Apple Pay and Google Pay don’t “use 3DS under the hood.” They use something called Consumer Device Cardholder Verification Method (CDCVM); where your device handles cardholder authentication directly via Face ID, fingerprint, or passcode.

Here’s the actual data flow when you pay with Apple Pay online:
– You authenticate on your device with Face ID or fingerprint -> this is the CDCVM step
– Apple Pay then generates a cryptogram -> a one-time cryptographic token tied to that specific transaction, your device, and your tokenized card number (DPAN)
– This cryptogram travels through the card network (Visa/Mastercard) to the issuer
– The issuer validates the cryptogram and approves the transaction

CDCVM proves you’re the cardholder. The cryptogram secures the transaction itself. Together, they satisfy the two factors needed for Strong Customer Authentication (SCA): something you have (the device) + something you are (biometric).

No 3DS redirect. No OTP. No issuer challenge. The issuer gets equivalent proof that the real cardholder is present. That’s why issuers grant liability shift on wallet transactions without requiring a 3DS flow.
So is 3DS dying then?
No. Because here’s what wallets don’t cover:

→ Direct card entry on websites. Every time a customer types their card number into a checkout form, that’s a card-not-present (CNP) transaction with no wallet cryptogram. 3DS is the primary way to authenticate these.
→ Markets where not everyone uses wallets. Despite the growth, credit cards still account for 32% of online payments in North America. That’s hundreds of billions in transaction volume that still needs 3DS.

What this actually means:

– Wallets aren’t killing 3DS. They’re splitting the market in two.
For wallet transactions, both online and in-store, CDCVM and cryptograms handle authentication before the payment ever needs 3DS.

– For everything else, direct card entry, markets with low wallet adoption, 3DS remains the backbone of CNP security.

– The more wallets grow, the smaller the “everything else” gets. But it’s still massive. And for 3DS, the real transformation is happening inside the protocol itself.