How to Authenticate Pay-by-Link and Invoice Payments with 3DS

Payment links have become a standard way to take card payments outside a website checkout. A hotel sends a deposit link after a phone booking, a clinic emails an invoice with a 'pay now' button, a sales team sends a link in a chat. The customer…

When 3DS and SCA Apply to Commercial, Lodged, and Virtual Cards

Commercial cards cover three quite different uses. An employee may pay for a hotel on a public website with a corporate card. A company may lodge a card with its travel management company, which books and pays on its behalf. Or a booking system…

What Happens to 3DS When an Issuer’s ACS Is Unavailable

When an issuer's Access Control Server (ACS) stops responding, online payments for its cardholders do not necessarily stop. The card scheme's Directory Server (DS) may answer the authentication request on the issuer's behalf. That keeps checkouts…

Certificate and Key Management in EMV 3DS Without Authentication Outages

Most 3DS outages caused by cryptography are not attacks. They are an expired certificate, a key rotated on one side and not the other, or an app released with old key material. The effect is abrupt: authentication for an entire card scheme,…

Can AI Simplify 3D Secure Integration?

Integrating 3D Secure (3DS) into a modern payment environment involves considerably more than connecting an API. Developers must understand authentication flows, protocol messages, card scheme requirements, testing scenarios and the dependencies…

How Least-Cost Routing Online Changes 3DS for Australian Merchants

Most Australian debit cards can be processed on two networks: eftpos and an international scheme such as Visa or Mastercard. Least-cost routing (LCR), also called merchant choice routing, lets the merchant send each transaction over whichever…

What a PCI 3DS Assessment Covers for ACS and 3DS Server Operators

An organisation running an Access Control Server (ACS) or a 3DS Server handles data and cryptographic material that, if compromised, would undermine authentication for every card it touches. The PCI Security Standards Council (PCI SSC) addresses…

How to Authenticate Stored-Card Payments When Account Takeover Is Suspected

Stored cards make checkout quick for genuine customers and for anyone who gets into their account. An attacker who takes over a customer account does not need the card number, and often does not need the security code either. The payment looks…

Using One 3DS Server Across Multiple Acquirers

Many enterprise merchants now route card payments through more than one acquirer, for cost, resilience, or local acquiring in different markets. Authentication often lags behind. Each payment service provider brings its own bundled 3D Secure,…

What the RBA Review Feedback Means for Card-Not-Present Authentication

On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit…