On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions<\/a> to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit routing. A shorter section deals with card-not-present (CNP) fraud on Australian cards at overseas merchants, and it is the part that matters most for payment authentication.<\/p>\n Submitters cited 2024 AusPayNet data putting gross overseas fraud on Australian cards at an estimated A$454 million, with overseas transactions making up roughly half of the fraud on those cards despite being about 3 per cent of transaction value. A few submissions raised a strong customer authentication (SCA) mandate for high-risk transactions. Most did not support the RBA prioritising the issue at all.<\/p>\n The RBA says it will publish a list of regulatory priorities by the end of 2026 and begin further consultation on prioritised issues from mid-2027. Nothing has been decided. What can be explained now is where EMV 3D Secure (EMV 3DS) sits in this problem, and why some of the options raised would be harder to apply than others.<\/p>\n The RBA summary records a clear split.<\/p>\n The smaller group that supported prioritisation described overseas CNP fraud as a material consumer protection and efficiency issue, given how over-represented overseas transactions are in the fraud figures. They pointed out that fraud costs can land in Australia even when the merchant and acquirer are overseas. Options they raised included an SCA mandate for high-risk transactions, standardised issuer-level fraud controls for overseas transactions and, from one issuer, an ecosystem-wide end-to-end SCA approach combined with scheme fraud-performance frameworks.<\/p>\n The larger group saw it as a valid concern but a low priority for the review, with limited evidence that formal RBA intervention is warranted. One global participant reported that cross-border CNP fraud rates and overall card fraud rates for Australian cards have declined, and an industry group said it is developing a coordinated program of work. Many argued that domestic action would have limited effect because the drivers sit with overseas merchants and acquirers, and preferred international coordination, better data sharing and changes through other frameworks such as the ePayments Code or the Scams Prevention Framework.<\/p>\n Australia already has a mechanism that ties authentication to fraud performance. AusPayNet’s CNP Fraud Mitigation Framework, implemented through Volume 7 of its Issuers and Acquirers Community (IAC) Code Set<\/a>, sets a merchant fraud threshold of 20 basis points and A$50,000 in fraud losses per quarter. Merchants that stay under it are not obliged to authenticate online CNP transactions; merchants that breach it face escalating requirements to apply strong authentication. Our article on multi-jurisdictional 3DS compliance<\/a> covers how the framework compares with PSD2 and PSD3, and what Australia’s 1 October payment reforms do and do not change<\/a> explains why the surcharging and interchange changes left it untouched.<\/p>\n The limitation submitters highlighted is one of reach. The framework is enforced through the IAC Code Set, so it binds Australian participants. It cannot compel an overseas acquirer or merchant to authenticate a transaction on an Australian card.<\/p>\n Authentication only happens in EMV 3DS when the merchant side starts it. That single fact explains most of the overseas gap.<\/p>\nWhat submissions said about overseas CNP fraud<\/h2>\n
Why the domestic framework does not reach overseas merchants<\/h2>\n
Where EMV 3DS sits in an overseas CNP transaction<\/h2>\n
| \n Step<\/strong><\/p>\n<\/td>\n Who controls it<\/strong><\/p>\n<\/td>\n Australian influence<\/strong><\/p>\n<\/td>\n<\/tr>\n<\/thead>\n\n Decide whether to request authentication<\/p>\n<\/td>\n Overseas merchant and its PSP<\/p>\n<\/td>\n None through domestic rules; scheme rules and local regulation in the merchant’s market apply<\/p>\n<\/td>\n<\/tr>\n Send the authentication request through the scheme Directory Server<\/p>\n<\/td>\n Overseas 3DS Server operator<\/p>\n<\/td>\n None directly<\/p>\n<\/td>\n<\/tr>\n Assess risk and decide whether to challenge<\/p>\n<\/td>\n Australian issuer’s Access Control Server (ACS)<\/p>\n<\/td>\n Full, but only if a request arrives<\/p>\n<\/td>\n<\/tr>\n Approve or decline the authorisation<\/p>\n<\/td>\n Australian issuer<\/p>\n<\/td>\n Full<\/p>\n<\/td>\n<\/tr>\n Carry fraud liability<\/p>\n<\/td>\n Depends on scheme rules and whether authentication took place<\/p>\n<\/td>\n Indirect, through scheme rules<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u00a0<\/p>\n When an overseas merchant does send an authentication request, the Australian issuer’s ACS can apply its own risk-based decision and challenge the transactions it considers high risk. When the merchant sends the authorisation without authentication, the ACS never sees the transaction. The issuer is then left with its authorisation decision alone: approve, decline, or in markets and schemes that support it, return a soft decline asking for authentication (see how soft declines work<\/a>).<\/p>\n It also helps to keep two terms apart. EMV 3DS is a messaging protocol. SCA is an outcome, usually defined as authentication using two independent factors. A frictionless EMV 3DS authentication based on risk data is not SCA in that sense, while a challenge using two factors can be. Any mandate framed around SCA would need to say which of these it means.<\/p>\n The table below maps each option recorded in the RBA summary to who it would bind and where it would act. This is GPayments analysis, not a forecast of what the RBA will do.<\/p>\n Option raised in submissions<\/strong><\/p>\n<\/td>\n Who it would bind<\/strong><\/p>\n<\/td>\n Where it acts in the EMV 3DS flow<\/strong><\/p>\n<\/td>\n Practical dependency<\/strong><\/p>\n<\/td>\n<\/tr>\n<\/thead>\n\n SCA mandate for high-risk transactions<\/p>\n<\/td>\n Depends on scope: domestic issuers, or card networks and overseas merchants<\/p>\n<\/td>\n At the issuer, it would change ACS challenge decisions; at the merchant, it would require authentication requests to be sent<\/p>\n<\/td>\n Reaching overseas merchants would need scheme rules or overseas regulators, not domestic rules alone<\/p>\n<\/td>\n<\/tr>\n Standardised issuer-level controls for overseas transactions<\/p>\n<\/td>\n Australian issuers<\/p>\n<\/td>\n ACS risk rules and authorisation decisions<\/p>\n<\/td>\n Only affects transactions the issuer sees; unauthenticated overseas transactions are handled at authorisation<\/p>\n<\/td>\n<\/tr>\n Ecosystem-wide SCA with scheme fraud-performance frameworks<\/p>\n<\/td>\n Issuers, acquirers and merchants via scheme rules<\/p>\n<\/td>\n Both ends: merchant initiation and issuer decision<\/p>\n<\/td>\n Relies on card networks setting and enforcing global rules<\/p>\n<\/td>\n<\/tr>\n International coordination on CNP standards<\/p>\n<\/td>\n Indirect<\/p>\n<\/td>\n Whatever overseas markets and schemes adopt<\/p>\n<\/td>\n Timing outside Australia’s control<\/p>\n<\/td>\n<\/tr>\n Better data collection and sharing<\/p>\n<\/td>\n Participants who join<\/p>\n<\/td>\n Feeds issuer ACS and authorisation risk models<\/p>\n<\/td>\n Voluntary unless mandated<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u00a0<\/p>\n Read across the rows and one difference stands out. Options aimed at Australian issuers act only on what reaches them. Options that would change merchant behaviour overseas depend on card networks or foreign regulators.<\/p>\n None of the following depends on the outcome of the review:<\/p>\n Not a general one. The AusPayNet CNP Fraud Mitigation Framework requires stronger authentication from domestic merchants whose fraud exceeds set thresholds. The RBA summary records that a few submissions raised an SCA mandate for high-risk transactions, but the RBA has not proposed one.<\/p>\n The RBA intends to publish a list of regulatory priorities by the end of 2026 and to start further consultation on prioritised issues from mid-2027. Overseas CNP fraud may or may not be on that list.<\/p>\n No. The surcharging ban and lower interchange caps that took effect on 1 October 2026 came from the RBA’s separate review of merchant card payment costs. The Review of Payments System Regulation is a broader review whose priorities have not yet been set.<\/p>\n An issuer can decline any authorisation under its own risk policy. Declining too broadly turns away genuine customers shopping overseas, so most issuers weigh the transaction’s risk rather than applying a blanket rule.<\/p>\n The RBA publishes submissions to the review on its website alongside the summary, except where a submitter asked for confidentiality.<\/p>\n GPayments provides ActiveAccess<\/a>, an Access Control Server for issuers and issuer processors, and ActiveServer, a 3DS Server for acquirers, gateways, PSPs, and merchants. To discuss how cross-border authentication decisions work on either side of the transaction, speak with a GPayments 3DS specialist.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" On 6 October 2026 the Reserve Bank of Australia (RBA) published its summary of the 75 submissions to the Issues Paper for its Review of Payments System Regulation. Most of the attention has gone to mobile wallets, American Express and debit routing. A shorter section deals with card-not-present (CNP) fraud on Australian cards at overseas […]<\/p>\n","protected":false},"author":13,"featured_media":3199,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[2],"tags":[19,138],"class_list":["post-3197","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-article","tag-3d-secure","tag-rba"],"aioseo_notices":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/posts\/3197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/comments?post=3197"}],"version-history":[{"count":2,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/posts\/3197\/revisions"}],"predecessor-version":[{"id":3200,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/posts\/3197\/revisions\/3200"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/media\/3199"}],"wp:attachment":[{"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/media?parent=3197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/categories?post=3197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gpayments.com\/blog\/wp-json\/wp\/v2\/tags?post=3197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |