Payments14 min readUpdated October 14, 2026

What Is Payment Authentication? A Merchant's Guide to 3DS and SCA

Payment authentication for merchants: 3-D Secure flows, SCA rules and exemptions with EU thresholds, liability shift limits, subscriptions and wallets.

Nick Bonnassies, CMO at Tagada · checked against 11 sources

Article summary

TL;DR

Payment authentication is the check that the person paying is the real cardholder, done by the card issuer before it decides to approve the payment. Online, it runs through 3-D Secure: often invisibly, sometimes with a code, an app or biometrics. In the EEA and UK, Strong Customer Authentication makes it mandatory unless an exemption applies.

Authentication proves who is paying. Authorization checks the card and the funds. The issuer does both, in that order.
With 3-D Secure 2, the issuer decides between a frictionless approval and a challenge. You can state a preference, not force it.
In the EEA and UK, SCA needs two independent factors on customer-initiated online payments. Exemptions exist, but the issuer has the final say.
Exempted and merchant-initiated payments skip the challenge and the liability shift. Fraud disputes on them stay with you.
Subscriptions: authenticate the first payment or the card setup with a mandate, then charge renewals as merchant-initiated transactions.

Want to go further? Ask

On this page

Payment authentication is the moment the card issuer asks "is this really the cardholder?" before it decides whether to approve. For a merchant, it decides three things at once: whether the order goes through, who pays if it turns out to be fraud, and how many customers drop out at checkout. Here is how it works, what the rules require in Europe, and how to keep it from costing you sales. For supplement and skincare brands: fraud and 3D Secure for supplement brands and fraud and 3D Secure for skincare brands.

What is payment authentication?

Payment authentication verifies that the person making a payment is the legitimate cardholder. Online, the card issuer runs it through 3-D Secure, which customers know as Visa Secure, Mastercard Identity Check or American Express SafeKey.9 The checks rely on three kinds of factors.

Factor	What it is	Examples at checkout
Knowledge	Something the customer knows	Password, PIN, answer to a question
Possession	Something the customer has	The phone that receives a one-time code, the banking app on a registered device
Inherence	Something the customer is	Fingerprint, face recognition

Strong Customer Authentication in Europe requires at least two of these, from different categories, and they must be independent: breaching one must not compromise the other.1 When both factors run on the same phone, the issuer must isolate them in separate secure environments.1 A password alone doesn't meet the standard.

Who does what matters. You, the merchant, collect the payment and pass data to the issuer through your processor. The issuer authenticates. You can ask for authentication or ask for an exemption, but you never decide the outcome.

Payment authentication vs authorization

People mix them up because they happen within seconds of each other. They answer different questions.

Authentication: is this the cardholder? The issuer checks identity, through 3-D Secure data or a challenge.
Authorization: can this payment go through? The issuer checks the card's status, the available funds and its own risk rules, then approves or declines.

Fig. 1Where authentication sits in an online card payment

approved declined or closed routing step

CheckoutCard, device and order data
authentication3-D SecureIssuer checks the cardholder
result attachedAuthorizationCard status, funds, riskApproved
approvedCaptureFunds settle to youApproved

identity first, money second

Simplified flow. With an exemption or a merchant-initiated transaction, the authentication step is skipped.

Two consequences for merchants. A payment can be authenticated and still declined at authorization, for instance for insufficient funds. And in Europe, the authentication is tied to the amount and the payee: the customer must see both, the authentication code must match them, and any change to the amount or the payee invalidates it.1 If you authenticate a hold for one amount, the code covers that amount. A larger charge needs a new authentication.

How 3-D Secure 2 works

EMV 3-D Secure, the current version of the protocol, is maintained by EMVCo. Its stated purpose is to help issuers and merchants prevent card-not-present fraud. It works in browsers and inside mobile apps, and it sends the issuer data about the transaction, the payment method and the device.4 The issuer uses that data to decide between two paths.

Fig. 2Frictionless or challenge: the issuer picks

Frictionless flow

Data sentTransaction, card, device
Issuer risk checkLooks like the cardholderApproved
AuthenticatedGoes on to authorizationApproved

The customer clicks Buy and sees nothing more

Challenge flow

Data sentTransaction, card, device
Issuer risk checkNeeds more proofDeclined
Customer actsCode, app approval, biometrics

One more step, and a chance to lose the customer

Based on EMVCo and Stripe documentation. You can ask for a preference; the issuer decides.

For many transactions, EMVCo says, the consumer simply clicks Buy and the payment is approved. On riskier ones, the issuer may require a challenge: a one-time passcode, a knowledge question or biometrics.4 In app integrations, the challenge screens come in four types: one-time passcode, out-of-band approval in the banking app, and single- or multi-select questions.5

What you control and what you don't:

You can request 3-D Secure on any payment, with a preference for a frictionless or a challenge flow. The issuer still decides the final flow.5
You can't style the challenge. On the web, the issuer controls the fonts and colors of the authentication window. You choose where it appears: a modal, inline or a redirect.5
You can't rush it. In Stripe's mobile SDKs, the authentication timeout must be at least 5 minutes to stay compliant with SCA.5
Better data means fewer challenges. Stripe fills 3-D Secure requests with data from the payment flow and the customer's past transactions to reduce friction and failed authentications.5 Billing address, email and a consistent device all help the issuer recognize the cardholder.

The first version of the protocol is gone: major card brands no longer support 3D Secure 1.5 EMVCo recommends version 2.2 or higher for full functionality.4

What happens behind the screen:

The issuer decides a challenge is needed and sends a push to its app.
The customer approves with a fingerprint or face, which is the second factor.
The checkout receives the result and sends the payment for authorization.

Your banknowConfirm your payment€84.00 to Northline Store. Open the app to approve.
Your banknowPayment approvedBiometrics confirmed. You can return to the store.

Illustrative example of an out-of-band challenge.

Liability shift: what authentication buys you, and its limits

When a payment is authenticated with 3-D Secure, liability for most fraud disputes usually moves from you to the issuer. That's covered, with Stripe's exact wording, in our ecommerce fraud prevention guide: the shift is expected but never guaranteed, early fraud warnings still arrive, and non-fraud disputes follow the normal process. What matters here is which kind of authentication outcome gives you the shift.

What happened	Fraud liability	Source
3-D Secure completed, frictionless or challenge	Usually the issuer's, never guaranteed	Stripe5
Network requires 3DS, but the card isn't enrolled	Can still shift to the issuer	Stripe5
Card doesn't support 3DS, or an error occurred	Generally stays with you	Stripe5
Exemption requested and accepted by the issuer	Stays with you	Stripe6
Merchant-initiated transaction (renewal, saved card)	Stays with you	Stripe6
Data Only request (data shared, no authentication)	Stays with you	Stripe6
Apple Pay or Google Pay with a cryptogram	Can shift in some cases	Stripe5

Two more limits from Stripe's documentation. A merchant in a card network fraud monitoring program can lose the shift, and Visa excludes some industries from it altogether: wire transfers and money orders, non-fiat currency sold by non-financial institutions, and stored-value card purchases or loads. And if the issuer sends an inquiry on an authenticated payment, you must answer it: an unanswered inquiry can become a "no-reply" chargeback that voids the shift.5 More in our glossary entry on liability shift.

Practical rule

Every frictionless shortcut has a price. An exemption or a merchant-initiated charge removes the challenge, and with it the liability shift. Use them where your fraud is low, and keep 3-D Secure where it isn't.

Strong Customer Authentication: where it applies

SCA comes from the second Payment Services Directive (PSD2) and its technical standards, Delegated Regulation 2018/389. It has applied since September 14, 2019, with enforcement for ecommerce phased in later.7 In the UK, the rules sit in the Payment Services Regulations 2017 and the related technical standards, supervised by the FCA.11

EEA or UK card, EEA or UK acquirer
SCA applies to customer-initiated online card payments. Issuers may decline a payment that needed authentication and didn't get it, unless an exemption applies.
One leg out of the EEA
When one side, such as the acquirer, is outside the EEA, the EBA says SCA applies on a best-effort basis and the issuer makes its own assessment of whether to block the payment.
Everywhere else
No SCA mandate. Stripe lists similar rules in India, Japan and Australia; in other regions, including the US, 3-D Secure is optional and used to reduce fraud.

Sources: Stripe Docs for the scope and other regions,9 EBA Q&A for one-leg-out payments.3 Mail and telephone orders are outside SCA: card details taken by phone don't need it, but the payment must be flagged as such.8

The regulation also sets some limits that shape the customer experience. The authentication code can be used only once. After at most five consecutive failed attempts, the payer's access is blocked, temporarily or permanently.1

SCA exemptions and their thresholds

Exemptions let a payment skip the challenge. They come from Articles 13 to 18 of the regulation, and they are permissions, not rights: the issuer receives the request, assesses the risk, and makes the final decision.8

Exemption	Condition	Who uses it	Liability shift?
Low value (Art. 16)	Up to €30, as long as the payer hasn't passed €100 in total, or five consecutive payments, since the last SCA	Issuer or acquirer; the issuer keeps count	NoYou keep fraud liability
Transaction risk analysis (Art. 18)	Payment provider's fraud rate under the reference rate for the amount band (table below), and no abnormal signal in real-time analysis	Issuer or acquirer	NoYou keep fraud liability
Recurring, same amount (Art. 14)	Same amount, same payee; SCA on creation, change or first payment	Issuer	No
Trusted beneficiaries (Art. 13)	The cardholder adds you to a list at their bank, with SCA	Cardholder, through the issuer	No
Secure corporate payments (Art. 17)	Dedicated processes for business payers, approved by the authorities	Issuer only	No
Merchant-initiated transactions	Out of scope, not an exemption: payments you start from a mandate, without the customer	You, flagged through your processor	No

Sources: the regulation for the conditions,1 Stripe for liability and who can request each one.6 8 In the UK, the low-value limits are £25 per payment and £85 cumulative.6 Stripe also notes that banks have been slow to offer trusted-beneficiary lists.8

The transaction risk analysis exemption depends on the fraud rate of the payment provider asking for it, calculated over a rolling 90 days on all its remote card payments, authenticated or exempted.1

≤ 0.13%

Fraud rate to exempt card payments up to €100 (£85 in the UK)

≤ 0.06%

Fraud rate to exempt card payments up to €250 (£220)

≤ 0.01%

Fraud rate to exempt card payments up to €500 (£440)

Reference rates from the annex of Regulation 2018/389;1 UK equivalents from Stripe.6 In practice, the band you get depends on your provider. Stripe, for example, currently offers the exemption up to €250 for EEA merchants and up to £220 for UK and Swiss merchants.6

When the issuer says no

An exemption request can come back as a soft decline: the issuer refuses the shortcut and asks for authentication. That isn't a lost sale if your checkout can respond.

Exemption acceptedNo challenge, no liability shiftKeep fraud rules on these payments
Soft decline asking for authenticationThe issuer wants SCA on this oneRetry with 3-D Secure while the customer is still there
Off-session payment declined for authenticationThe customer must authenticate a renewalEmail a link to complete payment, then retry
Challenge failed or timed outNot authenticated, not sent for authorizationLet the customer retry or switch method without losing the cart

Stripe retries automatically with authentication when the issuer sends a soft decline on an exempted payment.5 If you run your own integration, build that retry in: a decline for missing authentication is often the easiest one to recover.

Subscriptions, saved cards and one-click upsells

The rule turns on who starts the payment. When the customer triggers each payment, SCA applies, even with a card on file. When you charge on the basis of a mandate, without any action from the customer, the payment is payee-initiated and outside SCA. Setting up that mandate online is itself subject to SCA.2

Fig. 3The authentication life of a subscription

Sign-upFirst payment or card setup authenticated, mandate accepted
RenewalsMerchant-initiated: no challenge, no liability shift
Issuer pushes backA renewal declined for authentication
Customer returnsAuthenticates once, renewals resume

Based on EBA Q&A 2018_4031 and Stripe's SCA documentation.

What that means in practice:

Authenticate when you save the card. Stripe's guidance is to authenticate the card at the first payment, or with a setup flow when there's no payment, and to flag later payments as off-session.7
Get the mandate in writing. The agreement must cover the customer's permission for you to charge them, the expected frequency and how the amount is set.7
Variable amounts work too. A fixed-amount series can use the recurring exemption, but Stripe treats variable subscriptions as merchant-initiated transactions as well.6
Older cards. Cards saved before December 31, 2020 (EU) or September 14, 2021 (UK) can rely on the earlier agreement, if the issuer accepts it.7
Exemptions aren't guaranteed on renewals either. The issuer can still require authentication on an off-session payment.7 Plan a dunning email with a payment link for that case.

A one-click upsell after checkout is a different case. The customer clicks to buy, so it's a new customer-initiated payment on a card on file. In the EEA and UK, it needs SCA, unless the issuer accepts an exemption such as low value or transaction risk analysis.2 Expect some upsells to trigger a second challenge, and design the page so that's not a dead end. More on renewals in our guide to subscription payment processing.

Apple Pay, Google Pay and wallets

Wallets authenticate before the payment reaches you. With Apple Pay or Google Pay on a device, the customer unlocks the payment with Face ID, a fingerprint or a device code, and the payment carries a cryptogram. Stripe describes them as payment methods with a built-in layer of authentication, well suited to SCA.8

What wallets give you

Authentication built in, without a 3-D Secure window
Liability shift possible with the cryptogram, in some cases5
With a device token, the real card number stays out of your checkout

What to watch

Google Pay can also return a card saved in the customer's Google account, without a device token: that one may still need 3-D Secure10
3-D Secure can't be added on top of a wallet payment at Stripe5

Google's guidance is explicit: when the response says the cardholder wasn't authenticated, apply your risk checks and step up with 3-D Secure where it applies.10 How wallet tokens work is a separate subject, covered in tokenization vs encryption.

