Tag Archive for: 3DS2

When 3DS and SCA Apply to Commercial, Lodged, and Virtual Cards

Commercial cards cover three quite different uses. An employee may pay for a hotel on a public website with a corporate card. A company may lodge a card with its travel management company, which books and pays on its behalf. Or a booking system…

Where 3D Secure Helps Against Card Testing, and Where It Doesn’t

Card testing, also called enumeration, is the automated use of an online checkout to find out which stolen or generated card numbers still work. Bots submit large numbers of small or zero-value payments, keep the cards that succeed and sell…

How Merchants Should Measure 3D Secure Performance

Many merchants judge 3D Secure by a single figure, if they measure it at all: an authentication success rate, or a chargeback rate. Neither tells you where a sale was lost or whether authentication is protecting you. A checkout can show a healthy…

The 3DS challenge iframe settings that are now requirements rather than recommendations

Most merchants set up their challenge iframe once, during the original 3DS integration, and have not looked at it since. That was defensible when the guidance was advisory. It is not any more. EMVCo released the EMV 3D Secure Browser Flow…

How Bridging Message Extensions Support New Features in Older 3DS Products

No payments estate upgrades in a single step. Some components move to a new protocol version quickly, others are constrained by vendor release cycles, scheme certification windows or simply by the fact that they work and nobody wants to touch…

When an Issuer Lets the Merchant Authenticate the Cardholder

A cardholder unlocks a retailer's app with their face, browses, and checks out. They are then asked to authenticate again, this time by their bank, using a code sent by text message. The second authentication is weaker than the first and considerably…

How Trust Lists Reduce Challenges for Merchants Cardholders Trust

Every issuer has a cardholder who buys from the same three merchants every week and gets challenged every time. The risk model is not wrong exactly. It just has no way of knowing what the cardholder knows, which is that this particular…

How Exemptions Are Requested, Granted and Reported Across the 3DS Message Flow

Most discussion of Strong Customer Authentication exemptions happens at policy level. Which exemptions exist, what the thresholds are, when a regulator expects them to apply. That conversation is well covered. What gets much less attention…
3-D Secure authentication for Australian merchants

3-D Secure for Australian Merchants: What You Need to Know in 2026

Card-not-present (CNP) fraud on Australian-issued cards reached $913 million in 2024, a 20% increase year-on-year, according to the Australian Payments Network’s (AusPayNet) 2025 Australian Payment Fraud Report. CNP fraud now accounts for…
PSD2 Europe

3D Secure and PSD2 Strong Customer Authentication: A Guide for European and UK PSPs

PSD2 SCA requires most remote card payments in the EU and UK to use at least two independent authentication factors. EMV 3DS2 is the main way to meet this for card‑not‑present transactions, via challenges or eligible frictionless exemptions.