Why Do 3DS Results Vary by Issuer If the Protocol Is Identical?

3DS results vary depending on the card issuer. This happens because the EMV 3-D Secure system only standardizes how the message is sent, not the final approval decision. Every issuer’s Access Control Server receives the exact same type of authentication request. However, each issuer uses its own risk model, exemption policy, and challenge method. They make these choices based on how they balance preventing fraud losses, maintaining high checkout conversion, and meeting their specific regulatory obligations.

These differences are easy to measure. According to Ravelin’s Global Payments Report 2026, frictionless authentication happens 54% of the time in North America and 62% of the time in Europe. Additionally, groups like the EBA and ECB found that card fraud is 17 times higher in areas where SCA (Strong Customer Authentication) is not legally required.

Because rules and results change by region, merchants will find that authentication works best as a strategy tailored to each individual market, instead of a one-size-fits-all rule.

What part of 3DS is standardized, and what part is left to the issuer?

The EMV 3DS system creates a standard way to share data between the merchant’s 3DS Server, the card network’s Directory Server, and the issuer’s Access Control Server (ACS). However, it does not control how the ACS makes its final decision. The choice to approve a transaction silently, issue a challenge, or decline the payment is completely up to the issuer. They make this choice inside the ACS by relying on their own unique fraud model and risk tolerance.

It is helpful to understand the basic structure before looking at the outcomes. A card-not-present authentication process moves through three main steps:

1. The merchant’s 3DS Server gathers the transaction and device details and bundles them into an authentication request (AReq).
2. The network’s Directory Server receives that request and routes it to the correct issuer based on the card's number range.
3. The issuer’s ACS evaluates the request and sends back a response (ARes). This response will be a smooth frictionless approval, a request for more proof called a challenge (CReq/CRes), or a complete rejection. The final decision is delivered in a results message (RReq/RRes), along with a secure code called a cryptogram that the merchant uses to complete the final authorization.

Access Control Server (ACS): This is the issuer's part of the EMV 3DS process. It reviews authentication requests, manages any cardholder challenges, and creates the authentication cryptogram. Instead of building their own system, most issuers buy a license for an ACS from an outside vendor.

Frictionless flow: This is an EMV 3DS result where the issuer verifies the cardholder using only background data. This means the cardholder does not need to take any extra steps.

Challenge flow: This is an EMV 3DS result where the issuer asks the cardholder to prove who they are. This is usually done with an SMS one-time password, an approval inside a banking app, or a biometric check like a fingerprint.

Merchants are in charge of the quality of the data they send in the first step. Issuers are in full control of everything that happens in the third step. This division of power explains most of how the system works.

EMV 3DS is not a tool that the merchant uses to stop fraud directly. A merchant can choose to send more detailed data, ask for an exemption, or suggest a preference for a challenge. However, the issuer’s ACS is always the one making the final authentication decision. No amount of extra technical setup on the merchant's side can change or override that final choice.

Why does a single 3DS configuration underperform across markets?

A single 3DS configuration underperforms because the issuers on the other end of the request do not behave alike. A rule that lifts approvals with European banks can add pointless friction for US cardholders, and a setting tuned for domestic cards can leave cross-border traffic exposed. Merchants selling in several markets are effectively running dozens of different authentication relationships through one switch.

The gap is widening rather than closing. Ravelin’s Global Payments Report 2026 found that frictionless authentication rates fell in 76% of the countries it tracks, and now sit at 58% globally. Ravelin attributes the decline to issuers tightening fraud models while many merchants still send incomplete data.

To better understand and solve this, we need to look at a "corridor." A corridor is a specific combination of the issuer, the card-issuing country, and the merchant region. Two different corridors on the exact same card network might require completely opposite treatments. That is why the rest of this article/post focuses on how to identify the specific behavior of each corridor and how to respond to it effectively.

How should a global merchant build a 3DS strategy per issuer corridor?

A global merchant should create its 3DS strategy by grouping each major issuer corridor based on the patterns seen in its own authentication data. After doing this, the merchant can apply the specific action that works best for that behavior. The main goal is to route every transaction down the path that a specific issuer is most likely to approve, while keeping friction as low as the rules allow.

