# How to disable 3D Secure in Stripe

- Tool: Stripe
- Difficulty: Intermediate
- Time required: 15 minutes
- Compatibility: Stripe API v2024-12+, Stripe Radar, Stripe Dashboard
- Last updated: March 2026

## TL;DR

You cannot fully disable 3D Secure in Stripe because it is mandated by European SCA regulations and controlled by issuing banks. However, you can reduce 3DS triggers by configuring Stripe Radar rules to request exemptions for low-risk transactions, using Radar's machine learning to skip 3DS when regulations allow, and enabling automatic exemption requests for transactions under 30 EUR.

## Can You Disable 3D Secure in Stripe?

3D Secure (3DS) is an authentication layer required by Strong Customer Authentication (SCA) regulations in Europe and mandated by card networks for certain transactions worldwide. You cannot turn it off entirely in Stripe — and doing so would violate regulations and increase your liability for fraud. However, Stripe provides tools to minimize unnecessary 3DS challenges. Radar rules can request exemptions for low-risk payments, merchant-initiated transactions, and small amounts. The goal is to reduce checkout friction without sacrificing compliance.

## Before you start

- A Stripe account with Radar enabled (included on all accounts)
- Admin access to the Stripe Dashboard
- Understanding of your customer geography (EEA vs non-EEA)
- Familiarity with SCA exemption categories

## Step-by-step guide

### 1. Understand when 3DS is required vs optional

3DS is required for most customer-initiated card payments in the European Economic Area (EEA) and UK under SCA rules. It is optional for non-EEA transactions, merchant-initiated charges, recurring subscription payments (after the first), and transactions under 30 EUR (low-value exemption).

```
// SCA Exemptions (when 3DS may be skipped):

// 1. Low-value transactions: under €30 (cumulative limit €100 or 5 txns)
// 2. Low-risk transactions: Stripe's fraud rate qualifies for exemption
// 3. Merchant-initiated transactions: recurring charges after initial auth
// 4. Trusted beneficiary: customer whitelists your business
// 5. Corporate cards: business/corporate cards in some cases
// 6. Non-EEA transactions: one-leg-out rule (payer or merchant outside EEA)
```

**Expected result:** You understand which transactions can potentially skip 3DS.

### 2. Enable automatic exemption requests in Radar

Stripe Radar automatically requests applicable exemptions for your transactions. Go to Dashboard → Radar → Rules to verify that the default rules are active. Stripe's machine learning assesses each transaction and requests exemptions when the risk is low enough.

**Expected result:** Radar is configured to automatically request 3DS exemptions for qualifying transactions.

### 3. Configure Radar rules for exemptions

With Radar for Fraud Teams, you can create custom rules that request specific exemption types. For example, request the low-risk exemption for transactions from trusted customer segments.

```
// Radar rule examples (set in Dashboard → Radar → Rules):

// Request low-risk exemption for returning customers:
// Rule: Request 3DS exemption when customer has 5+ successful payments

// Block 3DS for non-EEA cards (3DS is optional):
// These are handled automatically by Stripe

// Note: The issuing bank has final authority on whether to
// accept or reject an exemption request. Stripe requests
// the exemption, but the bank decides.
```

**Expected result:** Custom Radar rules are active, requesting exemptions where regulations allow.

### 4. Use off-session payments for recurring charges

For subscription renewals and merchant-initiated charges, set off_session: true and confirm: true. These are classified as merchant-initiated transactions (MIT) and are exempt from SCA in most cases.

```
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

// Charge a saved card off-session (merchant-initiated)
const paymentIntent = await stripe.paymentIntents.create({
  amount: 2500, // $25.00
  currency: 'usd',
  customer: 'cus_ABC123',
  payment_method: 'pm_SAVED456',
  off_session: true,
  confirm: true,
});

console.log('Status:', paymentIntent.status);
// Should be 'succeeded' without 3DS for MIT
```

**Expected result:** The payment processes without triggering 3DS because it is a merchant-initiated transaction.

### 5. Handle cases where the bank requires 3DS anyway

Even with exemptions, issuing banks can override and require 3DS. Your code must handle the authentication_required error gracefully by sending the customer back through the payment flow.

```
try {
  const paymentIntent = await stripe.paymentIntents.create({
    amount: 5000,
    currency: 'eur',
    customer: 'cus_ABC123',
    payment_method: 'pm_SAVED456',
    off_session: true,
    confirm: true,
  });
} catch (err) {
  if (err.code === 'authentication_required') {
    // Bank overrode the exemption — bring customer back on-session
    console.log('3DS required. PI:', err.raw.payment_intent.id);
    // Notify customer to complete payment with 3DS
  }
}
```

