3-D Secure
Definition
3-D Secure (3DS) is an extra authentication step in an online card payment. The card issuer confirms that the person paying is the cardholder, usually with a one-time SMS code or an approval in the bank app, before the charge goes through. In Turkey it is the standard for e-commerce card payments.
Why it matters for your store
3DS changes who carries the fraud risk. When a payment is authenticated, liability for a "this was not me" dispute moves from the merchant to the card issuer in most cases. That means fewer chargebacks and fewer lost goods.
It also shapes the checkout experience. The customer leaves your page, or sees a bank frame inside it, approves the payment, and comes back. If the bank never sends the result, the order can hang in an unknown state. If the customer fails the check, they need a fast way back to the cart. Both edges need handling, and both are common.
Finally, 3DS is a compliance signal. Payment providers and banks in Turkey expect it, and card schemes reward authenticated traffic with lower dispute rates.
How Kambloo handles it
3DS is the default flow for every card gateway on Kambloo: iyzico, PayTR, Stripe (for international sales, under SCA rules), and direct bank virtual POS connections. The card form is always the provider's own page or iframe, so card data never touches Kambloo servers.
When the customer confirms payment, Kambloo creates the order, reserves stock, and sends the customer to the bank. The bank posts a signed result back to Kambloo. Nothing is processed until the signature is verified. If the result does not arrive within ten minutes, a status query job asks the provider directly, so a payment never stays in limbo.
If the authentication fails, the stock reservation is released at once, the customer returns to the cart with the error, and a retry starts a fresh payment. Duplicate results from the bank, which are common, are detected and ignored.
Questions about 3-D Secure
Is 3-D Secure mandatory for online stores in Turkey?
Turkish banking regulation treats 3DS as the standard for e-commerce card payments. Non-3DS (non-secure) processing is opened by banks only with special permission and is rare for consumer stores.
Does 3-D Secure lower conversion?
It adds one step, so some customers drop off during the redirect. A clean return to the store, a clear error message, and an immediate retry from the cart keep that loss small.