To help identify these patterns, the table below provides a practical framework for payment teams to use as a helpful guide, rather than a strict rulebook. The main takeaway is that the best approach changes depending on how the issuer acts. Because of this, tools like exemption requests, data enrichment, and challenge preferences should be customized for each specific corridor.

To accurately categorize these behaviors, you need a large amount of data. A payment corridor that only processes a few hundred authentications each month can easily jump between categories just by random chance. Because of this, it is better to group smaller corridors by the card country first. Once the transaction volume grows large enough, you can then start making specific, issuer-level decisions.

Why do issuers receiving the same 3DS request reach different decisions?

Issuers reach different 3DS decisions because each one weighs fraud losses, customer friction and regulatory exposure differently, and the protocol leaves that weighting entirely to them. The same authentication request can be approved silently by one bank and challenged by another without either bank breaking any rule.

Dwayne Gefferie, an expert payments data scientist, explains the issuer's job simply: "Authentication is where the issuer tests the claim the merchant has sent". In his model, every issuer has to accept one of three trade-offs:

• Accepting more fraud to provide a smoother checkout experience.
• Accepting more abandoned purchases to keep fraud levels lower.
• Following whatever operational path a regulator's rules dictate.

Gefferie points out that fast-growing fintech card programs usually choose the first option, large incumbent banks usually choose the second option, and issuers in areas with strict rules must follow the third option.

Two main things make it hard for an issuer to quickly change these habits:

• Vendor software: The ACS (Access Control Server) is usually licensed from an outside vendor. This means the issuer's risk logic only updates when the vendor releases a new version, rather than reacting quickly to a single merchant's results.
• Separated teams: The teams managing fraud rates, authorization rates, and compliance reporting often work separately from one another. Because they are isolated, the people who set up a cautious rule rarely see the real conversion cost (like lost sales) that their rule creates.

For merchants, this leads to a practical takeaway: you should view an issuer's authentication behavior as a stable, predictable pattern to plan around, rather than an error or a bug that needs to be fixed.

How do Strong Customer Authentication (SCA) exemption thresholds affect the way card issuers behave and make decisions in Europe?

European SCA rules turn authentication decisions into hard numbers. Under the EU's Regulatory Technical Standards, a payment service provider can skip the Strong Customer Authentication step by using a Transaction Risk Analysis (TRA) exemption. However, they can only do this if their fraud rate for remote card payments stays below a specific limit. This limit gets stricter as the transaction amount goes up. For any payment over €500, the TRA exemption is not allowed at all.

The table below shows the reference fraud rates set in the Annex to Commission Delegated Regulation (EU) 2018/389; the practical conclusion is that a provider needs roughly thirteen times less fraud to exempt a €500 payment than a €100 one.

Two rulings from the European Banking Authority (EBA) make these limits even more important than they first appear.

The first ruling clarifies who actually makes the final decision. An acquirer with a low fraud rate can ask for a TRA exemption, but the issuer always has the final say. The issuer can reject the request and demand an SCA challenge instead. Simply asking for an exemption does not guarantee it will be granted.

The second ruling is about how the fraud rate is calculated. The EBA requires both issuers and acquirers to include all unauthorized remote transactions in their fraud rates. It does not matter which party actually applied the exemption. If an acquirer uses exemptions too loosely and fraud occurs, it hurts the issuer's reported fraud rate. The exact same is true in reverse. Because of this shared risk, both sides are highly motivated to use exemptions very carefully. For merchants, this shared caution results in extra checkout challenges, even on payments that seem perfectly low-risk.

How does 3DS authentication differ across the US, Europe and Asia-Pacific?

3DS authentication settles into a different default in each major region, even though every region runs the same EMV 3DS specification. Europe mandates strong customer authentication by law. The United States has no equivalent mandate, so 3DS is a merchant choice. Much of Asia-Pacific is moving authentication off SMS codes and into bank apps by regulatory direction.

The comparison below shows how regulations set the standard rules for each region. The main difference comes down to who gets to decide when authentication must happen: the regulator, the card issuer, or the merchant.