**Expected result:** Your code catches the authentication_required error and can prompt the customer to re-authenticate.

## Complete code example

File: `minimize-3ds.js`

```javascript
const express = require('express');
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

const app = express();
app.use(express.json());

// On-session payment with automatic exemption handling
app.post('/api/pay', async (req, res) => {
  try {
    const { amount, customerId, paymentMethodId } = req.body;

    const paymentIntent = await stripe.paymentIntents.create({
      amount,
      currency: 'usd',
      customer: customerId,
      payment_method: paymentMethodId,
      confirm: true,
      automatic_payment_methods: {
        enabled: true,
        allow_redirects: 'never',
      },
    });

    if (paymentIntent.status === 'requires_action') {
      // 3DS triggered — return client_secret for frontend handling
      return res.json({
        requires_action: true,
        client_secret: paymentIntent.client_secret,
      });
    }

    res.json({ status: paymentIntent.status, id: paymentIntent.id });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// Off-session charge (merchant-initiated, exempt from 3DS)
app.post('/api/charge-saved-card', async (req, res) => {
  try {
    const { customerId, paymentMethodId, amount } = req.body;

    const paymentIntent = await stripe.paymentIntents.create({
      amount,
      currency: 'usd',
      customer: customerId,
      payment_method: paymentMethodId,
      off_session: true,
      confirm: true,
    });

    res.json({ status: paymentIntent.status, id: paymentIntent.id });
  } catch (err) {
    if (err.code === 'authentication_required') {
      return res.status(402).json({
        error: '3DS authentication required',
        payment_intent_id: err.raw.payment_intent.id,
      });
    }
    res.status(500).json({ error: err.message });
  }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Server on port ${PORT}`));
```

## Common mistakes

- **Trying to fully disable 3DS for all transactions** — undefined Fix: This is not possible and violates SCA regulations. Focus on requesting exemptions for qualifying transactions instead.
- **Assuming exemption requests are always approved** — undefined Fix: The issuing bank decides whether to accept exemptions. Always handle the authentication_required error as a fallback.
- **Not using off_session for recurring subscription charges** — undefined Fix: Set off_session: true for merchant-initiated charges. Without it, Stripe treats the charge as customer-initiated and may trigger 3DS.
- **Ignoring liability shift implications** — undefined Fix: Without 3DS, fraud liability falls on you (the merchant). With 3DS, liability shifts to the issuing bank. Consider this tradeoff when requesting exemptions.

## Best practices

- Use Stripe Radar's automatic exemption requests — it handles most optimization automatically
- Set off_session: true for all merchant-initiated and recurring charges to skip 3DS
- Always handle authentication_required as a fallback when banks override exemptions
- Monitor your 3DS challenge rate in Dashboard → Analytics to understand friction
- Use Radar for Fraud Teams for granular control over exemption request rules
- Authenticate the first payment in a subscription on-session with 3DS, then charge renewals off-session
- Test with cards 4000000000003220 (3DS required) and 4242424242424242 (no 3DS) to verify both paths

## Frequently asked questions

### Can I completely turn off 3D Secure?

No. 3DS is mandated by SCA regulations in Europe and required by card networks in many scenarios. Even outside Europe, issuing banks can request 3DS. You can minimize it with exemptions but not eliminate it.

### What is the liability shift with 3DS?

With 3DS authentication, fraud liability shifts from you to the issuing bank. Without 3DS (using exemptions), you carry the liability. This means if a fraudulent charge is disputed, you bear the cost.

### Do all cards support 3DS exemptions?

Not all cards and issuers support all exemption types. Stripe requests the exemption, but the issuer decides. Newer cards from major banks in the EEA generally support exemptions well.

### Does 3DS apply to non-European transactions?

SCA mandates only apply to EEA/UK transactions. However, card networks may require 3DS globally for high-risk transactions, and some non-European banks implement their own 3DS requirements.

### How does Stripe Radar decide when to request exemptions?

Radar uses machine learning to assess transaction risk. If the transaction qualifies for a low-risk or low-value exemption and the risk score is below the threshold, Radar automatically requests the exemption.

### What if I need help optimizing my checkout conversion rate with 3DS?

For businesses where 3DS friction significantly impacts conversion, the RapidDev team can analyze your payment flow, implement smart exemption strategies, and optimize the authentication experience.

---

Source: https://www.rapidevelopers.com/stripe-guide/how-to-disable-3d-secure-in-stripe
© RapidDev — https://www.rapidevelopers.com/stripe-guide/how-to-disable-3d-secure-in-stripe