Hacker News Reader

>At merchants not using 3DS, that is true – but these merchants also bear the full liability for any fraud happening

As far as I know, the merchant always bears the full liability for fraud, whether you use 3ds or not. The sales pitch for 3ds is simply to reduce the chances of fraud.

Also, you do don't even necessarily need the CVV to buy with a cc online. Depends on the merchant.

View on HN

> As far as I know, the merchant always bears the full liability for fraud, whether you use 3ds or not.

This is very much untrue. If a merchant initiates the 3DS flow, liability for fraudulent transactions shifts from the merchant onto the issuer. Here's documentation from Stripe[1] on the matrix of possible flows and the resulting liability shift, and docs from Adyen[2] on card networks that support liability shifting with 3DS.

[1]: https://support.stripe.com/questions/liability-shift-post-sc...

[2]: https://www.adyen.help/hc/en-us/articles/5091186681500-What-...

The amount of misinformation in this thread is staggering.

Reply on news.ycombinator.com