IIRC, this depends on the card brand. Attempting to do 3-D Secure with non-enrolled JCB/Visa cards should result in a liability shift, AMEX/Diners only records the attempt, and MasterCard does not offload liability in such cases. (Though this may also vary by country.)