When Merchants Should Request a 3DS Challenge, and When to Ask for None

Every EMV 3D Secure (EMV 3DS) authentication request can tell the issuer whether the merchant wants the cardholder challenged. The field is the 3DS Requestor Challenge Indicator (threeDSRequestorChallengeInd). It is a preference, not an instruction:…

What Regulators Retiring SMS OTPs Means for 3D Secure Challenges

For more than a decade, the most common EMV 3-D Secure (EMV 3DS) challenge has been a one-time passcode (OTP) sent by SMS. Several regulators have now acted against it. Coverage tends to describe this as a single global ban, but the rules differ…

How Passkeys, Network Tokens, and EMV 3DS Fit Together at Checkout

On 6 October 2026, Mastercard announced that Wio Bank had become the first issuer in the UAE to auto-enable Click to Pay for its cards. Mastercard describes the experience as powered by its network tokenisation and EMVCo authentication standards,…

Why Authenticated Transactions Lose Their 3D Secure Protection at Authorisation

Authentication and authorisation are separate steps, run by different systems and often by different providers. 3D Secure produces evidence that the cardholder was authenticated. The authorisation message has to carry that evidence to the issuer.…

How Issuers Should Use 3DS Results When the Authorisation Arrives

Inside many issuers, the Access Control Server (ACS) and the authorisation system belong to different teams, run on different platforms and use different risk models. The ACS decides whether to authenticate the cardholder. Seconds later, the…

What an EMVCo Letter of Approval Means for a 3DS Product

Vendors of 3DS Servers, Access Control Servers (ACS) and 3DS SDKs routinely describe their products as 'EMVCo certified'. The phrase sounds like a single fact. In practice, EMVCo approval is granted to a specific product version, against a…

Where 3D Secure Helps Against Card Testing, and Where It Doesn’t

Card testing, also called enumeration, is the automated use of an online checkout to find out which stolen or generated card numbers still work. Bots submit large numbers of small or zero-value payments, keep the cards that succeed and sell…

How Merchants Should Measure 3D Secure Performance

Many merchants judge 3D Secure by a single figure, if they measure it at all: an authentication success rate, or a chargeback rate. Neither tells you where a sale was lost or whether authentication is protecting you. A checkout can show a healthy…

How to Prepare Your 3D Secure Authentication for Peak Trading

Peak trading tests every part of an online checkout, but authentication is the part a merchant controls least. Your 3DS Server, whether you run it or your payment service provider does, depends on the card schemes' Directory Servers and on…

What India’s Cross-Border CNP Authentication Rule Means for Issuers and ACS Providers

Since 1 October 2026, card issuers in India have had to put in place a mechanism to validate non-recurring cross-border card-not-present (CNP) transactions when an overseas merchant or overseas acquirer asks for authentication. They also had…