Europe. A 2025 report from the EBA and ECB shows that Strong Customer Authentication (SCA) successfully helped reduce card fraud within Europe. However, total fraud losses on cards issued in the EU and EEA still reached €1.329 billion in 2024, which is a 29% increase from the previous year. The report also warns that criminals are now heavily targeting transactions where an SCA exemption was used.

United States. Research published in February 2026 by the Federal Reserve Bank of Kansas City shows that card-not-present (CNP) fraud on US debit cards is still going up across all network types. Data from Ravelin in 2025 made this gap very clear: 3DS was successful only 41% of the time in the US, compared to 93% in the UK. The US saw a big improvement in 2026, though the rate of smooth, frictionless approvals actually dropped.

Japan. Japan’s Credit Card Security Guidelines required e-commerce merchants to implement EMV 3DS by the end of March 2025, after card fraud losses reached ¥55.5 billion in 2024 according to the Japan Credit Association.

India, Hong Kong, and Singapore

• India: The Reserve Bank of India (RBI) requires two-factor authentication (2FA) for digital payments. This must include at least one dynamic step, but the RBI does allow newer alternatives to traditional SMS OTPs (One-Time Passwords).
• Hong Kong: The local regulator (HKMA) made it mandatory for card issuers to use in-app authentication on a registered device as the default method for online card payments starting in late 2024.
• Singapore: In 2024, regulators moved users away from SMS OTPs and toward digital tokens for bank logins. An industry director acknowledged that this adds extra friction for the user but stated it is necessary to prevent scams. While this specific rule applies to banking logins rather than card checkouts, it shows a clear trend in how regulators in the region are managing security.
  

Why is cross-border card-not-present fraud so much higher than domestic fraud?

Cross-border card-not-present (CNP) fraud is higher because the security rules of the cardholder’s home country stop at the border. When a card is used at an international merchant, that merchant’s region might not require strong authentication. Also, the card issuer’s domestic fraud controls are built specifically for their local environment. Fraudsters take advantage of stolen card data by using it in places where these security controls are the weakest.

Australia provides the clearest proof of this problem. According to the 2025 Australian Payment Fraud Report by the Australian Payments Network:

• Overseas CNP fraud on Australian-issued cards increased by 25% to A$454 million in 2024. This equals A$12.08 in fraud for every A$1,000 spent.
• Domestic CNP fraud dropped to a record low of just 97 cents per A$1,000 spent.
• Even though overseas transactions made up only 3% of total card spending, they caused half of all card fraud. This means the overseas fraud rate is more than 12 times higher than the domestic rate.

Andy White, the CEO of the Australian Payments Network, stated that the growth in CNP fraud has clearly moved to offshore transactions. The organization credits the drop in domestic fraud to the CNP Fraud Mitigation Framework they launched in 2019. However, this protective framework does not apply to overseas merchants.

Data from the EBA and ECB shows the exact same pattern in Europe. Card fraud on cards issued in the European Economic Area (EEA) was 17 times higher when the merchant was located outside the EEA. In these outside regions, Strong Customer Authentication (SCA) is not legally required and is not commonly used.

The next major regulatory change for this issue took effect on October 1, 2026. Under the 2025 directions from the Reserve Bank of India (RBI), Indian card issuers must be able to process an additional factor of authentication for one-time, cross-border CNP transactions whenever an overseas merchant or acquirer asks for it. Because of this, global merchants selling to Indian cardholders now have a new tool to use and a new decision to make about exactly when to apply it.

What is a false challenge, and why does no one measure it?

A false challenge happens when a 3DS challenge is given to a real, legitimate cardholder who would have easily finished their purchase without any extra steps. A "false decline" blocks a valid payment at the authorization stage. A false challenge, on the other hand, puts an unnecessary obstacle in front of the customer one step earlier.

Card schemes and regulators publish statistics on fraud and authentication. However, none of these reports measure how many unnecessary challenges actually happen. This is because every party in the payment chain only sees part of the picture. An issuer's system records how many challenges were sent and how much fraud was stopped. A merchant’s checkout data only shows which customers gave up at the authentication screen. Neither side knows what the customer would have done if the challenge had never appeared. Fraud KPIs (Key Performance Indicators) make this blind spot even worse. If a challenge ends in a completed purchase, the system logs it as a clean success, even if the extra step was completely unnecessary.

