What is 3D secure, and why do I get an OTP?

The step you resent

You reach checkout, the page redirects, you wait, an SMS arrives, you type six digits, the page redirects again, and sometimes it fails and you start over.

That entire sequence exists to answer one question: is the person using this card the person who owns it?

The part nobody tells you: liability

Here is the mechanic that actually drives adoption. When a payment is authenticated through 3D Secure and later turns out to be fraudulent, the loss generally shifts to the card issuer rather than the merchant. Without authentication, the merchant usually eats it.

So 3D Secure is not primarily a security feature from the merchant's point of view. It is an insurance policy. That reframing explains everything about how it is deployed.

Why it is mandatory in some places and not others

In India, additional factor authentication on card transactions has been effectively mandatory for years under RBI rules, which is why you almost never complete a card payment there without an OTP. In Europe, Strong Customer Authentication under PSD2 requires it for most transactions, with carefully defined exemptions. In the United States, it remains largely optional, which is why American checkouts feel faster and American card fraud rates are higher.

Three markets, three regulatory philosophies, three completely different checkout experiences. The technology is identical.

It is a bouncer who checks identification. Nightclubs in one city are legally required to have one, in another it is optional, and the ones who skip it are liable for whatever happens inside.

Where you meet it

Every OTP, every banking-app approval prompt, every redirect that makes you nervous about whether the payment went through. And in the quiet difference between an Indian checkout and an American one.