An extra security step can be reassuring when a transaction looks unusual. It can also interrupt a legitimate customer who was moments away from completing a purchase. The challenge for payment authentication is not simply whether a cardholder can be asked to verify their identity. It is when that additional verification is appropriate.
This is why I think risk-based authentication is such a useful lens for discussing Decision AI. The most effective customer experience is not necessarily one with the fewest checks or the greatest number of challenges. It is one in which the authentication response reflects the available transaction context.
The decision behind the experience
EMV 3D Secure enables data exchange between the merchant and issuer to support cardholder authentication. Depending on the issuer’s assessment and other applicable requirements, authentication may proceed through a frictionless flow or involve an additional challenge.
The cardholder sees the resulting experience. What they do not see is the information and operational logic that help determine it.
For issuers, the question is how to balance fraud risk with legitimate customer convenience. Unnecessary challenges can introduce friction; insufficient scrutiny can create other risks. That balance depends on reliable data, suitable authentication methods and a clear understanding of the transaction.
Why more friction is not the same as more security
It can be tempting to assume that challenging more transactions creates a more secure environment. But blanket treatment ignores differences between transactions and customer circumstances.
A routine purchase from a familiar context may warrant a different response from a transaction displaying unusual signals. Conversely, the absence of obvious warning indicators does not guarantee that a transaction is legitimate.
Risk-based authentication is valuable because it supports differentiated treatment. The objective is not to eliminate friction at all costs. It is to apply a proportionate response when additional confidence is needed.
That principle is already part of the established 3DS ecosystem. It should not be confused with a claim that every risk-based authentication system uses an AI model.
Where Decision AI could add value
The emerging Decision AI question is whether systems can evaluate available signals more contextually, recognise uncertainty and support a controlled recommendation about the next authentication step.
A bounded decision might involve whether additional verification is warranted under the issuer’s policy, or whether a case needs a different supported authentication method. The decision must remain consistent with protocol requirements, card scheme rules and relevant regulation.
An AI system should not invent a transaction history, override established security requirements or make an unreviewable judgement based on poorly understood data. For issuers, operational control and visibility are as important as sophisticated scoring.
The information behind the outcome
EMV 3DS can carry relevant transaction, payment and device information into the issuer domain. The quality and availability of this information influence the risk assessment that follows.
Imagine two transactions with the same amount but different supporting signals. One resembles the cardholder’s expected activity; the other has characteristics that warrant further examination. A system that considers only the amount cannot explain the difference.
A more contextual process considers the information that is legitimately available and useful. It also needs to recognise gaps in that information rather than treating missing fields as certainty.
This matters especially as issuers manage evolving channels, devices and authentication journeys.
What this means for an ACS
The Access Control Server is a critical component of issuer-side EMV 3DS authentication. GPayments’ ActiveAccess supports configurable risk-based authentication logic and operational tools for managing the authentication environment.
That established capability is distinct from hypothetical future AI-driven decisioning. What interests me is how the wider industry will continue to improve the quality, transparency and adaptability of authentication decisions.
An effective ACS environment needs to support an issuer’s chosen controls and the practical requirements of day-to-day operations, not just produce a technical response.
A smarter definition of progress
A future authentication strategy should be assessed through more than challenge rates. Issuers also need to understand fraud outcomes, authentication performance, false friction and the evidence behind decisions, within the measures available to them.
The broader lesson is simple. The goal is not to challenge every customer or challenge none of them. It is to make each authentication response proportionate to the information and risk at hand.
Further reading
Learn about GPayments ActiveAccess for issuers and EMV 3DS from EMVCo.