Why Do 3DS Results Vary by Issuer If the Protocol Is Identical?

3DS results vary depending on the card issuer. This happens because the EMV 3-D Secure specification standardizes the messages, data fields and flows, but not the issuer’s risk decision. Every issuer’s Access Control Server receives the exact same type of authentication request. However, each issuer uses its own risk model, exemption policy, and challenge method. They make these choices based on how they balance preventing fraud losses, maintaining high checkout conversion, and meeting their specific regulatory obligations.

These differences are easy to measure. According to Ravelin’s Global Payments Report 2026, frictionless authentication happens 54% of the time in North America and 62% of the time in Europe. Additionally, groups like the EBA and ECB found that card fraud on EEA issued cards is 17 times higher when the payee is outside the EEA, where SCA (Strong Customer Authentication) is not legally required.

Because rules and results change by region, merchants will find that authentication works best as a strategy tailored to each individual market, instead of a one-size-fits-all rule.

What part of 3DS is standardized, and what part is left to the issuer?

The EMV 3DS specification defines the messages, data fields and flows exchanged between the merchant’s 3DS Server, the card network’s Directory Server, and the issuer’s Access Control Server (ACS). However, it does not control how the ACS makes its risk decision. The choice to authenticate a transaction silently, issue a challenge, or reject authentication is completely up to the issuer. They make this choice inside the ACS by relying on their own unique fraud model and risk tolerance.

It is helpful to understand the basic structure before looking at the outcomes. A card-not-present authentication process moves through three main steps:

1. The merchant’s 3DS Server gathers the transaction and device details and bundles them into an authentication request (AReq).
2. The network’s Directory Server receives that request and routes it to the correct issuer based on the card's number range.If the issuer’s ACS is unavailable, the network can respond on its behalf.
3. The issuer’s ACS evaluates the request and sends back a response (ARes). The ARes either authenticates the cardholder frictionlessly, rejects authentication, or calls for a challenge. In a frictionless outcome, the ARes itself carries the result and the cryptogram that the merchant includes in the authorization request. When a challenge is needed, the cardholder completes it through the challenge messages (CReq/CRes); the ACS then sends the final result and cryptogram in a results request (RReq), and the 3DS Server confirms receipt with a results response (RRes).

Access Control Server (ACS): This is the issuer's part of the EMV 3DS process. It reviews authentication requests, manages any cardholder challenges, and creates the authentication cryptogram. Most issuers buy an ACS from a specialist vendor rather than build their own.

Frictionless flow: This is an EMV 3DS result where the issuer verifies the cardholder using only background data. This means the cardholder does not need to take any extra steps.

Challenge flow: This is an EMV 3DS result where the issuer asks the cardholder to prove who they are. This is usually done with an SMS one-time password, an approval inside a banking app, or a biometric check like a fingerprint.

Merchants are in charge of the quality of the data they send in the first step. Issuers are in full control of everything that happens in the third step. This division of power explains most of how the system works.

EMV 3DS is a fraud-prevention protocol, and the data a merchant sends feeds directly into the issuer’s risk assessment. But the merchant cannot dictate the outcome. A merchant can send richer data, request an exemption, or indicate a challenge preference; the issuer’s ACS still makes the final authentication decision, and no merchant-side configuration can override it.

Why does a single 3DS configuration underperform across markets?

A single 3DS configuration underperforms because the issuers on the other end of the request do not behave alike. A rule that lifts approvals with European banks can add pointless friction for US cardholders, and a setting tuned for domestic cards can leave cross-border traffic exposed. Merchants selling in several markets are effectively running dozens of different authentication relationships through one switch.

The gap is widening rather than closing. Ravelin’s Global Payments Report 2026 found that frictionless authentication rates fell or plateaued in 76% of the countries it tracks (28 of 37) when January to July 2025 is compared with the same months of 2024, and now sit at 58% globally. Ravelin attributes the decline to issuers tightening their fraud models and to merchants not submitting enough data, or the right data.

To better understand and solve this, we need to look at a "corridor." A corridor is a specific combination of the issuer, the card-issuing country, and the merchant region. Two different corridors on the exact same card network might require completely opposite treatments. That is why the rest of this article focuses on how to identify the specific behavior of each corridor and how to respond to it effectively.

How should a global merchant build a 3DS strategy per issuer corridor?

A global merchant should create its 3DS strategy by grouping each major issuer corridor based on the patterns seen in its own authentication data. After doing this, the merchant can apply the specific action that works best for that behavior. The main goal is to route every transaction down the path that a specific issuer is most likely to approve, while keeping friction as low as the rules allow.

