The code your card sends you

Sometimes it's a code.

Sometimes it's your face, or a thumbprint, or nothing at all, just a payment that clears without asking you anything. What checks you're you at checkout depends on which card's in your hand, and how normal the purchase looks to it.

What is 3D Secure

3D Secure is a verification step, sometimes called 3D Secure authentication, that confirms you're really the person spending the money, not just someone who happens to have your card number.

Visa came up with the idea back in 2001—the early wild-west days of online shopping when nobody had quite figured out how to stop people from using stolen card numbers. Mastercard built its own version right after. You’ll see them called Visa Secure or Mastercard Identity Check, but the job is still the same: prove it’s you.

The early version was painfully clunky.

It redirected you to a separate page and asked for a password you'd usually half-forgotten by then, so plenty of people just gave up and abandoned their basket instead. Today's version is built to stay out of your way as much as possible.

Why it’s everywhere

It's not optional in the UK and hasn't been for a while. It’s called Strong Customer Authentication (or SCA), and it means proving at least two of these three things before a payment goes through:

• Something you know, like a password or PIN
• Something you have, like your phone
• Something you are, a fingerprint or your face

3D authentication can look different depending on who issues your card. A code, a push notification you approve in an app... More providers are switching to face or fingerprint scans instead of texts, since it’s faster, safer, and means you aren't stuck waiting on an SMS to arrive.

Not every payment gets stopped for it. Behind the scenes, the card provider runs a quick risk check on every transaction:

• Does this look like how you normally spend
• Is it a device that's been seen before
• Is the amount unusually large for you

A payment at 3am from a country you've never shopped in before is exactly the kind of thing that gets flagged. Your regular Friday coffee order almost never will.

Small payments often skip the check completely. Spend under £30, and there's a decent chance nothing gets asked at all, which is either efficient risk management or your card provider quietly deciding a flat white isn't worth the paperwork.

When the code doesn't show up

The most annoying part is when that code just... doesn't arrive. Usually, it's not the system failing, it's just SMS being unreliable: poor cell signal, an old phone number still sitting on your account, a text that turns up two minutes after the checkout page has already given up.

On an Ampere card, that's Mastercard Identity Check running on 3DS 2.0, the modern version described above rather than the clunky original.

If a payment does get stuck, Ampere's app also lets you freeze the card or reset a PIN in seconds yourself, without needing to call anyone. See Ampere cards if that's the kind of thing that matters to you.

It also depends on what you're buying.

A subscription renewal usually only asks for the check once, the first time you sign up, then leaves you alone after that. A one-off purchase on a site you've never used before gets the full check almost every time, since there's no history yet for the risk check to lean on.