How does liability shift work?
When a payment is authenticated through 3-D Secure, the authentication result and its indicator travel with the authorization. If the cardholder later disputes the payment as fraud, the issuer’s dispute is checked against that result, and for eligible payments the issuer, not the merchant, bears the loss. Stripe’s documentation says liability shift typically applies to payments successfully authenticated with 3-D Secure and, in some cases, to payments with equivalent cryptograms such as Apple Pay or Google Pay.
Why does it matter?
For a store with fraud pressure, liability shift turns authentication from a conversion cost into a loss limit. As an illustrative example: a merchant receives 120 fraud disputes a month on unauthenticated payments, averaging 80 euros. If authenticating its riskiest 30% of payments covers 90 of those disputes, about 7,200 euros a month in fraud losses move to issuers, minus the sales lost to challenges.
What are the limits?
Liability shift is not protection from all disputes. Stripe notes that a merchant must still answer inquiries on authenticated payments, because an unanswered inquiry can become a chargeback that loses the liability shift, and that liability shift can be downgraded after authorization. Exemptions, used to avoid challenges, usually mean the merchant keeps the liability.
Where does Omno use it?
3-D Secure is performed by the connected PSP, and Omno’s hosted checkout carries the authentication step inside the payment flow. Routing and cascading keep the authentication state consistent when a payment moves between providers, and card blocking stops cards linked to past chargebacks from being used again.