3DS2: What to expect

Zai Payments offers 3D Secure version 2 (3DS2) on online card payments. 3DS2 is an industry standard, and the considerations below apply wherever it is used, regardless of payment provider. They come from how the standard works and how each card issuer (your customer's bank) chooses to authenticate its cardholders. Knowing what to expect, and how to plan for it, helps you get the best results.

New to 3DS2? Start with 3DS2: Overview and getting started.

Does 3DS2 add time to a payment?

Yes, a little. Before a payment is authorised, the card scheme and the cardholder's bank need a moment to assess it. When the bank asks for a challenge, the cardholder also needs to verify the payment, a step many online shoppers are already used to.

Every 3DS2 payment adds short extra steps before authorisation:

1. Authentication request. Zai sends the transaction data, through the card scheme's directory server, to the issuer's authentication service (the Access Control Server, or ACS). The issuer runs its own risk assessment.
2. Challenge (only if required). If the issuer wants more assurance, the cardholder is asked to verify themselves.
3. Fraud checks and authorisation. Zai runs its standard card fraud checks, then the payment goes to the issuer for approval, as it would without 3DS2.

What does a challenge look like for my customers?

It depends on the cardholder's bank. Common methods include:

• A one-time passcode sent by SMS or email
• A push notification to approve in the bank's app
• Biometric approval (fingerprint or face) in the bank's app
• Occasionally, answering a security question

The bank decides which method to use. Zai and you cannot choose or change it.

What situations should I plan for?

The following are common to 3DS2 across all providers. You can reduce most of them with the steps in 3DS2: Getting the best results and support.

• Unexpected challenges. Customers who aren't expecting to verify a payment may leave the checkout. A short message at checkout reduces this.
• SMS codes. Codes go to the mobile number held by the customer's bank, so an outdated number or poor reception can delay them.
• Banking app approvals. Customers may briefly switch to their banking app to approve the payment, then return to your checkout.
• Browser settings. Pop-up blockers, privacy extensions, or content security policies can stop the verification window from showing. Testing your checkout catches most of these.
• In-app browsers and webviews. Verification works best in a standard browser or a correctly configured app.
• Timeouts. Each verification has an ample time limit. If it expires, the customer can simply try again.

Will 3DS2 affect my completed payments?

Merchants introducing 3DS2 sometimes see a temporary change in completed payments, usually from customers who don't complete a challenge. This is a common industry pattern, and it typically settles as customers become familiar with verifying payments and as the data you send improves. The effect varies by industry, customer base, transaction value, and the banks your customers use.

What should "normal" look like?

• Most payments should authenticate frictionlessly (in the background, with no cardholder action), with a minority challenged.
• Challenge rates are higher for first-time customers, high-value payments, and unusual purchasing patterns.
• Challenge and failure rates vary by issuer. A small number of banks may account for a disproportionate share of challenges.
• Results usually improve over the first weeks as data quality improves and issuers build history with your customers' patterns.

If a payment fails, see 3DS2: Understanding payment outcomes.

Need help? Contact Zai Technical Support at support@zaipayments.com. To help us investigate quickly, see what to include in 3DS2: Getting the best results and support.