3D Secure / EMV 3DS
The cardholder authentication protocol for card-not-present transactions. 3DS2 adds frictionless, decoupled, and challenge flows while enabling SCA compliance under PSD2 and reducing CNP fraud liability.
Strong Customer Authentication & PSD2
EU Payment Services Directive 2 (PSD2) mandates Strong Customer Authentication (SCA) for most electronic payments initiated by EU cardholders. 3DS2 is the primary mechanism for meeting SCA requirements for card-not-present transactions.
What SCA Requires
Something You Know
PIN, password, security question answer
Something You Have
Mobile phone (OTP via SMS), hardware token, payment card
Something You Are
Fingerprint, face recognition, iris scan
At least 2 of the 3 factors must be present. The factors must be independent — compromise of one must not affect the others.
SCA Exemptions
| Exemption | Condition | Who Claims | Risk |
|---|---|---|---|
| Low Value (LVP) | Transaction < EUR 30. Max 5 consecutive LVP txns or cumulative EUR 100 between SCA events. | Merchant / Acquirer | Low |
| Transaction Risk Analysis (TRA) | Merchant/acquirer fraud rate below scheme threshold (0.13% for <EUR100, 0.06% for <EUR250, 0.01% for <EUR500). Real-time risk scoring. | Acquirer or Issuer | Medium |
| Trusted Beneficiary | Cardholder has whitelisted the merchant with their issuer. Future purchases at same merchant can skip SCA. | Issuer | Low |
| Recurring Transactions | Same merchant, same amount, same frequency. First transaction must have SCA; subsequent are exempt. | Merchant / Acquirer | Low |
| Corporate / B2B | Lodge cards, virtual cards, corporate cards used for business-to-business payments. | Issuer | Medium |
| MIT (Merchant Initiated) | Transaction initiated by merchant without cardholder present (subscription renewal, instalment). No SCA required as cardholder is not in session. | Merchant / Acquirer | Low-Medium |
Soft Decline Flow
What is a soft decline? When a merchant claims an SCA exemption in the authorization request but the issuer requires SCA, the issuer responds with response code 65 (exceeds frequency limit) or similar issuer-specific code, rather than declining outright.
Merchant action: Re-initiate 3DS authentication with the threeDSRequestorChallengeInd set to request a challenge. The issuer then steps up the authentication. After successful 3DS, re-submit the authorization with the CAVV.
Soft declines are common in EU markets. Merchants must handle response code 65 gracefully to avoid transaction abandonment.