Payment authentication does not stand still. New devices, changing payment behaviour and evolving attack methods create a moving set of conditions for issuers and payment technology providers.
Against that background, the prospect of more adaptive authentication decisions is compelling. But ‘adaptive’ should mean more than deploying an AI model and allowing it to make an unexplained judgement. In a standards-based payment environment, adaptability has to operate within controlled and testable boundaries.
The existing foundation is risk-based
EMV 3DS already supports the exchange of information that can help issuers assess transactions and determine appropriate authentication flows. Risk-based authentication may use configured logic, third-party risk services or other approved assessment methods.
That foundation matters. Decision AI is not the invention of contextual authentication; it is a potential extension of how relevant signals could be assessed and acted upon.
The industry’s challenge is to improve decision quality without undermining the reliability, transparency and security expected of payment infrastructure.
What ‘adaptive’ could mean
A more adaptive approach might recognise changing patterns in the information legitimately available to an issuer, evaluate a combination of signals and recommend when additional verification is appropriate.
Consider an illustrative pattern: a particular transaction context becomes less familiar over time. A system may need to respond differently from the way it would have responded before, provided the change is supported by evidence and the issuer’s approved policy.
This should not be confused with an AI model having unrestricted permission to learn from live activity and alter production authentication behaviour without oversight. Changes to decision processes need validation, governance and monitoring.
Decision AI needs well-defined outcomes
One way to keep adaptability controlled is to define the set of supported actions before any model is introduced. The authentication environment has protocol-defined routes, technical constraints and operational responsibilities.
A decision-support layer can only be useful if its outputs fit those real-world constraints. It must know when information is insufficient and when a rule or requirement takes precedence over a model recommendation.
For example, a system might help assess whether the available context supports a frictionless route or whether an appropriate challenge should be considered. The actual treatment would remain subject to issuer controls and relevant requirements.
Why testing becomes more important, not less
A sophisticated decision process creates more questions for testing teams. How does it behave when information is missing? What happens when signals conflict? Can unusual scenarios be reproduced? What happens if the model is unavailable?
Traditional functional tests remain essential, but adaptive logic also needs attention to consistency, exceptional cases and unintended outcomes. A failure mode should not result in an uncontrolled authentication path.
This makes testing environments valuable as places to explore realistic scenarios and verify technical behaviour before production changes are made. GPayments’ TestLabs provides a 3DS testing environment, including scenarios relevant to authentication outcomes and errors.
TestLabs should not be presented as an AI-model certification system; it is a practical 3DS testing capability within its documented scope.
The role of engineers and risk teams
Adaptive decisioning is not exclusively a data science question. Issuer risk teams, authentication specialists, security engineers and operational owners all need to understand what is being changed and why.
That includes how the approach will be monitored, what metrics should be reviewed, how incidents will be investigated and when a decision policy should be reconsidered.
Clear responsibilities matter because a good result in a demonstration is not evidence that a system is ready for unrestricted live use.
Avoiding the black-box trap
An adaptive authentication model that cannot be examined or governed may be difficult to trust. Decision explanations need not reveal every internal calculation, but teams require meaningful visibility into the signals and controls that shaped an outcome.
Customers also need the protection of appropriate data handling and security practices. Richer context is useful only when it is collected and used lawfully and safely.
The direction worth pursuing
For GPayments, the broader opportunity is to keep supporting reliable 3DS infrastructure while following developments that could improve the quality of issuer decisions.
The most promising future isn’t an uncontrolled AI layer on top of authentication. It is more responsive evaluation of risk, paired with the standards, testing and operational safeguards that payment systems require.
Further reading
Learn about ActiveAccess and GPayments’ 3DS testing environment.