Passkeys, biometrics and the end of the SMS code

The SMS one-time code was the default challenge for years. It has known weaknesses: it can arrive late, it can't be received without signal, and a SIM swap hands it to a fraudster. Issuers have been moving to approvals in their banking apps, where the customer confirms with a fingerprint or a face scan.

Passkeys go one step further. The cardholder's device holds a cryptographic key and unlocks it with biometrics or a device PIN, so one gesture can combine possession and inherence. EMVCo and the FIDO Alliance have published how FIDO authentication data can be carried in EMV 3-D Secure messages, to reduce fraud and friction.4 For a merchant, nothing changes in the integration: you still send a 3-D Secure request, and the issuer picks the method. What changes is how many challenges the customer completes. More on biometric authentication in our glossary.

Good to know

You don't choose the challenge method. The issuer does. What you control is the data you send, the moments you request authentication, and how your checkout behaves while the customer completes it.

The conversion trade-off: when to ask for authentication

Every challenge is a step where a legitimate customer can drop out. Every skipped one leaves fraud liability with you. The aim is to authenticate where the risk is and let the rest through.

Request 3-D Secure where the risk is. New cards, high amounts, an elevated fraud score, a mismatch between card, IP and shipping country. Our fraud prevention guide has Stripe's example rule.
Send complete data. Email, billing address, device data and the customer's history with you help the issuer approve without a challenge.
Use exemptions where your fraud is low. Low-value and transaction risk analysis exemptions remove the challenge, and the liability shift with it.
Handle the return trip. Keep the cart, the order and the session through the challenge, on mobile too. Never let a failed challenge send the customer back to an empty checkout.
Recover soft declines. Retry with authentication when the issuer asks for it, on-session right away, off-session with a payment link.
Measure by issuer and country. Track frictionless rate, challenge completion and approvals after authentication. One issuer that challenges everything can hide in an average. Our guide to acceptance rate shows how to read approvals.

Outside Europe, 3-D Secure is your choice. Inside, it's the default, and exemptions are the shortcut.

Authentication when you use more than one processor

Each processor runs its own 3-D Secure integration, its own exemption requests and its own fraud model. Some tools split the two jobs: Stripe, for example, can run 3-D Secure on a payment that another provider processes, and can import 3-D Secure results run elsewhere.9 If you route payments across processors, check with each one how it handles a card first authenticated elsewhere before you charge renewals through it. Routing itself is covered in dynamic payment routing.

How Tagada helps

3DS2 at checkout, cards that move with the customer

TagadaPay runs native 3DS2 with device intelligence and a rules engine. Payments route across Stripe, Adyen and TagadaPay with one logic, with a cascade when one declines. The card vault lets you move customers between merchant accounts without collecting their cards again, so running subscriptions keep charging. The checkout supports Apple Pay, Google Pay and one-click upsells, and subscriptions come with automatic retries. See pricing for plans. Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply for processing

Updated on October 14, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What is payment authentication?

It's the step where the card issuer checks that the person paying is the real cardholder, before it decides whether to approve the payment. Online, it runs through 3-D Secure. Most of the time the issuer approves from the data it receives; on riskier payments it asks the cardholder for a code, an app approval or biometrics.

What is the difference between payment authentication and authorization?

Authentication answers who is paying: the issuer checks the cardholder's identity. Authorization answers whether the payment can go through: the issuer checks the card's status, the available funds and its own risk rules. Authentication comes first. A payment can be authenticated and still declined at authorization, for example for insufficient funds.

What does failed payment authentication mean?

The cardholder didn't complete the issuer's check: wrong code, rejected app prompt, timeout or a closed window. The payment isn't sent for authorization. At Stripe, the payment returns to a state where the customer can retry authentication or use another payment method. Show a clear message and let them try again without rebuilding the cart.

Is 3D Secure mandatory?

In the EEA and UK, for most customer-initiated online card payments, yes: Strong Customer Authentication requires it unless an exemption applies. Similar rules exist in India, Japan and Australia, according to Stripe. Elsewhere, including the US, it's optional: merchants use it on risky payments to cut fraud and move fraud liability to the issuer.

Do recurring payments need strong customer authentication?

The first one does. When a customer sets up a subscription online, the mandate and first payment, or the card setup, must be authenticated. Later renewals charged by the merchant without the customer present are merchant-initiated transactions, outside the scope of SCA. The issuer can still decline one and ask the customer to authenticate.

Does Apple Pay count as strong customer authentication?

Apple Pay and Google Pay device tokens carry built-in authentication: the customer unlocks the payment on their device, and the payment includes a cryptogram. Stripe says liability shift can apply with such cryptograms in some cases. A card saved in a Google account without a device token is different: it may still need 3-D Secure.