How Least-Cost Routing Online Changes 3DS for Australian Merchants

Most Australian debit cards can be processed on two networks: eftpos and an international scheme such as Visa or Mastercard. Least-cost routing (LCR), also called merchant choice routing, lets the merchant send each transaction over whichever network costs it less. The RBA has found that merchants with LCR enabled pay nearly 20 per cent less to accept debit payments than those without it, as Australian Payments Plus (AP+) notes.

For years this mattered mainly at the terminal. eftpos now supports online payments, and AP+ states that online merchants can ask customers to authenticate with EMV 3D Secure (EMV 3DS) before the payment is processed. That brings routing and authentication into the same checkout, and the order in which they happen starts to matter.

Why routing has to come before authentication

Each card network runs its own 3DS programme. An authentication is produced under one network’s programme, carries that network’s authentication data, and is checked by that network when the authorisation arrives. A result created for Visa Secure should not be expected to stand in for an eftpos authentication, or the other way round.

The practical sequence for a dual-network debit card is therefore:

1. Identify the card as dual-network debit and decide which network will carry the payment.
2. Authenticate under that network’s 3DS programme.
3. Send the authorisation over the same network, with the authentication result intact.

This is the same principle that applies when a merchant routes across several acquirers, covered in using one 3DS Server across multiple acquirers. Here the choice is between networks rather than acquirers, which makes the dependency stricter.

What happens when routing falls back

PSPs that support LCR commonly retry over the international scheme if the eftpos route fails, so that the customer’s payment still goes through. If the original authentication was performed for eftpos, the retry is now on a network that has not authenticated the cardholder. Unless the checkout re-authenticates for the new network, the retried payment goes to authorisation without valid authentication data, which can mean a decline or a fraud-liability position the merchant did not expect (why authenticated transactions lose their protection at authorisation).

Merchants and PSPs should agree which of three options applies on a network fallback: re-authenticate on the new network, proceed without authentication within an agreed risk limit, or decline and ask the customer to retry.

How Click to Pay with eftpos changes the picture

Guest checkouts have historically been the hardest place to apply LCR online, because the merchant has no stored routing preference and often no token. AP+ and G+D have been developing eftpos Click to Pay with integrated LCR, piloted and set to roll out from early 2026, with payments using network tokens in place of card numbers. In that model, the routing decision moves inside the Click to Pay flow. Merchants adopting it should confirm with their PSP where authentication sits in the flow and which network’s programme it uses.

What merchants and PSPs should check

• Whether your PSP or acquirer supports eftpos online authentication, and through which 3DS Server.
• Where in your checkout the routing decision is made, and whether it happens before the authentication request is sent.
• What your PSP does on a network fallback, and whether it re-authenticates.
• Whether your reporting separates authentication and approval outcomes by network, so a problem on one route is visible (how merchants should measure 3D Secure performance).
• How LCR interacts with stored cards and tokens in your checkout.

Frequently asked questions

Does least-cost routing apply to credit cards?

No. LCR applies to dual-network debit cards, which can be processed on eftpos or an international scheme. Credit cards run on a single network.

Does eftpos support 3D Secure for online payments?

Yes. Australian Payments Plus states that online merchants can request customers to authenticate with EMV 3DS before an eftpos transaction is processed.

Can a merchant authenticate on Visa and then route the payment to eftpos?

This should not be relied on. Authentication results are produced and checked within one network’s programme. Decide the route first, then authenticate for that network.

Does least-cost routing affect liability shift?

Liability for fraud follows each network’s own rules and the authentication result it receives. A payment routed to a network without valid authentication for that network should not be assumed to carry authentication protection.

Can least-cost routing work at a guest checkout?

It has historically been harder there. eftpos Click to Pay with integrated LCR, which AP+ has been piloting with G+D, is designed to close that gap.

Designing routing and authentication together

GPayments’ ActiveServer is a 3DS Server used by acquirers, payment gateways, PSPs and merchants. To review how routing and authentication fit together in your checkout, speak with a GPayments 3DS specialist.