Merchants can estimate this problem by looking closely at their own data. They should track four specific rates every week, broken down by the issuer BIN (Bank Identification Number), the card's country, the device type, and the transaction amount. These four rates are:

• 3DS attempt rate: The total percentage of card transactions that are sent through authentication.
• Frictionless share: The percentage of authenticated transactions that went through smoothly without needing any extra action from the cardholder.
• Challenge completion rate: This rate isolates exactly where customers give up and drop out of the checkout process.
• Authorization rate after authentication: If a 3DS check is successful but the issuer still rejects the payment during final authorization, it is still lost revenue. Tracking this shows the true success rate.

If a merchant notices a sudden drop in the frictionless share for one specific issuer, and the merchant's own data has not changed, it usually means the issuer updated a rule in their ACS (Access Control Server). It rarely means the merchant made a mistake.

Where do merchant 3DS strategies commonly fail?

Merchant 3DS strategies most often fail by treating authentication as one global setting. Because issuers, regions and regulations respond differently, a single rule tuned for one specific market (corridor) usually underperforms in the others. Here are the most common mistakes that merchants make repeatedly:

• Switching 3DS on or off globally. Forcing 3DS everywhere adds friction in low-risk US corridors. Switching it off exposes the merchant to fraud liability and, in mandate markets, declines.
• Requesting exemptions by amount alone. Ravelin advises against sending blanket exemption requests just because a transaction value is low. Every issuer accepts different levels of risk. If an issuer refuses to honor a low-value exemption, it results in a soft decline, meaning the payment has to be tried all over again.
• Sending incomplete data: Leaving out important details like the device type, account history, or address match makes issuers suspicious. This pushes them to issue more challenges. Incomplete merchant data is a major reason why smooth, frictionless rates are dropping.
• Focusing on 3DS success instead of actual revenue: Having a high success rate for authentication does not matter if the final authorization rates are low after the 3DS step is complete.
• Ignoring regulatory calendars: Regulators set strict dates for new rules, like Japan’s mandate in March 2025 and India’s cross-border deadline in October 2026. These specific dates instantly change how issuers behave, and merchants must be ready for them.
• Relying on a single provider: If a merchant is locked into just one 3DS Server or PSP (Payment Service Provider), they have no backup plan. If that provider performs poorly with a specific group of issuers, the merchant has no other way to route the transaction successfully.

What capabilities does a corridor-level 3DS strategy require?

A corridor-level 3DS strategy needs three main tools to be successful:

• Issuer-level analytics: Data to understand and group different payment corridors.
• A rules layer: A system that can change authentication behavior instantly, without waiting for new software code releases.
• Provider flexibility: The ability to use more than one 3DS provider. If a merchant lacks even one of these tools, they might see the differences between payment corridors but will not be able to adjust to them quickly.

Juspay, which orchestrates 400 million daily transactions across 150+ countries, builds authentication as a capability within its orchestration layer. This setup allows merchants to create rules that decide exactly when 3DS is triggered. Merchants can manage multiple 3DS servers through a single integration and easily track authentication success and customer drop-off by the specific issuer, market, and sales channel. Furthermore, network tokenization provides an extra layer of security that issuers trust. Smart routing also lets merchants instantly switch a payment corridor to a better-performing provider if authentication results start to drop. Juspay’s Dublin operations give it working exposure to PSD2 exemption behaviour, and its Bengaluru and Singapore teams work directly with the app-first authentication models emerging across Asia.

However, there are two important limits to keep in mind. First, a smart corridor strategy cannot force a strict, cautious issuer to become permissive. It can only prevent the merchant from adding unnecessary friction on top of the issuer's existing rules. Second, any exemption strategy must still operate within the strict liability framework of both the merchant and the acquirer. This is crucial because frictionless outcomes and exemptions do not always provide the exact same liability shift (protection from fraud losses) as a fully completed authentication.

