How to Authenticate Stored-Card Payments When Account Takeover Is Suspected

Stored cards make checkout quick for genuine customers and for anyone who gets into their account. An attacker who takes over a customer account does not need the card number, and often does not need the security code either. The payment looks…
Read more

Using One 3DS Server Across Multiple Acquirers

Many enterprise merchants now route card payments through more than one acquirer, for cost, resilience, or local acquiring in different markets. Authentication often lags behind. Each payment service provider brings its own bundled 3D Secure,…
Read more

What the RBA Review Feedback Means for Card-Not-Present Authentication

On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit…
Read more

When Merchants Should Request a 3DS Challenge, and When to Ask for None

Every EMV 3D Secure (EMV 3DS) authentication request can tell the issuer whether the merchant wants the cardholder challenged. The field is the 3DS Requestor Challenge Indicator (threeDSRequestorChallengeInd). It is a preference, not an instruction:…
Read more

What Regulators Retiring SMS OTPs Means for 3D Secure Challenges

For more than a decade, the most common EMV 3-D Secure (EMV 3DS) challenge has been a one-time passcode (OTP) sent by SMS. Several regulators have now acted against it. Coverage tends to describe this as a single global ban, but the rules differ…
Read more

How Passkeys, Network Tokens, and EMV 3DS Fit Together at Checkout

On 6 October 2026, Mastercard announced that Wio Bank had become the first issuer in the UAE to auto-enable Click to Pay for its cards. Mastercard describes the experience as powered by its network tokenisation and EMVCo authentication standards,…
Read more

Why Authenticated Transactions Lose Their 3D Secure Protection at Authorisation

Authentication and authorisation are separate steps, run by different systems and often by different providers. 3D Secure produces evidence that the cardholder was authenticated. The authorisation message has to carry that evidence to the issuer.…
Read more

Where 3D Secure Helps Against Card Testing, and Where It Doesn’t

Card testing, also called enumeration, is the automated use of an online checkout to find out which stolen or generated card numbers still work. Bots submit large numbers of small or zero-value payments, keep the cards that succeed and sell…
Read more

How Merchants Should Measure 3D Secure Performance

Many merchants judge 3D Secure by a single figure, if they measure it at all: an authentication success rate, or a chargeback rate. Neither tells you where a sale was lost or whether authentication is protecting you. A checkout can show a healthy…
Read more