It is basically up to merchant what to implement. I ever developed a site (in team) for South East Asia customer. Singapore law and Indonesia law are pretty muc

It is basically up to merchant what to implement. I ever developed a site (in team) for South East Asia customer. Singapore law and Indonesia law are pretty much have freedom in it. You can choose 2D / 3DS. Yes, the different is pretty clear: who will responsible for the fraud. For 2D, merchant is responsible for fraudulent transaction -- and merchant can be charged back; while in 3DS the merchant will free from chargeback (hey you have been notified via two-factor authentication, so it is your fault, customer!) Meanwhile, in Malaysia, all credit card transaction must be in 3DS.