Key Takeaways

• Standard messages, different decisions: The EMV 3DS system creates a standard way to send an authentication message. However, the final decision made by the issuer’s ACS (Access Control Server) is completely private and unique to them. This is why sending the exact same request can lead to totally different results.
  
• Three types of behavior: Every issuer balances fraud, customer friction, and regulatory exposure in their own way. A helpful way to look at this is through a three-cost model. Merchants can use this idea to group their payment corridors into three categories: permissive, cautious, and mandate-driven.
  
• Frictionless payments are dropping: Smooth, frictionless authentication is becoming less common. According to 2026 data from Ravelin, these smooth approvals have dropped in 76% of the countries they track, bringing the global average down to just 58%.
  
• Strict rules for EU exemptions: Strict rules for EU exemptions: In the EU, using TRA (Transaction Risk Analysis) exemptions depends on keeping your fraud rate below strict limits. Under PSD2 rules, your reference fraud rate must be at or below 0.13% to exempt payments up to €100, 0.06% to exempt payments up to €250, and 0.01% to exempt payments up to €500. Payments over €500 cannot be exempted using TRA. Even if you qualify, the issuer always gets the final say. Additionally, both the merchant and the issuer must count each other's exempted fraud in their own records.
  
• Cross-border payments carry the highest risk: Cross-border corridors are the places where different authentication rules clash. For example, in 2024, overseas CNP (card-not-present) fraud on Australian cards was more than 12 times higher than the domestic fraud rate.
  
• New Indian regulations: India’s new rule requiring an additional-factor of authentication for cross-border payments officially goes into effect on October 1, 2026.
  
• Adjust rules by corridor, not by company: Merchants should measure their final authorization rates after the authentication step is finished. They should look at this data by specific issuers and corridors, and then customize their settings for each individual corridor rather than using one broad rule for the entire company.

Frequently Asked Questions

Why does 3DS get challenged by one bank but approved frictionlessly by another?

Different banks run different risk models inside their Access Control Servers. EMV 3DS only standardizes the data format, so each issuer decides how much risk it will accept before challenging. A bank focused on low fraud rates will challenge more often, while one focused on card growth will approve more transactions silently, even for the same merchant and cardholder profile.

What is a good 3DS frictionless rate?

A good frictionless rate depends on region and issuer mix, but Ravelin’s Global Payments Report 2026 gives useful benchmarks: 58% globally, 62% in Europe and 54% in North America. Merchants above these averages are usually sending complete device and account data. Comparing the rate by issuer BIN is more useful than one blended number.

Does requesting an SCA exemption guarantee the transaction won’t be challenged?

Requesting an SCA exemption does not guarantee a frictionless outcome. Under EBA guidance, the issuer always makes the final decision and may apply strong customer authentication instead, or decline if SCA isn’t possible. Merchants should request exemptions where specific issuers have historically honoured them, not on transaction amount alone.

What changes for merchants when India’s cross-border authentication rule starts in October 2026?

From October 1, 2026, Indian card issuers must be able to validate an additional factor of authentication for non-recurring cross-border card-not-present transactions when the overseas merchant or acquirer requests it. Global merchants selling to Indian cardholders should confirm their 3DS setup can request that authentication and track its effect on conversion.

Why is 3DS less common in the United States than in Europe?

The United States has no strong customer authentication mandate, so using 3DS is a merchant decision rather than a legal requirement. Many US issuers and consumers view 3DS as added friction, while EEA issuers treat it as standard because PSD2 requires it for most online card payments. As a result, US authentication rates have historically lagged European ones.

Is SMS OTP being phased out for card authentication?

SMS OTP is being reduced in several Asia-Pacific markets rather than banned outright. Hong Kong made in-app, bound-device authentication the default for online card payments from late 2024, with banks reporting nearly 80% lower related fraud. India’s 2025 directions allow alternatives to SMS OTP. Singapore removed OTPs from bank login for digital-token users.

How does Juspay help merchants improve 3DS authentication rates?

Juspay improves 3DS performance by treating authentication as part of its payment orchestration layer. Merchants can set no-code rules for when 3DS triggers, manage multiple 3DS servers through one integration, and analyze authentication success and drop-off by issuer, market and channel, then route corridors to better-performing providers when results diverge.