{"id":3268,"date":"2026-10-30T09:34:55","date_gmt":"2026-10-29T23:34:55","guid":{"rendered":"https:\/\/www.gpayments.com\/blog\/?p=3268"},"modified":"2026-10-30T09:34:57","modified_gmt":"2026-10-29T23:34:57","slug":"stale-cardholder-contact-data-3ds-challenges","status":"publish","type":"post","link":"https:\/\/www.gpayments.com\/blog\/article\/stale-cardholder-contact-data-3ds-challenges\/","title":{"rendered":"How Stale Cardholder Contact Data Breaks 3DS Challenges"},"content":{"rendered":"\n

Every EMV 3D Secure (EMV 3DS) challenge depends on cardholder contact data: the phone number that receives a one-time passcode, the email address used as a fallback, the device registered for banking-app approvals. When that data is out of date, genuine cardholders cannot complete the challenge. When it has been taken over, the challenge goes to the fraudster.<\/p>\n

Issuers tend to treat challenge performance as an Access Control Server (ACS) question. Much of it is a data question.<\/p>\n

How cardholder contact data failures show up in challenges<\/h2>\n\n\n\n\n\n\n\n\n
\n

Challenge method<\/strong><\/p>\n<\/td>\n

\n

Contact data it depends on<\/strong><\/p>\n<\/td>\n

\n

Stale data<\/strong><\/p>\n<\/td>\n

\n

Taken-over data<\/strong><\/p>\n<\/td>\n<\/tr>\n<\/thead>\n

\n

SMS one-time passcode<\/p>\n<\/td>\n

\n

Mobile number<\/p>\n<\/td>\n

\n

Code goes to an old number; genuine cardholder abandons<\/p>\n<\/td>\n

\n

Code goes to a SIM the fraudster controls<\/p>\n<\/td>\n<\/tr>\n

\n

Email one-time passcode<\/p>\n<\/td>\n

\n

Email address<\/p>\n<\/td>\n

\n

Code goes to an abandoned inbox<\/p>\n<\/td>\n

\n

Code goes to a compromised inbox<\/p>\n<\/td>\n<\/tr>\n

\n

Banking-app approval (out of band)<\/p>\n<\/td>\n

\n

Registered device and app<\/p>\n<\/td>\n

\n

Push goes to a replaced or reset phone<\/p>\n<\/td>\n

\n

Approval requested on a device the fraudster enrolled<\/p>\n<\/td>\n<\/tr>\n

\n

Passkey or biometric<\/p>\n<\/td>\n

\n

Registered credential on a device<\/p>\n<\/td>\n

\n

Credential lost with the old device<\/p>\n<\/td>\n

\n

Credential enrolled by a fraudster after account takeover<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Stale data shows up as abandoned challenges and complaints. Taken-over data is quieter: the challenge succeeds, and the issuer only learns otherwise when the fraud report arrives. What happens when the app cannot open<\/a> covers the app-specific failure modes.<\/p>\n

Why number takeover matters for SMS challenges<\/h2>\n

A fraudster who moves a cardholder’s mobile number to their own SIM receives every SMS passcode the issuer sends. Australia has tightened telecommunications rules against this. The ACMA’s pre-porting identity verification standard<\/a>, made in 2020, requires additional identity verification before a mobile number is ported to another provider. A later determination<\/a> extended multi-factor identity checks to high-risk customer transactions such as SIM swaps, after the ACMA found that SIM swaps had become the main route for mobile number fraud.<\/p>\n

These rules reduce the risk; they do not remove it. For issuers, a recently changed number or SIM is still a signal worth acting on, and our article on regulators retiring SMS OTPs<\/a> explains why many markets are moving away from SMS for this reason.<\/p>\n

Keeping cardholder contact data fit for authentication<\/h2>\n