Participation in a Supported 3DS Program
Sufficient Customer and Transaction Data
Supported Card Networks

Please note that not all BIN ranges are eligible for Data Only. Eligibility for a specific card should be verified through the card lookup, which will indicate whether Data Only processing is supported.

When Should a Merchant Choose 3DS Data Only?

A merchant may consider 3DS Data Only when:

Maximizing conversion is a priority
The organization wants a frictionless checkout experience
Additional issuer insights may improve approval rates
Existing fraud controls are already in place
The business accepts the absence of authentication-based liability shift

Full 3DS vs. 3DS Data-Only Comparison

Feature	Full 3-D Secure	3DS Data-Only
Authentication	Yes	No
Challenge	Possible	Not possible
Liability Shift	Yes	No
User Experience	Potential friction	Always frictionless
Primary Purpose	Authenticate cardholder	Enhance issuer risk scoring
Best For	High-risk, SCA-required, liability-conscious scenarios	Approval optimization & frictionless UX

Conversely, traditional 3DS may be more appropriate when liability shift protection and cardholder authentication are business priorities.

Indicators of 3DS Data Only

From a protocol perspective, 3DS Data Only is an EMV 3DS AReq/ARes exchange focused on risk-data sharing rather than cardholder authentication. The merchant sends an AReq with detailed customer, account, device, and transaction data, receives an informational ARes, then continues with the authorization request. This lets issuers add richer risk signals to their authorization models while keeping checkout frictionless.

Required AReq Value for 3DS Data Only Transactions

For 3-D Secure (3DS) Data Only transactions, the Authentication Request (AReq) must identify the request as Data Only by setting the threeDSecureChallengeRequested element to either NO_CHALLENGE_REQUESTED_DATA_ONLY or NO_CHALLENGE_REQUESTED_AUTHENTICATION_PERFORMED. Both values are considered 3DS Data Only requests and indicate that no cardholder challenge is being requested. If this field is missing or set to any other value, the transaction will not be treated as a Data Only 3DS request and may be handled according to the authentication behavior associated with that value. Supporting both accepted values in the AReq message ensure correct Data Only handling and compliant 3DS processing.

3DS Data Only AReq - Card

{
    "idempotencyKey": "",
    "amount": {
        "amount": 0000,
        "currency": "Currency Code"
    },
    "cardholderName": "Cardholder name",
    "cardholderEmail": "customer's email address",
    "cardholderPhoneNumber": "customer's phone number",
    "shippingAddress": {
        "unitNumber": "Unit number",
        "streetNumber": "Street number",
        "streetName": "Street name",
        "city": "Identifies the city.",
        "province": "Province or state",
        "postalCode": "Postal or zip code",
        "country": "Provides the two letter country" 
    },
    "billingAddress": {
        "unitNumber": "Unit number",
        "streetNumber": "Street number",
        "streetName": "Street name",
        "city": "Identifies the city.",
        "province": "Province or state",
        "postalCode": "Postal or zip code",
        "country": "Provides the two letter country"
    },
    "paymentMethod": {
        "cardholderInformation": {
            "cardholderName": "Cardholder name",
            "companyName": "Associated company name"
        },
        "contactDetails": {
            "phoneNumber": "customer's phone number",
            "email": "customer's email address"
        },
        "billingAddress": {
            "unitNumber": "Unit number",
            "streetNumber": "Street number",
            "streetName": "Street name",
            "city": "Identifies the city.",
            "province": "Province or state",
            "postalCode": "Postal or zip code",
            "country": "Provides the two letter country"
        },
        "paymentMethodSource": "CARD",
        "card": {
            "cardNumber": "customer's credit or debit card numbe",
            "expiryMonth": Card expiration month,
            "expiryYear": Card expiration year,
            "cardSecurityCode": "CVD value located on credit card"
        },
        "customData": {
            "additionalProp1": "string",
            "additionalProp2": "string",
            "additionalProp3": "string"
        }
    },
    "threeDSecureMessageCategory": "category of the message",
    "threeDSecureDeviceChannel": "Type of channel interface",
    "threeDSecureRequestType": "Type of payment",
    "threeDSecureRecurringFrequency": Indicate the Frequesncy,
    "threeDSecureRecurringExpiry": "Date recurring shlould stop",
    "threeDSecureNotificationUrl": "Fully qualified Encode URL",
    "threeDSecureCompletionIndicator": "3DS Card Lookup Indicator",
    "threeDSecureChallengeRequested": "NO_CHALLENGE_REQUESTED_DATA_ONLY",
    "threeDSecureChallengeWindowSize": "Refert to the rendering of the browser.",
    "browserIpAddress": "Internet Protocol version",
    "browserUserAgent": "Exact content of the HTTP user-agent header",
    "browserJavaEnabled": Is Java enabled?,
    "browserJavascriptEnabled": Is Javascript enabled?,
    "browserScreenHeight": pixel height of the cardholder's screen,
    "browserScreenWidth": pixel width of the cardholder's screen,
    "browserLanguage": "Language codes"
}

3DS Data Only response ARes

A successful Authentication Response (ARes) for a 3DS Data Only request sets the threeDSecureTransactioStatus field to CHALENGE_PREFERENCE_ACKNOWLEDGED. This status confirms that the 3DS Data Only request was processed successfully.

With this response confirmed, merchant can now use the returned 3DS Data Only result to continue your payment flow with confidence.