How to Authenticate Stored-Card Payments When Account Takeover Is Suspected

Stored cards make checkout quick for genuine customers and for anyone who gets into their account. An attacker who takes over a customer account does not need the card number, and often does not need the security code either. The payment looks…

Using One 3DS Server Across Multiple Acquirers

Many enterprise merchants now route card payments through more than one acquirer, for cost, resilience, or local acquiring in different markets. Authentication often lags behind. Each payment service provider brings its own bundled 3D Secure,…

What the RBA Review Feedback Means for Card-Not-Present Authentication

On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit…

When Merchants Should Request a 3DS Challenge, and When to Ask for None

Every EMV 3D Secure (EMV 3DS) authentication request can tell the issuer whether the merchant wants the cardholder challenged. The field is the 3DS Requestor Challenge Indicator (threeDSRequestorChallengeInd). It is a preference, not an instruction:…

What Regulators Retiring SMS OTPs Means for 3D Secure Challenges

For more than a decade, the most common EMV 3-D Secure (EMV 3DS) challenge has been a one-time passcode (OTP) sent by SMS. Several regulators have now acted against it. Coverage tends to describe this as a single global ban, but the rules differ…

How Passkeys, Network Tokens, and EMV 3DS Fit Together at Checkout

On 6 October 2026, Mastercard announced that Wio Bank had become the first issuer in the UAE to auto-enable Click to Pay for its cards. Mastercard describes the experience as powered by its network tokenisation and EMVCo authentication standards,…

Why Authenticated Transactions Lose Their 3D Secure Protection at Authorisation

Authentication and authorisation are separate steps, run by different systems and often by different providers. 3D Secure produces evidence that the cardholder was authenticated. The authorisation message has to carry that evidence to the issuer.…

How Issuers Should Use 3DS Results When the Authorisation Arrives

Inside many issuers, the Access Control Server (ACS) and the authorisation system belong to different teams, run on different platforms and use different risk models. The ACS decides whether to authenticate the cardholder. Seconds later, the…

What an EMVCo Letter of Approval Means for a 3DS Product

Vendors of 3DS Servers, Access Control Servers (ACS) and 3DS SDKs routinely describe their products as 'EMVCo certified'. The phrase sounds like a single fact. In practice, EMVCo approval is granted to a specific product version, against a…

Where 3D Secure Helps Against Card Testing, and Where It Doesn’t

Card testing, also called enumeration, is the automated use of an online checkout to find out which stolen or generated card numbers still work. Bots submit large numbers of small or zero-value payments, keep the cards that succeed and sell…