Payment authentication confirms that the cardholder is who they claim to be before the issuer authorizes a payment. For PSPs, PayFacs, ISOs and ISVs, it decides fraud liability, approval rates and checkout friction for every merchant. 3-D Secure, SCA exemptions and delegated flows are configured per merchant and market on NORBr's white-label payment infrastructure.
Authentication is the step most merchants notice only when it fails: a challenge screen that never loads, a bank app that times out, a payment approved by the wallet and then declined by the issuer. Sandra Mianda, Founder and CEO of Paypr.work, follows that step from the first version of 3-D Secure to delegated and demoted authentication in Season 3 of #TheShot, after explaining BINs in Season 1.
This article, updated in October 2026, follows the six episodes of Season 3 and adds what has changed since: the scheme rules, the European payments package and the rise of passkeys.
Key takeaways on payment authentication:
- 3-D Secure separated authentication from authorization and introduced the liability shift: when a transaction is authenticated, fraud liability moves to the issuer.
- In Europe, PSD2 turned 3DS from a fraud tool into the default way to comply with strong customer authentication.
- Outside Europe, 3DS is mostly optional, so a blanket approach can cost approvals.
- Delegated authentication lets a wallet or device authenticate on the issuer's behalf, but only if the issuer accepts it.
What is payment authentication and why does it matter for PSPs and PayFacs?
Authentication answers one question: is the person paying the legitimate cardholder? Before 3-D Secure, that question had no separate step. The issuer used the same data to authenticate and to authorize, which left merchants, in Sandra's words, "very much at the mercy of the issuer."
Strong customer authentication rests on three kinds of factor: something the cardholder knows, such as a PIN or a password, something they have, such as a phone, and something they are, such as a fingerprint or a face. The factors chosen, and how often they are requested, shape three outcomes at once: the fraud rate, the conversion rate and the customer experience.
For an operator serving hundreds of merchants, those outcomes are not set once. They depend on the market, the issuer, the card and the amount, and they land on the operator's support desk when they go wrong.
How did 3-D Secure change online card payments?
3-D Secure, launched by the card schemes in the early 2000s, created a structured exchange between the merchant, the scheme and the issuer, so the cardholder could be asked to verify themselves in real time. It also introduced the concept that made it stick.
"Something really important to note about the authentication framework 3DS is that it introduced a key concept, which is the liability shift. With 3DS, when a transaction is authenticated successfully, the issuer takes the heat for fraud, not the merchant." Sandra Mianda, Founder and CEO, Paypr.work, in Episode 1
The protocol has since moved from static passwords to risk-based, often invisible flows. The first version was switched off by the schemes in October 2022. Today EMVCo recommends version 2.2 or higher of EMV 3-D Secure, which lets the issuer approve a transaction without a challenge when the merchant sends enough data. Episode 2 explains how that separation of authentication from authorization reshaped the card flow.
How did PSD2 turn 3-D Secure into a compliance requirement?
In Europe, strong customer authentication became law. The rules of PSD2 have applied since September 2019, and the European Banking Authority set 31 December 2020 as the deadline for card e-commerce. The UK followed on 14 March 2022.
"When people think of 3DS, they often think about fraud prevention. But what really pushed 3DS into the spotlight wasn't just fraud, it was regulation." Sandra Mianda, in Episode 3
3DS became the default way to deliver that authentication, and the liability shift became part of compliance rather than an option. The evidence that it works is in the data: the latest joint EBA and ECB report on payment fraud (December 2025) found that transactions verified with SCA were generally less exposed to fraud, and that card fraud was 17 times higher when the payee sat outside the European Economic Area, where SCA does not apply.
The next round of rules is close. The PSD3 directive and the Payment Services Regulation, agreed in 2025, are expected in the Official Journal at the end of 2026. According to Freshfields' analysis of the agreed text, SCA will be allowed to rely on two biometric elements, PSPs will have to offer several SCA methods free of charge, none of which may depend on a single device, and technical service providers that deliver SCA will carry their own liability.
How does 3-D Secure enforcement differ outside Europe?
