3DS2: Understanding payment outcomes

Zai Payments offers 3D Secure version 2 (3DS2) on online card payments. This article explains why a 3DS2 payment may not succeed, what your customer should do next, and who makes each decision along the way. These outcomes are common to 3DS2 wherever it is used, regardless of payment provider.

New to 3DS2? Start with 3DS2: Overview and getting started.

What is the difference between an authentication failure and a declined payment?

This is the most important distinction to understand when investigating a failed payment.

• Authentication failure (3DS2 stage): the card issuer (your customer's bank), or the 3DS process itself, did not confirm the cardholder's identity. The payment does not proceed.

• Declined payment (after 3DS2): authentication succeeded, but the payment was declined afterwards, either by Zai's fraud checks or by the issuer at authorisation.

3DS2 does not guarantee approval. An authenticated transaction can still be declined.

Why might an issuer fail or reject authentication?

Common reasons include:

• The cardholder entered the wrong code or did not complete the challenge in time

• The cardholder abandoned the challenge or closed the window

• The issuer's risk engine flagged the transaction as high risk

• The card is blocked, restricted, or has been reported lost or stolen

• The cardholder's contact details held by their bank are out of date

• The issuer's authentication systems were temporarily unavailable

• Incomplete or inconsistent data was sent with the request (for example, missing billing address or email)

The issuer does not share the details of its risk decisions with Zai or with you.

Can Zai decline a payment after 3DS2?

Yes. Every card payment, whether or not it used 3DS2, is assessed by Zai's standard card fraud system and rules. A payment that passes 3DS2 authentication may still be declined by Zai if it does not meet those rules.

Why else might a payment be declined?

Card payments can be declined for reasons unrelated to 3DS2, including:

• Insufficient funds or card limits reached

• Expired card or incorrect card details

• The issuer's own fraud or risk rules

• Issues or outages at the cardholder's financial institution

• A soft decline from the issuer requesting authentication

Should my customer retry a failed payment?

• After an abandoned or timed-out challenge: yes, a retry is reasonable once the customer is ready to complete the challenge.

• After a failed challenge (wrong code): the customer should check with their bank that their contact details are correct before retrying.

• After the bank refuses to authenticate the payment, or after a hard decline: do not keep retrying. Repeated attempts can trigger further fraud controls. The customer should contact their bank or use another payment method.

Who decides what?

A 3DS2 payment passes through several parties, and each makes its own decisions.

Need help? Contact Zai Technical Support at support@zaipayments.com. To help us investigate quickly, see what to include in 3DS2: Getting the best results and support.