{"id":2188,"date":"2025-07-25T10:53:37","date_gmt":"2025-07-25T00:53:37","guid":{"rendered":"https:\/\/blog.gpayments.com\/?p=2188"},"modified":"2025-07-25T10:53:37","modified_gmt":"2025-07-25T00:53:37","slug":"understanding-3ri-in-3d-secure-a-business-friendly-guide","status":"publish","type":"post","link":"https:\/\/www.gpayments.com\/blog\/user-guide\/understanding-3ri-in-3d-secure-a-business-friendly-guide\/","title":{"rendered":"Understanding 3RI in 3D Secure: A Business-Friendly Guide"},"content":{"rendered":"\n

In today\u2019s digital economy, businesses are expected to offer payment experiences that are both frictionless and secure. Customers subscribe to services, make repeat purchases, and expect charges to occur seamlessly. How can merchants charge a customer regularly or in special situations without asking them to re-enter details or approve every time? The answer lies in 3RI (3DS Requestor-Initiated)<\/a> payments within the 3D Secure<\/a> framework.<\/p>\n

This blog post will demystify 3RI in simple terms, provide real-world examples, and explain how it benefits businesses (from merchants to payment providers) as well as the challenges to consider. We\u2019ll also explore how GPayments can help implement 3RI, so your business can leverage this technology with ease.<\/p>\n

What is 3RI in 3D Secure?<\/h2>\n

3RI, short for 3DS Requestor-Initiated authentication, is a feature introduced in version 2.2 of the EMV 3D Secure protocol\u200b. In essence, it allows a merchant or payment provider (the ‘3DS Requestor’) to initiate a cardholder authentication without the customer actively participating each time. In other words, the merchant can authenticate a payment on the customer\u2019s behalf when the customer isn\u2019t actively on the website or app. This is why 3RI is often called ‘merchant-initiated authentication’, the merchant\u2019s systems handle the authentication process instead of prompting the cardholder.\u00a0<\/p>\n

Think of the traditional 3D Secure<\/a> flow: a customer at checkout is redirected to their bank\u2019s verification page or app to confirm a purchase (entering a one-time code or using biometric approval). With 3RI, after an initial setup, subsequent transactions can be authenticated in the background without interrupting the customer. The merchant\u2019s system securely sends the necessary data to the issuer bank, which checks and approves the transaction based on previously stored credentials and risk analysis\u200b. The customer isn\u2019t required to input their card details or verification code again for those later charges.<\/p>\n

A Real-World Example<\/h3>\n

To illustrate, imagine a customer subscribes to a monthly streaming service. When they sign up, they complete a normal 3D Secure verification for the first payment (perhaps entering an OTP from their bank). That initial checkout involved the customer and fulfilled Strong Customer Authentication (SCA) requirements. The streaming service then securely stores the customer\u2019s payment credentials (or a tokenised version). In subsequent months, when it\u2019s time to charge the subscription fee, the service uses 3RI to authenticate the transaction with the bank without disturbing the customer. The recurring charge is processed securely in the background and the customer isn\u2019t asked to do anything each month, yet the transaction still benefits from 3D Secure\u2019s fraud checks. The result is a seamless experience for the customer and a compliant, secure process for the business.<\/p>\n

This concept isn\u2019t limited to subscriptions. 3RI basically covers any scenario where a merchant needs to initiate a payment when the cardholder isn\u2019t actively involved at that moment.<\/strong> It\u2019s a way to tell the issuer, \u201cI have authorisation from the cardholder on file, please authenticate this new transaction using the data we have.\u201d By doing so, the issuer can approve the payment with confidence, or decline\/challenge if something looks suspicious, all without the normal interactive step with the customer.<\/p>\n

How Does 3RI Work? (Without the Technical Jargon)<\/h2>\n

The mechanics of 3RI can be summed up in a few steps. First, there is usually an initial transaction with the customer present. During this transaction, e.g., the first payment in a series, the customer goes through the standard 3D Secure authentication (perhaps confirming via their banking app or SMS code). This initial step establishes a “trusted link” or record for future payments\u200b. Think of it as the customer giving permission and proving their identity once.<\/p>\n

For each subsequent payment (for example, the next month\u2019s subscription fee or the next instalment in a payment plan<\/em>), the merchant\u2019s system initiates an authentication request to the 3D Secure network without prompting the user\u200b. The request includes data about the transaction and references the previous authentication (for instance, using stored authentication IDs or tokens from the initial transaction). The issuer (cardholder\u2019s bank) receives this behind-the-scenes authentication message and performs a risk assessment just like it would if the customer were checking out live\u200b. The bank checks details like the card info, the transaction history, and any parameters shared from the initial verification to decide if the new charge looks legitimate\u200b.<\/p>\n

If all seems in order, the issuer provides a frictionless authentication approval, and the payment proceeds without a hitch – the customer isn\u2019t even aware of the background check – they just see their service continue or their order go through. Only if something appears risky (say a suspiciously large amount or out-of-pattern charge) might the issuer step in and require additional verification. In 3DS 2.2, there\u2019s even a concept called decoupled authentication, where if a challenge is needed but the customer isn\u2019t online, the issuer can authenticate via an out-of-band method (e.g., later via a banking app notification). However, in most cases, properly set up 3RI transactions will flow through transparently.<\/p>\n

Key point:<\/strong> 3RI leverages the data and consent from a prior customer-approved transaction to streamline future ones. The merchant or payment provider must have the customer\u2019s card credentials stored securely (often via tokenisation in a vault) and must use a 3D Secure 2.2+ capable system to send these 3RI authentication requests\u200b.<\/p>\n

From a business perspective, you don\u2019t need to dive into the technical messages being exchanged, it\u2019s handled by your payment gateway or 3D Secure server provider. But it\u2019s useful to know that under the hood, each 3RI payment still undergoes an authentication check (risk-based, often invisible) to maintain security.<\/p>\n

Real-World Examples of 3RI in Action<\/h2>\n

3RI is incredibly useful across various business models. Here are some real-world use cases where 3RI makes a big difference for merchants:<\/p>\n