Tag Archive for: 3d secure

How to Authenticate Stored-Card Payments When Account Takeover Is Suspected

Stored cards make checkout quick for genuine customers and for anyone who gets into their account. An attacker who takes over a customer account does not need the card number, and often does not need the security code either. The payment looks…

Using One 3DS Server Across Multiple Acquirers

Many enterprise merchants now route card payments through more than one acquirer, for cost, resilience, or local acquiring in different markets. Authentication often lags behind. Each payment service provider brings its own bundled 3D Secure,…

What the RBA Review Feedback Means for Card-Not-Present Authentication

On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit…

When Merchants Should Request a 3DS Challenge, and When to Ask for None

Every EMV 3D Secure (EMV 3DS) authentication request can tell the issuer whether the merchant wants the cardholder challenged. The field is the 3DS Requestor Challenge Indicator (threeDSRequestorChallengeInd). It is a preference, not an instruction:…

What Regulators Retiring SMS OTPs Means for 3D Secure Challenges

For more than a decade, the most common EMV 3-D Secure (EMV 3DS) challenge has been a one-time passcode (OTP) sent by SMS. Several regulators have now acted against it. Coverage tends to describe this as a single global ban, but the rules differ…

Why Authenticated Transactions Lose Their 3D Secure Protection at Authorisation

Authentication and authorisation are separate steps, run by different systems and often by different providers. 3D Secure produces evidence that the cardholder was authenticated. The authorisation message has to carry that evidence to the issuer.…

How to Prepare Your 3D Secure Authentication for Peak Trading

Peak trading tests every part of an online checkout, but authentication is the part a merchant controls least. Your 3DS Server, whether you run it or your payment service provider does, depends on the card schemes' Directory Servers and on…

What India’s Cross-Border CNP Authentication Rule Means for Issuers and ACS Providers

Since 1 October 2026, card issuers in India have had to put in place a mechanism to validate non-recurring cross-border card-not-present (CNP) transactions when an overseas merchant or overseas acquirer asks for authentication. They also had…

What Australia’s 1 October Payment Reforms Do and Do Not Change for 3D Secure

On 1 October 2026, two parts of the Reserve Bank of Australia's (RBA) review of merchant card payment costs took effect. Merchants can no longer surcharge card payments on the eftpos, Mastercard, and Visa networks, and the caps on interchange…

How to Scope 3DS Regression Testing When a Component Changes

Changes arrive at a 3DS deployment from more directions than most test plans anticipate. A specification bulletin. A new device information version driven by an operating system release. A vendor patch. A scheme programme update. A counterparty…