3-D Secure (3DS) is the extra checkout step where the customer's bank confirms the buyer's identity. In most cases it moves the loss on a fraud dispute from you to the bank. A few exceptions catch merchants who assumed they were covered.
A full Visa authentication (the highest result, called ECI 5) moves the loss to the bank. An "attempts only" response (ECI 6), where the bank's system declined or was unavailable, does not always move it, and the rules vary by region. Visa Data Only runs the check to help the bank score risk. It never challenges the customer and never moves the loss. Cards not enrolled in 3DS get no protection. If you fail to pass the authentication proof (the CAVV) along with the payment, the bank can reopen the case.
See your dispute rate on each card network. Install Predispute free on Shopify.
Protection covers fraud disputes (Visa 10.x reason codes) only. Consumer disputes (13.x) and disputes about the bank approving the payment (11.x) are never covered. Gambling, adult and certain digital subscription categories are excluded by card brand rule. In the EEA and UK, a merchant who claims an exemption from the extra identity checks that the European PSD2 rules require keeps the loss on fraud.