I forced 3D Secure on every order — and lost 15% of my conversions.
3D Secure stops fraud, but forcing it on every transaction punishes legitimate buyers. This guide explains the SCA background, how to force 3DS in code, and how to trigger it intelligently instead of universally.
The SCA background (PSD2)
3D Secure implements Strong Customer Authentication. Europe’s PSD2 regulation makes SCA mandatory for most EU transactions — but non-European orders do not automatically need it. Whether you challenge a buyer outside the EU is a risk decision, not a legal one.
Force 3DS in WooCommerce PayPal Payments
A single filter forces the 3DS contingency to always challenge:
add_filter('woocommerce_paypal_payments_three_d_secure_contingency', fn() => 'SCA_ALWAYS');Why “always” is expensive
Smart triggering: risk-based 3DS
Instead of challenging everyone, decide dynamically by amount, buyer history, and IP geography. Stripe Radar can do this natively, though the configuration is more involved than flipping a flag.
A tiered fraud-control plan
- Low risk (small amount, known device): skip 3DS.
- Medium risk: silent verification behind the scenes.
- High risk (large amount, new IP): force the challenge.
Balance risk and conversion deliberately. For the rest of your payment security stack, see our WordPress plugin tutorials.