To help identify these patterns, the table below provides a practical framework for payment teams to use as a helpful guide, rather than a strict rulebook. The main takeaway is that the best approach changes depending on how the issuer acts. Because of this, tools like exemption requests, data enrichment, and challenge preferences should be customized for each specific corridor.

To accurately categorize these behaviors, you need a large amount of data. A payment corridor that only processes a few hundred authentications each month can easily jump between categories just by random chance. Because of this, it is better to group smaller corridors by the card country first. Once the transaction volume grows large enough, you can then start making specific, issuer-level decisions.

Why do issuers receiving the same 3DS request reach different decisions?

Issuers reach different 3DS decisions because each one weighs fraud losses, customer friction and regulatory exposure differently, and the protocol leaves that weighting entirely to them. The same authentication request can be approved silently by one bank and challenged by another without either bank breaking any rule.

Dwayne Gefferie, a payments strategist, explains the issuer's job simply: "Authentication is where the issuer tests the claim the merchant has sent". In his model, every issuer has to accept one of three trade-offs:

• Accepting more fraud to provide a smoother checkout experience.
• Accepting more abandoned purchases to keep fraud levels lower.
• Following whatever operational path a regulator's rules dictate.

Gefferie points out that fast-growing fintech card programs usually choose the first option, large incumbent banks usually choose the second option, and issuers in areas with strict rules must follow the third option.

Two main things make it hard for an issuer to quickly change these habits:

• Vendor software: Gefferie notes that almost every issuer buys its ACS rather than building one, and that the contract is usually signed by procurement working from a vendor RFP, rarely by the team that owns the authorization rate. The ACS choice therefore tends to lock in a fraud-versus-conversion position that a single merchant’s results are unlikely to shift.
• Separated teams: The teams managing fraud rates, authorization rates, and compliance reporting often work separately from one another. Because they are isolated, the people who set up a cautious rule rarely see the real conversion cost (like lost sales) that their rule creates.

For merchants, this leads to a practical takeaway: you should view an issuer's authentication behavior as a stable, predictable pattern to plan around, rather than an error or a bug that needs to be fixed.

How do Strong Customer Authentication (SCA) exemption thresholds affect the way card issuers behave and make decisions in Europe?

European SCA rules turn authentication decisions into hard numbers. Under the EU's Regulatory Technical Standards, a payment service provider can skip the Strong Customer Authentication step by using a Transaction Risk Analysis (TRA) exemption. However, they can only do this if their own fraud rate for remote card payments stays below a specific limit. This limit gets stricter as the transaction amount goes up. For any payment over €500, the TRA exemption is not allowed at all.

The table below shows the reference fraud rates set in the Annex to Commission Delegated Regulation (EU) 2018/389; the practical conclusion is that a provider needs roughly thirteen times less fraud to exempt a €500 payment than a €100 one.

Two pieces of European Banking Authority (EBA) guidance, published as answers in its Single Rulebook Q&A, make these limits even more important than they first appear.

The first clarifies who actually makes the final decision. An acquirer with a low fraud rate can apply a TRA exemption, but the issuer always has the final say. The issuer can reject the request and apply SCA instead, or decline the transaction if SCA is not possible. Simply asking for an exemption does not guarantee it will be granted.

The second is about how the fraud rate is calculated. The EBA requires both issuers and acquirers to include all unauthorized remote transactions in their fraud rates. It does not matter which party actually applied the exemption. If an acquirer uses exemptions too loosely and fraud occurs, it hurts the issuer's reported fraud rate. The exact same is true in reverse. Because of this shared risk, both sides are highly motivated to use exemptions very carefully. For merchants, this shared caution can result in extra checkout challenges, even on payments that seem perfectly low-risk.

How does 3DS authentication differ across the US, Europe and Asia-Pacific?

3DS authentication settles into a different default in each major region, even though every region runs the same EMV 3DS specification. Europe mandates strong customer authentication by law. The United States has no equivalent mandate, so 3DS is a merchant choice. Much of Asia-Pacific is moving authentication off SMS codes and into bank apps by regulatory direction.

The comparison below shows how regulations set the standard rules for each region. The main difference comes down to who gets to decide when authentication must happen: the regulator, the card issuer, or the merchant.

Europe. A 2025 report from the EBA and ECB shows that Strong Customer Authentication (SCA) successfully helped reduce card fraud within Europe. However, fraud losses on cards issued in the EU and EEA still reached €1.329 billion in 2024, which is a 29% increase from the previous year. The report also warns that new types of fraud are emerging, often targeting transactions where an SCA exemption was applied, or manipulating legitimate users into authenticating fraudulent transactions.

