Last month, Visa retired the Digital Authentication Framework version of 3D Secure, and Mastercard consolidated its own step-up flow under Identity Check. Every headline is saying the same thing: passkeys make online payments more secure. That’s true, when taken just at face value. But it’s much less secure overall than you might realize.
The story everyone is telling
Visa confirmed in its merchant business news digest that it would sunset the DAF 3DS program in September 2026, with no new participants accepted and DAF test cases already optional for Visa Secure certification since October 2025. The replacement is Visa Payment Passkey (VPP), built on the FIDO standard, which swaps passwords and SMS one-time codes for a biometric or device PIN check tied to the cardholder’s own device. Mastercard is running a parallel track, with its existing step-up authentication platform Identity Check absorbing the same passkey pattern and phasing out legacy 3DS 1.x endpoints on its own timeline.
The idea behind both companies’ new systems is that they’ll result in fewer challenge screens and less checkout abandonment for customers, as a fingerprint or face scan replaces a code sent by text message. That pitch is accurate. Passkeys are a real, measurable win against phishing and credential replay at the login and checkout moment, but not necessarily more secure than the systems that they’re replacing.
A passkey proves possession, but not intent
A passkey confirms that a specific device, holding a specific private key, produced the correct cryptographic response at the moment someone authenticated it. That’s a strong, phishing-resistant signal, and it closes off an entire category of attack, including fake login pages, intercepted one-time codes, and credential-stuffing scripts that only work against passwords.
However, it doesn’t tell a fraud team whether the account behind that device was compromised before the passkey was ever set up, nor whether the person tapping the sensor is being coached, in real time, by a scammer on another call. It also doesn’t tell them whether the “customer” completing checkout is a person at all, rather than a shopping agent acting on stored payment credentials with no human reviewing the order. Authentication cleanly answers one question, while fraud prevention continues asking questions after that initial answer comes back as yes.
4 fraud types authentication was never built to catch
While authentication passkeys have their perks, there’s several situations where they actually provide worse security than traditional MFA and password systems, including:
- Post-login account takeover: Once a session is authenticated, a stolen session cookie, an infostealer sitting on a personal device, or a SIM-swapped phone number can hand a fraudster the same access a passkey would have granted the real owner, without ever touching the login form the passkey protects. Security researchers tracking this shift describe session hijacking and multi-factor fatigue attacks as the harder problem in 2026, precisely because they route around the login screen instead of attacking it directly.
- Scams: A real customer, using their own real passkey, on their own real device, can still be walked through a payment by someone impersonating their bank, their delivery courier, or a family member. The authentication succeeds. The intent behind it was manufactured by someone else.
- Agent-driven purchases: As shopping agents get wired into stored payment methods and one-click checkout, the “authenticated session” making the purchase decision may not involve a human weighing the transaction at all. That is a governance and consent question a passkey has no mechanism to answer.
- Refund and dispute abuse: First-party misuse, sometimes called friendly fraud, never touches a login screen or a checkout challenge. A legitimate purchase, made by the legitimate account holder, gets disputed anyway and will still count against a merchant’s overall CB rate, even if the financial liability shifts to the issuing bank. No authentication upgrade changes that.
The chargeback squeeze arriving at the same time
The timing compounds the problem. Visa’s Acquirer Monitoring Program folded its old fraud and dispute programs into a single ratio, and on April 1, 2026, it cut the merchant “excessive” threshold from 2.2% to 1.5%, a roughly one-third reduction, with an $8 fee attached to every flagged transaction and no warning tier before enforcement starts. Mastercard’s parallel Excessive Chargeback Program can enroll a merchant at just 100 disputes in a month. Both ratios combine confirmed fraud reports with cardholder disputes, so a single bad transaction can count against a merchant twice.
In other words, merchants are being told their checkout is safer at the exact moment the financial penalty for the fraud types checkout authentication does not touch, account takeover, scams, first-party disputes, gets sharper. A passkey migration that stops at the login screen leaves that exposure completely untouched.
Decisioning has to run the length of the customer lifecycle
The fix for this is continuous risk decisioning that runs from registration through the login process and the transaction itself, and into the dispute that follows, rather than a single strong authentication check and nothing afterwards. Sift’s Q1 2026 Digital Trust Index found that nearly three in four consumers have abandoned an online transaction over fraud concerns, and that global e-commerce fraud losses are projected to top $107 billion annually by 2029, growing at roughly 19% a year. Once operational costs like chargebacks and customer support are factored in, fraud and related abuse can consume close to 10% of a business’s annual online revenue. None of that cost lives exclusively at the login page.
Teams that handle this well treat risk as something to reassess at every step rather than decide once. New signals, such as an unfamiliar device, an unusual velocity pattern, or a dispute filed weeks after the sale, change the picture and decisions need to change with them. Sift uses this approach, and blocks tens of thousands of card-testing and routine-reject attempts every year, protecting six figures in fraud losses annually, without adding unneeded friction to legitimate transactions.
Passkeys are worth deploying. They will cut phishing losses and, when done well, cut checkout friction too. They are simply not a fraud strategy on their own, and treating the 3DS sunset as a finish line rather than one input into a longer decisioning chain is how a team can end up secure at the front door while leaving the rest of the house open.
If you’re interested, visit our solutions page to learn more about how Sift’s risk scoring can help your team stop account takeover.
Frequently asked questions
Does the 3DS sunset affect merchants who never enrolled in Visa’s DAF program?
Directly, no. Visa’s DAF 3DS retirement affects merchants and issuers processing through that specific framework. But the broader shift toward FIDO-based passkeys, and the tightened VAMP dispute thresholds arriving alongside it, affect nearly every card-not-present merchant, regardless of which 3DS implementation they run today.
Do passkeys lower a merchant’s Visa VAMP ratio?
They can help on the fraud-report side, since phishing-driven account compromise and stolen-credential fraud tend to fall as passkey adoption rises. They do very little for the dispute side of the ratio, since first-party disputes and post-login account takeover both continue to generate TC15 and TC40 reports regardless of how the original session was authenticated.
What should a fraud and trust and safety team prioritize now that DAF 3DS has been retired?
First, confirm the transition actually landed clean: check for authentication failures or unauthenticated fallout anywhere in the gateway, PSP, cart platform, or mobile SDK chain, since a broken handoff often surfaces as a dispute spike weeks later rather than an outage on day one. Then look past the migration itself: make sure risk decisioning covers the full lifecycle, registration, login, transaction, and dispute, rather than concentrating protection at the authentication moment alone.
