Two ways to authenticate
EMV 3-D Secure exchanges information between the merchant side and the card issuer during a card-not-present payment. Transaction and device information can help the issuer decide how to authenticate the cardholder. The three domains are the merchant/acquirer side, the issuer side and interoperability between them.
In a frictionless flow, authentication can proceed without another interactive step. In a challenge flow, the issuer asks the shopper to act. A banking-app approval or one-time code may be used, but the method depends on the issuer and implementation.
When the issuer asks the shopper to act
An issuer can request a challenge when it needs further authentication. The shopper may switch to a banking app and then return to checkout. The integration must handle completion, cancellation, expiry and an interrupted return without guessing the payment outcome.
Show an accurate status while the result is being resolved. Do not make repeated clicks on Pay or another challenge the default answer to an uncertain result. First establish the payment’s actual state through the provider’s supported process.
Check the payment result separately
Authentication concerns the cardholder. Authorization is the issuer’s decision on the payment request. A payment can pass authentication and still fail authorization. Further stages, such as capture, depend on the integration and payment flow.
Scroll the table sideways to compare all columns.
| What happened | What to check next |
|---|---|
| Frictionless authentication succeeds | Check the payment result. Authentication alone does not mean the payment was approved. |
| The shopper completes a challenge | Check that the payment reached the state required for fulfillment before releasing the order. |
| The shopper closes the challenge or it expires | Check the provider’s status and supported recovery. This does not, by itself, show that the shopper is fraudulent. |
| A completed payment is later disputed | Check the dispute reason and required evidence. Authentication does not resolve every dispute. |
An order may still be awaiting payment after a successful challenge if the payment attempt is then declined. Sending a paid-order receipt based only on the challenge would mislead the customer and fulfillment staff. Keep the order aligned with the payment state you actually received.
Liability protection has conditions
Some eligible 3D Secure payments may shift liability for certain fraud disputes under card-network rules. The authentication result and other conditions determine eligibility. A successful authentication does not guarantee a liability shift.
Delivery, refunds and dispute responses still matter. A goods-not-received claim raises a different issue from whether the cardholder authenticated. Keep the order, delivery and customer-service records needed for the relevant dispute.
Test the return to checkout
Run frictionless and challenge journeys using the provider’s supported test cases. Check cancellation, expiry and the return from a banking app. Confirm that an authenticated but declined payment does not create a paid order.
For an uncertain result, test how the customer gets help and how staff reconcile the payment. The recovery path should not simply invite another payment attempt.
3D Secure is one part of payment risk management. Ask your payment provider which 3D Secure settings, exemptions and liability conditions apply to your account and integration.