3D Secure: payment declined, causes and recourse

A payment declined at 3D Secure usually means authentication failed, not that the card is blocked: code not received, app not approved, time-out. And when the missing approval was part of a fraud, it is the bank that pays.

Why is a payment declined at 3D Secure?

Because one of three checks failed: you, your device, or the bank. The table below lists the causes I met most often, from the most mundane to the rarest.

At Beobank, the Visa Classic page states that an SMS with a one-time code goes to the mobile number given to the bank, and that a Digipass can generate the code instead. At Buy Way, the Mastercard One guide (September 2025 edition) requires a Buy Way Mobile account and a SecureCode: without them, no online purchase goes through.

In the files I used to handle, the most mundane cause was also the most frequent. A mobile number changed two years earlier and never given to the bank. The cardholder thought the card was faulty.

What should you do right away when the payment is declined?

Read the exact message, then do not rush. In order:

1. Note the error text and the time, with a screenshot.
2. Check the approval channel: does the SMS arrive, is the app up to date?
3. Restart the purchase from the beginning, once.
4. Check the online payment limit in the bank's app.
5. Call the issuer if the failure repeats. Buy Way answers Monday to Friday from 8:30 to 17:00 on 02 320 25 96, and the card can be blocked 24 hours a day on 02 320 25 95.

Do not multiply attempts by switching cards on the same site. A burst of attempts looks like a stolen-card test, and issuers' anti-fraud systems read the rhythm of the tries.

Is 3D Secure mandatory in Belgium?

Yes, for the vast majority of online card payments. Article 97 of Directive (EU) 2015/2366, known as PSD2 (and "DSP2" in French), requires strong authentication: two elements among what you know, what you have and what you are.

Belgium rolled it out in steps in 2020. According to RTBF, banks rejected online payments above €1,500 without strong authentication from 25 August 2020. Test-Achats, the Belgian consumer association, published the calendar of Febelfin, the banking federation: €250 on 22 September, €30 on 19 October, €0 on 17 November 2020. The European deadline was 1 January 2021.

Exemptions exist, and they explain why a purchase sometimes goes through without asking anything. They come from Delegated Regulation (EU) 2018/389:

An exemption is an option, not an obligation. The issuer can always require approval, and it is the one that decides.

Is a site without 3D Secure suspect?

Not necessarily, but a first purchase above €30 made without any approval should make you check the merchant. A site outside Europe may not offer authentication: RTBF noted in 2020 that some payments to non-European merchants might be blocked for that reason.

Can a purchase approved with 3D Secure still be disputed?

Yes. Authentication proves that someone approved with your credentials. It does not prove that you consented to the purchase.

Article VII.42 of the Code of Economic Law (Book VII is the part that governs payment services and consumer credit) makes the bank prove that the operation was authenticated, recorded and booked without technical deficiency. It adds that use of the card, as recorded by the bank, does not necessarily suffice to prove that you authorised the operation. The bankinglaw.be guide summarises the same mechanism.

The issuer looks first at the authentication log: channel, device, time. In the files I used to handle, the words "authenticated transaction" came in the first line of the refusal letter. They do not close the debate. The bank must still establish fraud or gross negligence on your part to leave the loss with you, and the definition of gross negligence is detailed in the article on the bank that refuses to refund a fraud.

A commercial dispute is another matter. A parcel never delivered or a subscription debited after cancellation is settled through the chargeback, which your approval does not close. The steps are in the article on chargeback in Belgium.

Who pays if the bank did not require strong authentication?

The bank, unless you acted fraudulently. When strong authentication was required and the issuer did not demand it, the payer bears no financial loss, under article 74 of Directive 2015/2366, carried into article VII.44 of the Code of Economic Law. The €50 excess applies only to a lost or stolen card, before you report.

Refund is due by the end of the first business day after you report (article VII.43). You have thirteen months after the debit to report (article VII.41). Here is how situations split.

The brochure does not highlight this: the protective regime depends on what you did not approve. As soon as you typed the code or touched the screen, the file changes nature, even if you were tricked. The article on the hacked card covers the first-hour steps.

How do three Belgian issuers approve an online purchase?

Each in its own way, and the public pages do not say everything. Here are three cards with their three basic figures.

On the Mastercard One, a €100 ATM withdrawal costs €6.50, and the same guide sets the withdrawal limit between €20 and €620. On Belfius's Visa Classic, the payment limit runs from €500 to €1,900. That is a cause of decline that 3D Secure does not explain, and the mechanism of deferred debit is detailed separately.

The limit to know: none of the three sources publishes how long a code stays valid, or what to do when authentication fails. Buy Way's guide says so by omission: it describes the procedure, not its failures. I will therefore not give you a duration I cannot source.

Who can you turn to if the bank refuses to refund?

First its complaints department, in writing, demanding the facts on which the refusal rests. Then Ombudsfin, the Belgian financial ombudsman: free, written, open after your complaint to the issuer. Its opinion does not bind the bank.

Block the card without waiting, in the app or with Card Stop on 078 170 170, and forward any fraudulent message to suspect@safeonweb.be, the address of Safeonweb. Blocking is detailed in the article on Card Stop.

If a fraud puts your budget under strain during the examination, an accredited debt mediation service or your commune's CPAS (the public social welfare centre) can help you free of charge. This article does not replace advice suited to your situation.

To compare cards on what they cost rather than on their promises, the ranking of Belgian credit cards, the comparison tool and the selection guide start from the same surveyed rates.

Sources, read on 19 October 2026. Strong authentication: article 97 of Directive (EU) 2015/2366; exemptions, articles 13, 14, 16 and 18 of Delegated Regulation (EU) 2018/389, text published by the National Bank of Belgium. Proof, refund and allocation of losses: articles VII.41 to VII.44 of the Code of Economic Law, Book VII, and article 74 of Directive 2015/2366; commentary: bankinglaw.be. Belgian 2020 calendar: RTBF and Test-Achats, 9 September 2020. Beobank Visa Classic, rate in force on 9 May 2025: Beobank. Mastercard One, guide of September 2025: Buy Way. Belfius Visa Classic: Belfius. Recourse: Ombudsfin. The case tables are the author's readings, made on 19 October 2026, which summarise the law without replacing it. No link in this article is paid.