For instance, PayPal's patented 'verification' uses one or more dummy transactions are directed towards a credit card, and the cardholder must confirm the value of these transactions, although the resulting authentication can't be directly related to a specific transaction between merchant and cardholder.
This additional security authentication is based on a three-domain model hence the 3-D in the name itself.
The problem for the cardholder is determining if the pop-up window or frame is really from their card issuer when it could be from a fraudulent website attempting to harvest the cardholder's details.
The newer recommendation to use an inline frame instead of a pop-up has reduced user confusion, at the cost of making it harder, if not impossible, for the user to verify that the page is genuine in the first place.
Perhaps the biggest disadvantage for merchants is that many users view the additional authentication step as a nuisance or obstacle, which results in a substantial increase in transaction abandonment and lost revenue.
Even if the merchant has a mobile web site, unless the issuer is also mobile-aware, the authentication pages may fail to render properly, or even at all.