United States. Research published in February 2026 by the Federal Reserve Bank of Kansas City shows that card-not-present (CNP) fraud on US debit cards is still going up across both single-message and dual-message networks. Ravelin’s data shows how fast authentication performance is shifting. In its 2025 report (January to July 2024 data), 3DS was successful only 41% of the time in the US, compared to 93% in the UK. In its 2026 report (January to July 2025 data), the US success rate jumped to 88%, a rise of 47 percentage points, while the UK reached 95%. At the regional level, North America’s 3DS success rate (85%) is now above Europe’s (83%); only its frictionless rate still trails (54% against 62%). US frictionless approvals actually slipped over the same period, from 78% to 74%.

Japan. Japan’s Credit Card Security Guidelines (version 5.0, March 2024) required e-commerce merchants to implement EMV 3DS by the end of March 2025. Fraud losses kept climbing while merchants prepared: they reached a record ¥55.5 billion in 2024, according to the Japan Consumer Credit Association.

India, Hong Kong, and Singapore

• India: Two-factor authentication (2FA) has long been required for digital payments in India. The RBI’s Authentication Directions, 2025, with a compliance date of April 1, 2026, keep that rule for all digital payments unless a transaction is exempted, and require at least one dynamic factor for transactions other than card-present ones. The Directions also open the door to alternatives to traditional SMS OTPs (One-Time Passwords)
• Hong Kong: The local regulator (HKMA) asked card-issuing banks to make authentication through the mobile banking app on a bound device the default method for online card payments, for customers who have the app, no later than 31 December 2024. Customers without the app can still use SMS OTPs.
• Singapore: In July 2024, the Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore announced that major retail banks would phase out SMS OTPs for bank account login for customers who already use digital tokens. An industry director acknowledged that this may cause some inconvenience but stated it is necessary to prevent scams. While this specific change applies to banking logins rather than card checkouts, it shows a clear trend in how the region is managing security.

Why is cross-border card-not-present fraud so much higher than domestic fraud?

Cross-border card-not-present (CNP) fraud is higher because the security rules of the cardholder’s home country usually stop at the border. When a card is used at an international merchant, that merchant’s region might not require strong authentication. Also, the card issuer’s domestic fraud controls are built specifically for their local environment. Fraudsters take advantage of stolen card data by using it in places where these security controls are the weakest.

Australia provides the clearest proof of this problem. According to the 2025 Australian Payment Fraud Report by the Australian Payments Network:

• Overseas CNP fraud on Australian-issued cards increased by 25% to A$454 million in 2024. This equals A$12.08 in fraud for every A$1,000 spent.
• Domestic CNP fraud dropped to a record low of just 97 cents per A$1,000 spent.
• Even though overseas transactions made up only 3% of total card spending, they caused half of all card fraud. This means the overseas fraud rate is more than 12 times higher than the domestic rate.

Andy White, the CEO of the Australian Payments Network, stated that the growth in CNP fraud has clearly moved to offshore transactions. The organization credits the drop in domestic fraud to the CNP Fraud Mitigation Framework they launched in 2019. However, this protective framework does not apply to overseas merchants.

Data from the EBA and ECB shows the exact same pattern in Europe. Card fraud on cards issued in the European Economic Area (EEA) was 17 times higher when the payee was located outside the EEA. In these outside regions, Strong Customer Authentication (SCA) is not legally required and is not commonly used.

A major regulatory change for this issue took effect on October 1, 2026. Under the RBI’s 2025 Directions, Indian card issuers must be able to validate an additional factor of authentication for non-recurring, cross-border CNP transactions when an overseas merchant or acquirer requests it. Issuers must also have a risk-based mechanism in place for handling all cross-border CNP transactions. Because of this, global merchants selling to Indian cardholders now have a new tool to use and a new decision to make about exactly when to apply it.

What is a false challenge, and why does no one measure it?

A false challenge happens when a 3DS challenge is given to a real, legitimate cardholder who would have easily finished their purchase without any extra steps. A "false decline" blocks a valid payment at the authorization stage. A false challenge, on the other hand, puts an unnecessary obstacle in front of the customer one step earlier.

Card schemes and regulators publish statistics on fraud and authentication. However, none of the scheme or regulatory reports cited in this article measure how many unnecessary challenges actually happen. This is because every party in the payment chain only sees part of the picture. An issuer's system records how many challenges were sent and how much fraud was stopped. A merchant’s checkout data only shows which customers gave up at the authentication screen. Neither side knows what the customer would have done if the challenge had never appeared. Fraud KPIs (Key Performance Indicators) make this blind spot even worse. If a challenge ends in a completed purchase, the system logs it as a clean success, even if the extra step was completely unnecessary.

