Shop Pay and 3D Secure Authentication: Why Authentication Isn’t Required Every Time

Introduction

Are you tired of seeing screens asking you to “Enter your verification code” or “Enter your one-time password”?

Since April 2025, the implementation of “3D Secure” for credit card payments has become mandatory in earnest. However, with some payment services such as Shop Pay, this cumbersome authentication may be skipped in certain cases. In this article, we answer the questions: “Why is authentication not required?” and “Is it really safe to skip it?”

Background to the 3D Secure Mandate and Exceptions

Background to the Mandate

The Ministry of Economy, Trade and Industry’s “Credit Card Security Guidelines, Version 6.0” requires e-commerce merchants to implement 3D Secure (EMV 3-D Secure) in response to the increasing number of unauthorized transactions. This change is a legal requirement based on the Installment Sales Act, and in principle, all e-commerce businesses are required to comply.

Important Exceptions

The guidelines explicitly state the following important exception:

“Depending on the content and deterrent effect of fraud prevention measures implemented by the merchant in addition to EMV 3-D Secure, merchants may operate in a way that requires EMV 3-D Secure authentication when registering a card number, or may operate in a way that requires EMV 3-D Secure authentication based on the merchant’s risk assessment.” (Guidelines Version 6.0, p. 59)

In other words, if sufficient alternative security measures are in place, 3D Secure authentication is not necessarily required for every transaction. This exception provides the legal basis for services such as Shop Pay to omit 3D Secure authentication in certain situations.

How Services Such as Shop Pay Can Skip Authentication

In the Case of Shop Pay (Shopify)

The reasons Shop Pay can omit 3D Secure authentication are based on a combination of security measures:

1. Multi-factor authentication during initial registration
   • Email address registration
   • SMS verification
   • Verification when registering card information
2. Security during continued use
   • A combination of a registered device and SMS verification (6-digit code)
   • PCI DSS Level 1-compliant security infrastructure (a level of security comparable to that of financial institutions)
3. Risk-based authentication
   • Additional authentication is requested only when the usage pattern differs from normal behavior

Other Services That May Skip Authentication

Apple Pay / Google Pay

• Strong identity verification using biometric authentication (Face ID/fingerprint authentication)
• Protection of card information through tokenization technology
• Security ensured by linking the device with payment information

PayPal / Amazon Pay

• Proprietary account authentication systems
• Advanced fraud detection algorithms
• User assessment based on past transaction history

Cases Where Authentication Is Required

Regardless of which service you use, authentication may be required in the following situations:

• First-time use: When using a new card or service for the first time
• High-value transactions: Purchases above a certain amount (e.g., 10,000 yen)
• Unusual usage patterns: Purchases made at unusual times, locations, or amounts compared with normal behavior
• Use of a new device: Purchases made from an unregistered device
• When determined by the card issuer: When the card issuer determines that the transaction carries a risk

Benefits and Considerations for Users

Benefits

1. Improved Shopping Experience
   • Time savings by reducing the number of steps required
   • Less stress through a smoother purchasing flow
   • Reduced cart abandonment
2. Sufficient Security
   • Security checks are performed only for high-risk transactions
   • Unnecessary authentication procedures can be skipped

Considerations

• Authentication cannot be eliminated completely
• Authentication is generally required for high-value transactions and first-time use
• The conditions under which authentication can be skipped vary by service

For E-commerce Businesses: How to Leverage Services That Can Skip Authentication

1. Implement Advanced Payment Services

By proactively implementing payment services that can omit authentication as described above, businesses can improve the customer experience while maintaining security:

• Shop Pay (Shopify)
• Apple Pay / Google Pay
• PayPal / Amazon Pay

2. Leverage AI-Powered Fraud Detection Systems

• Purchase pattern analysis: Require authentication only for purchase patterns that differ from normal behavior
• Geographic information: Require authentication only when access comes from an unusual region
• Time-based authentication: Require authentication only for transactions outside the customer’s usual purchasing hours

Examples of practical tools: “Kount,” “Signifyd,” “Riskified,” and “Adyen (RevenueProtect)”

3. Optimize Integration with Payment Service Providers

Understand the characteristics of each provider and configure them appropriately:

• GMO Payment Gateway: Plans supporting risk-based authentication
• Stripe: Custom rules can be configured with Radar for Fraud
• PayPal: Proprietary fraud detection system
• Square: Configuration for conditional authentication exemptions

4. Optimize Exceptions and Settings

• Apply for exceptions with card issuers (by presenting a track record of fraud prevention measures)
• Adjust settings based on transaction amount (skip authentication for low-value transactions)
• Configure preferential treatment for repeat customers (skip authentication for purchases after the second transaction)

Conclusion

We hope this article helps those of you who already use Shop Pay or Apple Pay understand why 3D Secure authentication may not be required and enables you to explain this to your customers as well.

The mandatory implementation of 3D Secure is not simply a tightening of regulations; it is an important turning point that will improve the overall reliability of the e-commerce industry. With new technologies enabling us to achieve both security and ease of use, we do not need to impose inconvenience on customers “for the sake of security.”

The burden on businesses resulting from security measures may be unavoidable. However, never forget that customer trust is the most valuable asset. Rather than focusing on reducing short-term inconvenience, building long-term relationships of trust will determine the future success of e-commerce businesses.

Our expert team is available to support you with the latest security requirements and a smooth transition. Please feel free to contact us here.

References

• Ministry of Economy, Trade and Industry (METI), “Credit Card Security Guidelines, Version 6.0” (published March 2025)
• Japan Credit Association, “EMV 3-D Secure Implementation Guide”
• Shopify Help Center, “About Shop Pay”
• Shopify Help Center, “Understanding PSD2 and 3D Secure Checkout”
• Japan Credit Association, “Status of Credit Card Fraud Losses”

This article is based on information available as of April 2025. Laws, regulations, and service specifications may change, so please check the latest information on the respective official websites.