How Do Issuers Measure the Quality of Their 3DS Authentication Decisions?

A 3D Secure (3DS) authentication strategy has to achieve more than a high volume of frictionless outcomes. Issuers are trying to protect cardholders, assess uncertain transactions and maintain a workable shopping experience. Those objectives can sometimes pull in different directions.

That makes an important question for payment teams: how can an issuer evaluate whether its authentication decisions are actually improving? The answer requires a balanced view of security, challenge experience and operational outcomes – not a single headline metric.

Begin with the decision being made

EMV 3D Secure enables merchants and issuers to exchange transaction, payment method and device information so the issuer can assess a cardholder authentication request. Depending on relevant context and requirements, the issuer’s Access Control Server (ACS) may support a frictionless authentication outcome or require additional cardholder verification.

As EMVCo explains, richer transaction data helps issuers balance fraud protection and friction in ecommerce payments. Authentication is related to, but distinct from, the issuer’s subsequent authorisation decision.

A measurement framework should therefore evaluate the authentication decision itself and its contribution to the wider payment journey.

Track more than challenge rate

A low challenge rate can indicate an efficient experience, but it does not independently prove that the decisions are appropriate. Issuers should review a set of measures together, with definitions that are consistent across channels and portfolios:

• Frictionless and challenge distribution: the share of requests following each permitted path, segmented by relevant transaction context.
• Authentication completion: how frequently cardholders successfully complete required steps, including drop-offs and technical failures.
• Decision consistency: whether similar requests receive consistent treatment under the same approved policy.
• Fraud and dispute outcomes: relevant downstream indicators, interpreted carefully because they reflect more than authentication alone.
• Operational reliability: response times, timeouts, unavailable outcomes and error patterns.

A change in one metric needs interpretation in light of the others. Fewer challenges may be welcome, but not if it coincides with material deterioration in other risk indicators.

Segment results before drawing conclusions

Aggregate performance can hide significant differences between use cases. A transaction with familiar cardholder context may warrant a different approach from an unfamiliar device or unusual purchasing pattern.

A useful review might compare browser and app-based authentication, card scheme programmes, transaction amounts, geography or authentication methods, subject to privacy and data governance requirements. Segmentation helps teams identify where policies work well and where the experience could be improved.

It also reduces the temptation to optimise towards a single global target that makes sense for one segment but not another.

Consider a practical issuer scenario

Suppose an issuer reduces challenges in an effort to lower customer friction. Completion rates improve, which looks encouraging. However, the issuer later observes that a particular high-value transaction segment is behaving differently from the rest of the portfolio.

The right response is not necessarily to reverse the whole policy. Analysts should verify the metrics, review whether the segment’s risk signals changed and test an appropriately targeted adjustment in a controlled environment.

The important outcome is an evidence-backed decision about which authentication journeys need different treatment, rather than a simple pursuit of fewer challenges overall.

Where Decision AI may add value

Decision AI could potentially help payment teams compare trends, surface changes and recommend policy areas for review. In more advanced future applications, contextual models might support issuer decisioning under strict technical and governance controls.

Such possibilities should be separated from the existing EMV 3DS risk-based authentication framework. Any AI-supported approach needs to be tested against specifications, programme requirements, security controls, customer experience and issuer accountability.

A model that improves a dashboard metric but cannot explain its decision boundaries may be unsuitable for a standards-driven payment environment.

Connecting measurement to ActiveAccess

GPayments’ ActiveAccess is an ACS solution for issuer-side 3DS authentication. The broader value of issuer tooling is the ability to manage authentication processes reliably and analyse operational outcomes, without reducing performance assessment to a single number.

Teams evaluating ACS technology should discuss the reporting and monitoring information available for their specific deployment, including the fields needed to examine frictionless, challenge, and unsuccessful authentication flows.

Frequently asked questions

Is a higher frictionless authentication rate always better?

No. It may reduce friction, but performance should also be evaluated against fraud exposure, completion, error rates, and the issuer’s risk policies.

Does a successful authentication guarantee payment authorisation?

No. Authentication and payment authorisation are distinct stages. A successful 3DS outcome does not guarantee the authorisation decision that follows.

Evaluate the whole authentication experience

Good issuer decisioning balances security, outcomes and cardholder experience. Explore GPayments ActiveAccess and discuss the authentication performance measures most relevant to your programme.