When an Issuer Lets the Merchant Authenticate the Cardholder

A cardholder unlocks a retailer's app with their face, browses, and checks out. They are then asked to authenticate again, this time by their bank, using a code sent by text message. The second authentication is weaker than the first and considerably…
Read more

How Binding a Device to a Cardholder Account Changes ACS Risk Assessment

Risk-based authentication works better the more it knows about the device in front of it. That is uncontroversial. What is less obvious is that the protocol provides a way for the cardholder themselves to confirm the link between a device and…
Read more

How Trust Lists Reduce Challenges for Merchants Cardholders Trust

Every issuer has a cardholder who buys from the same three merchants every week and gets challenged every time. The risk model is not wrong exactly. It just has no way of knowing what the cardholder knows, which is that this particular…
Read more

How Exemptions Are Requested, Granted and Reported Across the 3DS Message Flow

Most discussion of Strong Customer Authentication exemptions happens at policy level. Which exemptions exist, what the thresholds are, when a regulator expects them to apply. That conversation is well covered. What gets much less attention…
Read more

Why Browser-Based Out-of-Band Authentication Fails on Mobile

Out-of-band authentication is meant to be the good option. The cardholder approves a payment in their banking app, where they are already enrolled, already recognised, and already familiar with the interface. No codes to read off an SMS, nothing…
Read more

Why Skipping the 3DS Method URL Raises Your Challenge Rate

If your frictionless rate is lower than your peers and your data quality looks fine, there is a good chance the problem sits earlier in the checkout than you have been looking. Before an authentication request is ever sent, the browser flow…
Read more

What Should Issuers Measure Across 3D Secure Authentication?

Issuers should monitor more than transaction volume. A useful 3D Secure view includes authentication success, frictionless and challenge ratios, decoupled activity, decline reasons, errors, device channels, issuer and scheme views, and trends…
Read more

ACS vs 3DS Server vs Directory Server: What’s the Difference and Who Needs Which

As online payments grow and AusPayNet and PSD2/PSD3 rules enforce Strong Customer Authentication (SCA), implementing 3D Secure (3DS2) is essential for preventing payment fraud and securing liability shifts. However, technical buyers often struggle…
Read more

Giving Issuers Greater Control Over the 3D Secure Authentication Experience

Issuer control over the 3D Secure authentication experience includes more than branding. Modern ACS platforms can support configurable content, challenge templates, responsive previews and page flows scoped by issuer, card scheme, authentication…
Read more