3D Secure Challenge Comparison: What Converts?

A checkout can lose a legitimate customer in the seconds between entering a card number and completing authentication. That makes a 3D Secure challenge comparison a commercial exercise, not simply a compliance review. The right approach protects your business from fraud and unauthorised-payment disputes while keeping genuine customers moving through payment with minimal interruption.

For merchants operating across markets, the challenge is that no single authentication journey performs best everywhere. Issuers control the final authentication experience, customer behaviour varies by device and region, and the transaction data you submit can influence whether a challenge is required at all. Your role is to build a payment flow that gives issuers confidence, manages exemptions correctly and recovers effectively when a challenge fails.

3D Secure challenge comparison: frictionless vs challenged payments

EMV 3-D Secure, often called 3DS2, supports two broad outcomes. A frictionless flow authenticates the transaction in the background using risk data shared between the merchant, acquirer and issuer. The customer sees no additional step. A challenge flow asks the customer to prove they are the genuine cardholder, usually through their banking app, biometrics, a passcode or a one-time password.

Frictionless authentication is usually the strongest conversion outcome because there is no added checkout task. It also gives issuers far more context than legacy 3D Secure 1, including device, browser, delivery and transaction information. However, it is not something a merchant can demand. The issuer’s risk decision determines whether a transaction proceeds frictionlessly, receives a challenge or is declined.

A challenged transaction adds friction, but it should not be treated as a failed payment experience. For higher-risk orders, unusual customer behaviour or transactions that require Strong Customer Authentication under PSD2, a well-executed challenge can preserve an otherwise lost sale. It may also provide liability-shift benefits where scheme rules and transaction circumstances allow.

The goal is therefore not to eliminate challenges. It is to ensure that challenges occur only when justified, work reliably on the customer’s device and sit within a payment flow designed to retain the customer.

Comparing the main challenge methods

The issuer chooses the available method, but merchants should understand how each option affects completion and support volumes. The comparison below helps payment teams identify where their checkout, transaction data and routing strategy can make the greatest difference.

| Challenge method | Customer experience | Commercial strengths | Main risks | | — | — | — | — | | Banking app approval or push notification | Customer switches to, or approves within, their bank app | Fast, familiar and highly secure for enrolled users | App is unavailable, notifications are delayed, or the customer is using another device | | In-app biometric authentication | Customer confirms with fingerprint or facial recognition | Low effort and strong completion on supported mobile devices | Depends on issuer app adoption and working device biometrics | | One-time password by SMS | Customer enters a code received by text message | Broad device coverage and familiar process | Delayed messages, roaming issues, wrong phone numbers and code-entry errors | | One-time password by e-mail or call centre fallback | Customer receives a code or follows a verification route outside the primary app | Can support customers without app access | Slower, less consistent and more likely to create abandonment |

Issuer app and biometric challenges generally offer the best experience for active mobile-banking users. They remove the need to copy a code and can make the request feel like a normal banking interaction. Their weakness is dependency: the customer must have the relevant app installed, registered and accessible at the moment of payment.

SMS remains useful because it works for many customers without requiring an issuer app. Yet it is vulnerable to delivery delays and introduces more opportunities for input errors. It can be especially problematic for travellers, customers using a new telephone number or cardholders with limited signal. For travel, hospitality and subscription merchants, these are not edge cases. They are everyday payment conditions.

The key point is that a merchant cannot simply replace an issuer’s SMS challenge with a preferred biometric option. What you can control is the quality of the authentication request, the continuity of the checkout session and the recovery journey if the customer does not complete the challenge.

What actually determines challenge performance

A challenge completion rate tells only part of the story. A low rate may reflect a poorly designed checkout, but it can also arise from an issuer’s authentication availability, an unsuitable customer segment or unnecessary challenges caused by incomplete transaction data. Assess performance across the full payment funnel.

Start with the challenge rate: the share of authentication attempts that receive a challenge rather than a frictionless result. Then measure challenge completion, post-authentication authorisation rate, soft-decline recovery rate and eventual successful-payment rate. Segment each measure by issuer, country, device, card scheme, payment channel and recurring versus customer-initiated transaction.

