Tag Archive for: 3d secure

What a PCI 3DS Assessment Covers for ACS and 3DS Server Operators

An organisation running an Access Control Server (ACS) or a 3DS Server handles data and cryptographic material that, if compromised, would undermine authentication for every card it touches. The PCI Security Standards Council (PCI SSC) addresses…

How to Authenticate Stored-Card Payments When Account Takeover Is Suspected

Stored cards make checkout quick for genuine customers and for anyone who gets into their account. An attacker who takes over a customer account does not need the card number, and often does not need the security code either. The payment looks…

Using One 3DS Server Across Multiple Acquirers

Many enterprise merchants now route card payments through more than one acquirer, for cost, resilience, or local acquiring in different markets. Authentication often lags behind. Each payment service provider brings its own bundled 3D Secure,…

What the RBA Review Feedback Means for Card-Not-Present Authentication

On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit…

When Merchants Should Request a 3DS Challenge, and When to Ask for None

Every EMV 3D Secure (EMV 3DS) authentication request can tell the issuer whether the merchant wants the cardholder challenged. The field is the 3DS Requestor Challenge Indicator (threeDSRequestorChallengeInd). It is a preference, not an instruction:…

What Regulators Retiring SMS OTPs Means for 3D Secure Challenges

For more than a decade, the most common EMV 3-D Secure (EMV 3DS) challenge has been a one-time passcode (OTP) sent by SMS. Several regulators have now acted against it. Coverage tends to describe this as a single global ban, but the rules differ…

Why Authenticated Transactions Lose Their 3D Secure Protection at Authorisation

Authentication and authorisation are separate steps, run by different systems and often by different providers. 3D Secure produces evidence that the cardholder was authenticated. The authorisation message has to carry that evidence to the issuer.…

How Issuers Should Use 3DS Results When the Authorisation Arrives

Inside many issuers, the Access Control Server (ACS) and the authorisation system belong to different teams, run on different platforms and use different risk models. The ACS decides whether to authenticate the cardholder. Seconds later, the…

What an EMVCo Letter of Approval Means for a 3DS Product

Vendors of 3DS Servers, Access Control Servers (ACS) and 3DS SDKs routinely describe their products as 'EMVCo certified'. The phrase sounds like a single fact. In practice, EMVCo approval is granted to a specific product version, against a…

How to Prepare Your 3D Secure Authentication for Peak Trading

Peak trading tests every part of an online checkout, but authentication is the part a merchant controls least. Your 3DS Server, whether you run it or your payment service provider does, depends on the card schemes' Directory Servers and on…