Merchants can estimate this problem by looking closely at their own data. They should track four specific rates every week, broken down by the issuer BIN (Bank Identification Number), the card's country, the device type, and the transaction amount. These four rates are:

• 3DS attempt rate: The total percentage of card transactions that are sent through authentication.
• Frictionless share: The percentage of authenticated transactions that went through smoothly without needing any extra action from the cardholder.
• Challenge completion rate: This rate isolates exactly where customers give up and drop out of the checkout process.
• Authorization rate after authentication: If a 3DS check is successful but the issuer still rejects the payment during final authorization, it is still lost revenue. Tracking this shows the true success rate.

If a merchant notices a sudden drop in the frictionless share for one specific issuer, and the merchant’s own data has not changed, the likeliest cause is a change on the issuer’s side, such as an updated rule in their ACS (Access Control Server), rather than a merchant mistake.

Where do merchant 3DS strategies commonly fail?

Merchant 3DS strategies most often fail by treating authentication as one global setting. Because issuers, regions and regulations respond differently, a single rule tuned for one specific market (corridor) usually underperforms in the others. Here are the most common mistakes that merchants make repeatedly:

• Switching 3DS on or off globally. Forcing 3DS everywhere adds friction in low-risk US corridors. Switching it off exposes the merchant to fraud liability and, in mandate markets, declines.
• Requesting exemptions by amount alone. Ravelin warns that blanket exemption requests, for example based on transaction value, can fail because issuer risk tolerances vary, and calls the habit of always requesting the highest available exemption a misconception. If an issuer refuses an exemption flagged in the authorization request, the result is a soft decline, and the payment has to be retried with authentication.
• Sending incomplete data: Leaving out important details like the device type, account history, or address match makes issuers suspicious. This pushes them to issue more challenges. Incomplete merchant data is a major reason why smooth, frictionless rates are dropping.
• Focusing on 3DS success instead of actual revenue: Having a high success rate for authentication does not matter if the final authorization rates are low after the 3DS step is complete.
• Ignoring regulatory calendars: Regulators set strict dates for new rules, like Japan’s mandate in March 2025 and India’s cross-border deadline in October 2026. These specific dates instantly change how issuers behave, and merchants must be ready for them.
• Relying on a single provider: If a merchant is locked into just one 3DS Server or PSP (Payment Service Provider), they have no backup plan. If that provider performs poorly with a specific group of issuers, the merchant has no other way to route the transaction successfully.

What capabilities does a corridor-level 3DS strategy require?

A corridor-level 3DS strategy needs three main tools to be successful:

• Issuer-level analytics: Data to understand and group different payment corridors.
• A rules layer: A system that can change authentication behavior instantly, without waiting for new software code releases.
• Provider flexibility: The ability to use more than one 3DS provider. If a merchant lacks even one of these tools, they might see the differences between payment corridors but will not be able to adjust to them quickly.

Juspay, which processes 400 million transactions a day across 150+ countries, builds authentication as a capability within its orchestration layer. This setup allows merchants to create rules that decide exactly when 3DS is triggered. Merchants can manage multiple 3DS servers through a single integration and easily track authentication success and customer drop-off by the specific issuer, market, and sales channel. Furthermore, network tokenization provides an extra layer of security that issuers trust. Smart routing also lets merchants instantly switch a payment corridor to a better-performing provider if authentication results start to drop. Juspay’s Dublin operations give it working exposure to PSD2 exemption behaviour, and its Bengaluru and Singapore teams work directly with the app-first authentication models emerging across Asia.

However, there are two important limits to keep in mind. First, a smart corridor strategy cannot force a strict, cautious issuer to become permissive. It can only prevent the merchant from adding unnecessary friction on top of the issuer's existing rules. Second, any exemption strategy must still operate within the strict liability framework of both the merchant and the acquirer. This matters because a successfully authenticated transaction, whether frictionless or challenged, generally shifts fraud liability to the issuer. When the merchant or acquirer applies an exemption instead, no authentication takes place, so the liability usually stays with them.

Key Takeaways

• Standard messages, different decisions: The EMV 3DS specification standardizes the authentication messages, data and flows. However, the risk decision made by the issuer’s ACS (Access Control Server) is private and unique to each issuer. This is why sending the exact same request can lead to totally different results.
  
