Pay-by-Link Payments and 3D Secure

Payment links have become a standard way to take card payments outside a website checkout. A hotel sends a deposit link after a phone booking, a clinic emails an invoice with a ‘pay now’ button, a sales team sends a link in a chat. The customer opens the link, enters their card details on a hosted payment page and pays.

Because the conversation that led to the payment often happened by phone or email, link payments are sometimes treated like mail order or telephone order (MOTO) payments. For authentication purposes they are not. The customer enters their own card details online, which makes it an ecommerce payment, and EMV 3D Secure (EMV 3DS) applies in the same way as at any checkout.

Why a payment link is not a MOTO payment

In a MOTO payment, the customer gives card details to the merchant by phone or post, and the merchant enters them. In a link payment, the merchant only supplies the link; the customer completes the payment on a web page. That is a remote electronic payment initiated by the customer.

The distinction matters most in the EEA and UK. The European Banking Authority has stated that remote non-electronic payments initiated by mail or telephone order can be considered out of scope of strong customer authentication (SCA), while card payments initiated by the payer through the payee are electronic payments within its scope (EBA Q&A 2019_4788). A link payment completed online by the customer falls on the electronic side of that line, so SCA rules apply and EMV 3DS is the normal way to meet them. Outside those markets there may be no mandate, but the liability position still depends on whether the payment was authenticated.

Our MOTO guide covers payments where the merchant does take card details by phone or post.

Why payment links attract fraud

Fraudsters send fake payment links that imitate genuine merchants, so customers become wary of real ones and fraud teams see disputes on links the merchant never sent.
Links get forwarded. The person who pays may not be the person the invoice was addressed to.
A long-lived link can be reused or tested with stolen cards long after the original transaction was settled.
Link payments are often high value, such as travel deposits or professional fees, which raises the stakes of an unauthenticated payment.

Design choices that help link payments authenticate well

Design choice	Why it helps authentication
Run the payment page through EMV 3DS like any checkout, using the browser flow and the 3DS Method	Gives the issuer device and browser data, which supports frictionless outcomes for genuine customers
Send what you already know about the customer: email, phone, billing address and account history	Merchants sending a link usually know far more than a guest checkout does (requestor data quality)
Make the merchant name in the authentication match the name on the invoice	Customers abandon or dispute payments they do not recognise
Fix the amount and currency in the link to the invoice	The authenticated amount then matches the authorised amount
Make links single-use and set an expiry	Limits reuse and card testing through old links
Design the page for mobile, including challenge display	Most links are opened on phones (challenge iframe requirements)

If the link stores the card for later

Some links are used to set up a card for future charges, such as balances, incidentals or instalments. The link payment is then the customer-initiated payment that should be authenticated, and later charges follow merchant-initiated rules. If an account behind the link is later compromised, the signals described in authenticating stored-card payments when account takeover is suspected apply.

Frequently asked questions

Is pay-by-link a MOTO payment?

No. The customer enters their own card details online, so it is an ecommerce payment. MOTO covers payments where the merchant takes card details by phone or post.

Do payment links need 3D Secure outside Europe?

There may be no legal mandate, but authentication still decides who carries fraud liability under card scheme rules. Many merchants authenticate link payments for that reason, particularly high-value ones.

Can a link payment be authenticated without a challenge?

Yes. With good device data and the customer information the merchant already holds, many issuers can authenticate frictionlessly. The issuer makes the final decision.

What if the customer forwards the link to someone else?

The person paying is then authenticated by their own card issuer, which protects the merchant against fraud on that card. Whether the payment should be accepted from a third party is a business decision for the merchant.

Should payment links expire?

Generally yes. Single-use links with a sensible expiry reduce reuse, card testing and confusion when a customer finds an old link.

Authenticating every payment route

GPayments’ ActiveServer is a 3DS Server used by acquirers, payment gateways, PSPs, and merchants. To review how your payment links authenticate, speak with a GPayments 3DS specialist.