This wider view avoids an expensive mistake: optimising for a low challenge rate while allowing more fraud, declines or chargebacks to enter the portfolio. For high-risk sectors, an issuer may reasonably seek more evidence before approving a payment. Better data and more appropriate routing can improve results, but aggressive exemption use is not a substitute for sound risk control.

The data behind a frictionless decision

3DS2 is designed to carry richer data than its predecessor. Missing or inconsistent fields reduce the issuer’s ability to make a confident risk decision. Supply accurate customer name and contact details, billing and delivery information where relevant, device and browser data, account age, prior purchase history and clear transaction descriptors.

Data quality must be balanced with privacy and relevance. Do not send placeholder values merely to fill fields. Inaccurate information can be worse than absent information, creating mismatches that trigger a challenge or decline. Your technical and fraud teams should agree which fields are reliably collected and ensure they are passed consistently through the gateway and acquirer connection.

Exemptions need measured use

PSD2 exemptions can reduce unnecessary customer authentication for eligible payments, including low-value, low-risk and recurring scenarios. The acquiring side may request an exemption, but the issuer retains the right to challenge the payment. That means an exemption strategy should be monitored as a performance hypothesis, not treated as a guarantee.

For example, transaction risk analysis may improve conversion for a merchant with controlled fraud levels and strong data quality. If fraud rises beyond relevant thresholds, the commercial benefit can disappear quickly through higher losses, reduced issuer trust and weaker authorisation outcomes. The best configuration depends on your vertical, ticket size, markets, fraud pattern and acquirer capabilities.

Build a checkout that survives the challenge

The authentication screen may belong to the issuer, but your checkout sets the conditions around it. Keep the customer informed that their bank may ask them to confirm the payment, particularly for first-time purchases or larger orders. Avoid language that suggests the payment has failed before the final authorisation response arrives.

Preserve the basket, selected delivery option and checkout state while authentication is in progress. If the customer returns after cancelling or timing out, make it simple to retry the card once or choose an alternative payment method. Repeated automatic retries can create duplicate authorisations, confuse customers and increase support contacts.

For mobile web, test the redirect and return path across common browsers and operating systems. For native apps, confirm that app-to-app hand-off returns the customer to the correct payment state. A technically valid 3DS integration can still lose revenue if the callback handling is weak or the customer is left staring at a loading screen.

Plan for soft declines and failed authentication

A soft decline often signals that the issuer wants authentication before it will approve the payment. Your payment platform should identify this response, initiate 3DS where appropriate and submit the authenticated transaction correctly. Treating every decline as final leaves recoverable revenue on the table.

Failed challenges require more care. A customer may have entered the wrong code, missed a push notification or abandoned because they do not recognise the descriptor. Offer a clear retry path, but set sensible limits and apply fraud checks before repeated attempts. Where appropriate, present another suitable payment method rather than forcing the same card through the same failing journey.

Put orchestration behind the authentication strategy

Merchants using multiple acquirers should compare 3DS performance at acquirer and issuer level, not only at a portfolio average. One route may perform better for a specific country, card scheme or transaction type because of its risk settings, local issuer relationships or exemption handling. Another may be better suited to recurring billing or high-value transactions.

Payment orchestration makes it possible to apply these insights without rebuilding checkout logic for every provider. Rules can direct transactions based on geography, currency, risk score, previous response patterns or merchant category. The rules should remain transparent and regularly reviewed. Routing solely for an initial approval can create downstream costs if it increases fraud exposure, chargebacks or settlement complexity.

AllSecure can support this work through 3DS2-capable payment infrastructure, configurable risk controls and access to acquiring options that fit complex acceptance requirements. The most effective setup combines technology with ongoing review of issuer response data and customer behaviour.

A good challenge flow is not the one that asks the fewest questions. It is the one that gives genuine customers the fastest credible route to payment while giving issuers enough confidence to approve the transaction.