Risk-Based Authentication and 3-D Secure

Risk-based authentication uses information about a transaction, device and payment context to decide whether to request additional cardholder authentication. EMV 3-D Secure (3DS) is an e-commerce protocol through which merchants and issuers exchange data to authenticate a cardholder. EMVCo describes two primary paths: a frictionless flow, where the issuer authenticates without an interactive prompt, and a challenge flow, where the cardholder completes additional authentication. The merchant or payment provider can request or support 3DS, but the issuer’s Access Control Server determines whether a transaction is authenticated and which flow applies. In Stripe’s documentation, its SCA engine can request authentication based on risk and requirements; a manual preference for a challenge or frictionless experience is not a guarantee because the issuer determines the ultimate flow. Authentication is also distinct from authorization: even an authenticated cardholder’s transaction can be declined for other reasons. 3DS aims to reduce e-commerce fraud while limiting unnecessary friction, but a challenge can interrupt checkout and a frictionless flow is not a promise of zero fraud. Availability and obligations depend on region, card, issuer, merchant and integration. When designing a flow, test successful, declined, timed-out and unsupported cases. Explain the next step clearly, avoid retry loops and provide a safe alternative when authentication cannot complete. Monitor both fraud outcomes and abandoned or incorrectly blocked legitimate attempts. 3DS can be requested for some transactions without guaranteeing which challenge method the issuer uses.