The European Payment Services Directive (PSD2) has made strong authentication almost mandatory for online credit card purchases. The 3D Secure protocol, in its version 2, is the main mechanism for this authentication. Attempting to bypass this system often stems from a misunderstanding of its actual functioning, as many payments already go through without any visible intervention from the buyer.
Frictionless 3D Secure Flow: Why Some Payments Go Through Without a Code
The 3D Secure 2 protocol distinguishes between two paths at the time of payment. The first, called “challenge,” requires an action from the buyer (validation via the banking app, SMS code). The second, known as “frictionless,” authenticates the transaction without any intervention from the cardholder.
This silent flow relies on automated risk analysis. The issuing bank evaluates several parameters in the background: the history of the terminal used, the transaction amount, the frequency of purchases at this merchant, and the consistency of the IP address. If the risk level is deemed low, the transaction is validated without the buyer seeing any authentication window.
A regularly updated inventory lists sites without bank verification where the purchasing path seems not to trigger 3D Secure, but in most cases, the protocol is indeed present in the background, simply in frictionless mode.
PSD2 Exemptions: The Legal Framework That Removes the Challenge Without Compromising Security
The absence of a visible authentication window does not mean the absence of 3D Secure. PSD2 provides several exemptions codified in Delegated Regulation (EU) 2018/389 that allow merchants to request a challenge-free path while remaining within the regulatory framework.
- Low-value transactions: payments below a certain threshold may be exempt from strong authentication, subject to cumulative limits.
- Trusted beneficiaries: the buyer can add a merchant to their whitelist via their banking app, which removes future challenges at that merchant.
- Recurring payments: after an initial strong authentication, subsequent subscriptions and regular direct debits go through without a new challenge.
- Transaction Risk Analysis (TRA): payment service providers with fraud rates below the thresholds set by PSD2 can request exemptions for higher amounts.
These mechanisms explain why some sites seem never to trigger verification. The merchant or their payment provider applies an exemption, not a workaround.
Liability in Case of Fraud on a Purchase Without 3D Secure Authentication
The liability shift is the point that most guides on “sites without 3DS” do not address. When a transaction goes through the 3D Secure protocol and authentication is completed (including in frictionless mode), the liability in case of fraud shifts from the merchant to the issuing bank.
On the other hand, if a merchant chooses not to implement 3D Secure or bypasses the protocol without a valid exemption, they bear the full financial risk in case of a dispute. For the buyer, the situation is different: legal protection against fraudulent transactions is guaranteed by the monetary and financial code, regardless of the authentication path.
The concrete problem arises during a dispute. A payment without authentication will complicate the refund process if the merchant contests the fraud. The evidence required is more burdensome, and resolution times are extended.
What the Buyer Really Risks
Shopping on a site that does not implement 3D Secure is not illegal for the consumer. The regulatory responsibility lies with the merchant and their payment provider, not the cardholder.
The risk lies elsewhere: a site that deliberately refuses any form of strong authentication offers no guarantee regarding the reliability of its payment infrastructure. The voluntary absence of 3D Secure may signal an unreliable site, not just a technical choice.
Concrete Alternatives for Frictionless Payments on Secure Sites
Instead of looking for sites that evade the 3D Secure protocol, several methods allow for reducing payment friction while maintaining fraud protection.
The first is to use the “trusted beneficiary” feature offered by most French banking apps. Once a merchant is added to this list, subsequent purchases at that merchant go through in frictionless mode automatically.
Digital wallets (PayPal, Apple Pay, Google Pay) offer another route. Strong authentication occurs when logging into the wallet, not with each transaction. Payment via digital wallet removes the 3D Secure challenge on the merchant’s side while maintaining an equivalent level of security.
Single-use virtual cards, offered by several online banks, represent a third option. The card number is generated for a single transaction, which reduces the risk of fraud and often simplifies the authentication path.
PSD3 and the Future of Online Payments Without Visible Authentication
The European regulatory framework is evolving towards PSD3, which is expected to strengthen invisible authentication mechanisms rather than eliminate them. The trend is towards more refined and faster risk analysis, with a clear goal: to reduce friction for the buyer without diminishing fraud protection.
The available data does not allow for a conclusion on the exact timeline for the implementation of PSD3, but feedback from European payment providers converges towards a generalization of frictionless for the vast majority of everyday transactions.
Looking for a “site without 3D Secure” in 2026 is akin to looking for a problem already solved by the protocol itself. Frictionless exists, exemptions are codified, and payment alternatives are multiplying. The friction still experienced by some buyers often relates to a banking configuration that needs adjustment, not a flaw in the system.
