A non-secure transaction can be described as an e-commerce transaction that is approved without any verification prior to authorization (such as sending an SMS OTP and verifying the password contained in it before the transaction). In short, authorization is obtained simply by verifying the card number, expiration date, and CVV2 information.
Who decides whether a transaction is Non-secure?
The merchant decides whether a transaction is Non-secure. If the merchant does not support 3D Secure, the transaction is automatically carried out as Non-Secure.
So who is liable for fraud cases that may arise in transactions carried out as Non-Secure?
In Non-Secure transactions, liability belongs to the merchant.
You can find details on how a transaction's 3D Secure level is determined in my article below.
How is risk managed in non-secure transactions?
Since there is no verification, merchants need additional measures: monitoring address and IP mismatches, manually reviewing high-value or unusual orders, preventing a high number of attempts with the same card in a short period, and using blacklists.
On the bank side, amount-based and sector-based limits are often applied to this type of transaction. Depending on the product, some banks do not accept non-secure transactions at all.
For the merchant, the safest approach is to make 3D Secure mandatory and to deliberately define exceptions only after a risk analysis.
