- Short answer
- Not fully: on authenticated payments, 3D Secure shifts fraud-chargeback liability to the card issuer, and Visa can take that shift away.
- Where to turn it on
- Settings > Payments: Edit Shopify Payments, then Edit next to 3D Secure and select On
- Bank-triggered mode
- Shopify Payments uses 3DS only when the card-issuing bank requires it; its PSD2-region stores get the flow automatically
- Visa limit
- Shopify's PSD2 page cites Visa: more than $7,500 USD in fraudulent chargebacks in one month ends the shift
- US option
- Shopify Protect covers eligible Shop Pay orders in US stores
What does 3D Secure change about a fraudulent chargeback?
Shopify's settings page says “When you turn 3D Secure on in your checkout, a fraudulent chargeback can't be filed for the order.” Its PSD2 page (both read October 15, 2026) calls it a shift of liability:
When a payment is authenticated with 3D secure, the liability for fraudulent chargebacks or disputes is shifted from merchants to card issuers.
If a chargeback marked Fraudulent still arrives — Shopify's label when “the cardholder didn't authorize the charge” — submit the 3D Secure record, which the chargeback process page lists as evidence.
Who triggers 3D Secure: you or the card-issuing bank?
On Shopify Payments, you can turn it on yourself:
- Settings
- Payments
- Shopify Payments
- Fraud prevention
- 3D Secure
Click Edit in the Shopify Payments section, then Edit next to 3D Secure; select On and save.
The bank can trigger it too: Shopify Payments “only uses 3DS when required by the card-issuing bank,” and a Shopify Payments store in a PSD2 region automatically uses a 3D Secure checkout flow, per the fraud prevention page; PSD2 regions are the EEA and the UK.
No Shopify Payments, fraud or chargeback help page we read on October 15, 2026 says whether the setting forces 3D Secure on every payment, and none names the US or Canada when it describes who triggers 3D Secure.
Without Shopify Payments, use a third-party provider that supports 3D Secure.
When does the liability shift stop protecting you?
When fraud runs high. Shopify's PSD2 page cites Visa's policy: merchants with more than $7,500 USD in fraudulent chargebacks in one month “are no longer able to shift liability to the card issuer.”
For US businesses, the monitoring programs page adds a Visa program counting Early Fraud Warnings: meet or exceed both monthly thresholds, $75,000 USD and a 0.9% fraud rate, and “you lose liability shift on domestic 3D Secure transactions.”
In that program the shift stays lost until you fully exit it by bringing fraud back below the thresholds, so review risky orders before you fulfil them.
US stores using Shop Pay can also cover eligible orders with Shopify Protect.
This page was written by AI. Separate AI agents that did not write it check its figures and claims against official sources and test its links and interactive tools. A human editor sets the site's editorial direction, topics and rules and checks that pages are complete and display correctly, but does not check their facts or edit their text. Details may change — always confirm critical data at shopify.com.
Editorial Policy