• Three types of behavior: Every issuer balances fraud, customer friction, and regulatory exposure in their own way. A helpful way to look at this is through a three-cost model. Merchants can use this idea to group their payment corridors into three categories: permissive, cautious, and mandate-driven.
  
• Frictionless payments are dropping: Smooth, frictionless authentication is becoming less common. According to Ravelin’s 2026 report (January to July 2025 data), frictionless rates fell or plateaued in 76% of the countries it tracks, and the global average is now 58%.
  
• Strict rules for EU exemptions: In the EU, using TRA (Transaction Risk Analysis) exemptions depends on the provider’s (issuer’s or acquirer’s) fraud rate staying below strict limits. Under PSD2 rules, the provider’s reference fraud rate must be at or below 0.13% to exempt payments up to €100, 0.06% to exempt payments up to €250, and 0.01% to exempt payments up to €500. Payments over €500 cannot be exempted using TRA. Even if the provider qualifies, the issuer always gets the final say. Additionally, issuers and acquirers must each count fraud on transactions where the other party applied the exemption.
  
• Cross-border payments carry the highest risk: Cross-border corridors are the places where different authentication rules clash. For example, in 2024, overseas CNP (card-not-present) fraud on Australian cards was more than 12 times higher than the domestic fraud rate.
  
• New Indian regulations: India’s rule requiring an additional factor of authentication for non-recurring cross-border CNP payments, when the overseas merchant or acquirer requests it, took effect on October 1, 2026, alongside a risk-based mechanism for all cross-border CNP payments.
  
• Adjust rules by corridor, not by company: Merchants should measure their final authorization rates after the authentication step is finished. They should look at this data by specific issuers and corridors, and then customize their settings for each individual corridor rather than using one broad rule for the entire company.

Frequently Asked Questions

Why does 3DS get challenged by one bank but approved frictionlessly by another?

Different banks run different risk models inside their Access Control Servers. EMV 3DS standardizes messages and data, not the risk decision, so each issuer decides how much risk it will accept before challenging. A bank focused on low fraud rates will challenge more often, while one focused on card growth will approve more transactions silently, even for the same merchant and cardholder profile.

What is a good 3DS frictionless rate?

A good frictionless rate depends on region and issuer mix, but Ravelin’s Global Payments Report 2026 (January to July 2025 data) gives useful benchmarks: 58% globally, 62% in Europe and 54% in North America. Ravelin links falling frictionless rates to merchants not sending enough data, or the right data, so data completeness is the first thing to check if you sit below these averages. Comparing the rate by issuer BIN is more useful than one blended number.

Does requesting an SCA exemption guarantee the transaction won’t be challenged?

Requesting an SCA exemption does not guarantee a frictionless outcome. Under EBA guidance, the issuer always makes the final decision and may apply strong customer authentication instead, or decline if SCA isn’t possible. Merchants should request exemptions where specific issuers have historically honoured them, not on transaction amount alone.

What changed for merchants when India’s cross-border authentication rule took effect in October 2026?

Since October 1, 2026, Indian card issuers must be able to validate an additional factor of authentication for non-recurring cross-border card-not-present transactions when the overseas merchant or acquirer requests it. Issuers must also run a risk-based mechanism for all cross-border card-not-present transactions. Global merchants selling to Indian cardholders should confirm their 3DS setup can request that authentication and track its effect on conversion.

Why is 3DS less common in the United States than in Europe?

The United States has no strong customer authentication mandate, so using 3DS is a merchant decision rather than a legal requirement. Many US issuers and consumers view 3DS as added friction, while EEA issuers treat it as standard because PSD2 requires it for most online card payments. US 3DS success rates historically lagged European ones, but the gap has closed: in Ravelin’s 2026 report, North America’s success rate (85%) was above Europe’s (83%), although its frictionless rate (54%) still trailed Europe’s (62%).

Is SMS OTP being phased out for card authentication?

SMS OTP is being reduced in several Asia-Pacific markets rather than banned outright. Hong Kong made in-app, bound-device authentication the default for online card payments by customers with a mobile banking app from the end of 2024, with banks reporting nearly 80% lower related fraud. India’s 2025 directions allow alternatives to SMS OTP. In Singapore, major retail banks phased out OTPs for bank login for customers who use digital tokens.

How does Juspay help merchants improve 3DS authentication rates?

Juspay improves 3DS performance by treating authentication as part of its payment orchestration layer. Merchants can set no-code rules for when 3DS triggers, manage multiple 3DS servers through one integration, and analyze authentication success and drop-off by issuer, market and channel, then route corridors to better-performing providers when results diverge.