Outside Europe, 3DS is mostly a tool the issuer can choose to use. Depending on its own risk signals, the issuer decides whether to challenge the cardholder or let the transaction through. In the US, Sandra warns in Episode 4, a merchant that turns 3DS on for every transaction will probably see declines rise in some segments.
Some markets have moved toward mandates. Japan's Ministry of Economy, Trade and Industry revised its credit card security guidelines to require EMV 3-D Secure at, in principle, every e-commerce merchant by the end of March 2025. Performance still varies widely: Ravelin's 2026 Global Payments Report found that frictionless rates fell or plateaued in 28 of the 37 countries it tracks.
"Key to remember that the authentication framework and the strategy around it is not simply one rule. It has to be designed with many components and parameters. Regulation is one part to understand." Sandra Mianda, in Episode 4
The issuer keeps the final say. An authentication strategy therefore combines regulation, the data sent with each request, and an understanding of how each issuer behaves, market by market.
What is delegated authentication and when does it fail?
Delegated authentication lets a third party, such as a wallet, a merchant or a device maker, perform strong authentication on the issuer's behalf. Approving an Apple Pay payment with your face is the common example: the wallet authenticates you, not your bank. It happens closer to where the customer acts, and it removes a redirect from the checkout.
The schemes are building on it. Mastercard reported in June 2026 that three in five of its e-commerce transactions in Europe are tokenized, with payment passkeys live and a goal of ending manual card entry by 2030. Passkeys are also spreading beyond payments: the FIDO Alliance's Passkey Index 2026, published on 15 October 2026, found that passkey sign-ins succeed 93% of the time, against 78% for traditional multi-factor authentication.
The catch, in Episode 5, is trust. Not every issuer accepts authentication performed by someone else. When it does not, the transaction is pushed back into the standard flow, which Sandra calls demoted authentication.
"Even when a customer is strongly authenticated by the wallet or device, if the issuer doesn't trust that method, it is ignored or rejected." Sandra Mianda, in Episode 6
In practice, the issuer returns a soft decline asking for SCA, and the merchant has to retry with a 3DS challenge, which adds friction or fails outright. It happens when issuers have not opted in to delegation, when acquirers are not configured to allow it, or when a scheme program is not enabled for every party in the chain.
How should a PSP or PayFac design its authentication strategy?
As a set of rules per merchant, market and transaction type, not as a switch. Four decisions matter most:
- When to request 3DS: mandatory flows in the EEA and UK, selective use elsewhere, based on issuer behavior and fraud data.
- Which exemptions to request: low value, transaction risk analysis, trusted beneficiaries and merchant-initiated transactions, within each acquirer's limits.
- How to handle soft declines: retry with a challenge when the issuer asks for SCA, instead of letting the payment fail.
- Which credentials to store: network tokens and passkey-ready flows that support delegated authentication.
On NORBr, operators configure 3DS triggers, SCA exemption rules and retry policies per merchant in payment resilience, use the BIN and issuer data read at the entry of the routing engine, and run the authentication step inside a hosted checkout under their own brand. NORBr does not decide whether an issuer accepts a delegated authentication: that remains the issuer's call. The BIN configuration article by Sandra and the article on AI agents that pay, where authentication built for humans no longer fits, go further.
Who is Sandra Mianda?
Sandra Mianda, Founder and CEO, Paypr.work. Sandra runs Paypr.work, a payments consultancy that helps merchants and payment providers improve acceptance, authentication and card data. She was the first guest of #TheShot, in Season 1 on BINs, and wrote NORBr's article on BIN configuration. Follow her on LinkedIn and Paypr.work on LinkedIn.
A liability shift only protects the merchant whose authentication the issuer actually trusts.
NORBr is the white-label payment infrastructure for PayFacs, PSPs, ISOs and ISVs. Operators set 3DS rules, exemptions and retries per merchant and market, under their own brand.
About #TheShot: a video series sharing clear, unsponsored insights from payment professionals. One expert, one topic, short episodes. Watch Season 3 with Sandra Mianda or browse all seasons.
_%2520a%2520game%2520changer%2520for%2520digital%2520transactions_-Cover.webp){kind=spacer}
