Shopify Payments triggers 3DS dynamically: always where SCA regulation requires it (EU/UK issuers), selectively elsewhere based on risk signals. You don't get a global on-switch — and that's mostly good, since blanket 3DS costs real conversion (the math). What you should know: which of your disputed orders were authenticated (it's in the order's payment details), because a completed 3DS on a fraud dispute is close to an automatic win.
When Shopify triggers 3DS
Three drivers:
- Regulatory (SCA): EU/UK-issued cards get 3DS by law, with exemption logic (low-value, low-risk) handled automatically. This is most of Shopify's 3DS volume.
- Issuer risk requests: some issuers demand step-up authentication on transactions they find suspicious; the checkout complies.
- Risk-based selection: elevated-risk transactions can get routed through authentication dynamically.
No merchant toggle for blanket-3DS on Shopify Payments — unlike raw Stripe, where Radar rules can force it. Given challenge-flow abandonment, the dynamic approach is usually the right trade anyway.
The liability shift
A fully authenticated 3DS transaction (frictionless or challenge-completed) shifts fraud liability to the issuer: fraud-code disputes (10.4 and kin) on authenticated transactions are essentially won at filing.
Boundaries: the shift covers fraud codes only — not-received, quality, and subscription disputes are untouched by authentication. And attempted-but-failed authentication carries network-specific rules (Mastercard is more merchant-generous on attempts than Visa).
Checking authentication on disputes
The order's payment details show whether 3DS ran and its result. Make it a triage step: fraud dispute → check authentication first. Authenticated = cite the liability shift in sentence one of the rebuttal and attach the authentication record. That case is near-automatic — issuers know shifted liability when they see it documented.
Aurai checks authentication status on every fraud dispute automatically and leads with the liability-shift argument whenever it exists — the single fastest win in the reason-code catalog.
Frequently asked questions
Can I force 3DS on all Shopify orders?
Not on Shopify Payments — it applies 3DS dynamically (regulatory + risk-based). Blanket 3DS costs 5–20% conversion on challenged traffic anyway; dynamic is usually the better trade.
Does 3DS stop chargebacks?
It shifts fraud-code liability to the issuer — those disputes essentially win at filing. It does nothing for not-received, quality, or subscription disputes, which are the majority.
Post reflects public documentation, industry surveys, and Aurai's own book of disputes as of the publish date. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.