How to measure 3-D Secure: challenge rate, abandonment and failure

A payment can fail at 3-D Secure in several different ways, and a single line in a report rarely tells them apart. The customer may have closed the bank’s page. The code may never have arrived. The issuer may have rejected the attempt. The issuer’s server may have been down. Each of these looks like a lost sale, and each has a different owner.

This article sets out which numbers to track, how to separate abandonment and authentication failure from an authorisation decline, what published figures look like, and what to do when one of the numbers moves. For when to request 3-D Secure and which exemptions apply, see our guide to 3DS2 for cross-border shops. This one is about measuring the result.

What should you measure in 3-D Secure?

Treat it as a funnel with one denominator per step. Stripe’s authentication analytics use four rates, and they are a good starting point because the definitions are public.

Metric	Formula	Question it answers
Authentication rate	Payments with 3DS attempted ÷ all payments	How often do we ask?
Authentication success rate	Payments with 3DS completed ÷ all 3DS attempts	How often does it work?
Challenge rate	Payments challenged ÷ all 3DS attempts	How often does the customer have to act?
Challenge success rate	Challenges completed ÷ challenges shown	How often do they finish?

Add a fifth number of your own: approval after authentication, meaning payments the issuer approved ÷ payments that passed authentication. It shows whether authenticated traffic is actually getting through.

The names are a trap. Stripe’s “authentication rate” measures how often you request 3DS, not how often it succeeds. Ravelin’s report uses “3DS success rate” for the share of payments sent to authentication that succeed, which is closer to Stripe’s authentication success rate. Ravelin’s blog post words the same metric differently, so we use the definition printed in its report. Write your own definitions down before you compare anything with a provider’s number.

Decide on your scope as well. Stripe excludes 3DS requests made during card validations, payments through Apple Pay and Google Pay, and Data Only requests, which lead to neither a challenge nor a liability shift. It also offers raw and deduplicated views, and a customer who fails three times counts three times in one and once in the other. Our guide on how to calculate approval rate explains why payment intents make the better headline.

How do abandonment, failure and a decline differ?

They happen at different stages, and only one of them involves an authorisation decision.

Outcome	What happened	How it can appear	Who can act
Frictionless success	Issuer authenticated without customer input	Stripe flow frictionless	Keep it high with better data
Abandoned	Customer dropped off and the attempt timed out	Stripe abandoned; Adyen reason 14, timed out at the access control server	You, on checkout design and data; issuer, on its challenge page
Cancelled	Customer cancelled the authentication	Stripe canceled; Adyen Shopper Cancelled	You, by offering another method
Failed or rejected	Customer did not pass, or the issuer refused	Stripe failed, reason rejected; Adyen status N or R	Issuer; treat with care
Technical failure	The issuer’s 3DS system or the network failed	Stripe processing_error, protocol_error; Adyen status U, 3DS Authentication Error	Provider and issuer; watch for spikes
Not supported	Card or issuer has no 3DS	Stripe not_supported, card_not_enrolled	Decide per segment whether to proceed
Authorisation decline	Authentication passed, then the issuer declined	Decline code on the authorisation	Treat as an issuer decline

Stripe’s charge data carries these distinctions in a result field and a more detailed result_reason. Stripe’s dashboard chart is coarser: its “failed 3DS challenge” outcome groups customers who abandoned with payments rejected by the bank. If your report only shows that line, pull the detail from the transaction records.

Adyen’s API reference lists status Y for a successful authentication, I for an exemption granted by the issuer, N for not authenticated, U when authentication could not be performed, A when it was attempted but could not be verified, C when a challenge is required and R when the issuer rejected it. Its refusal reasons add 3D Not Authenticated and Shopper Cancelled. Other providers will use other labels, so map them into one set, as we describe in building a decline dashboard.

The last row matters most. Stripe’s analytics count a payment that fails 3DS as failing before it is sent to the card network, so it stays out of the authorisation rate and inside the payment success rate. In Stripe’s own example, 93,000 authorised out of 100,000 valid attempts is a 93% payment success rate, and the same 93,000 out of 98,000 reaching the network is 94.9% authorisation.

Why is abandonment hard to count?

Three reasons.

It arrives late. Stripe’s mobile SDK documentation says the 3DS timeout must be at least 5 minutes, and that this time covers network round trips and customer input. A customer who leaves shows up as abandoned only after the window closes. A report refreshed every few minutes understates the current hour.

It mixes silence with failure. A code that never arrived looks much like a customer who lost interest. Adyen notes that redirection can lower conversion through technical errors as well as shoppers dropping out.

It overlaps with retries. A customer who abandons and then pays with another card is lost at 3DS and won at checkout. Measure abandonment on attempts to judge the challenge experience, and on intents to judge the revenue effect.

What do published 3-D Secure numbers look like?

Ravelin’s Global Payments Report 2026 is one of the few published benchmarks. It uses anonymised data from its own payment fraud and 3DS products, so it describes Ravelin’s customers rather than the whole market.

January to July 2025	3DS success rate	Challenge success rate	Frictionless rate
North America	85%	85%	54%
Europe	83%	75%	62%
Global	82%	76%	58%

The spread between countries is wide. Ravelin puts the United Kingdom at 95% and Brazil at 36% for 3DS success, and Brazil at 27% for challenge success. Frictionless rates fell from 64% to 58% globally in a year, while 78% of merchants in its survey said they use exemptions. Ravelin’s reading is that issuers are refusing those requests more often.

Evidence on conversion points in two directions, and the context explains why. In a Stripe Sessions 2026 talk, Stripe staff said that a 2024 US experiment requesting 3DS on some transactions for selected businesses lowered conversion from 87% to 82%, even though most were approved frictionlessly, and that many US issuers treat 3DS as a risk signal. The same talk said conversion on 3DS transactions in Japan held at about 93% after the April 2025 mandate, with about 60% frictionless and dispute rates down by more than 50%. These are Stripe’s own figures for its own traffic. The lesson for a cross-border merchant is that the same request behaves differently in each issuing market.

What should you do when a number moves?

Match the symptom to the step where it appears.

What moved	Likely cause	What to do
Challenge rate up, one issuing country	Thin data, or issuers tightening	Check which fields you send for that segment; compare with last month
Challenge rate up everywhere	A change in your integration or data	Review recent releases and device data collection
Abandonment up, one issuer	Its challenge page or code delivery	Compare device and browser; raise it with your provider
Abandonment up, mobile only	Your flow on small screens	Test the challenge inside your checkout on real phones
Technical failures spike	Issuer or network outage	Check by issuer and provider; decide whether to proceed without 3DS where allowed
Rejections up on new customers	Possible fraud attempts	Keep the block; review with your fraud team
Approval after authentication falls	Issuer or acquirer problem	Treat it as a decline investigation, not a 3DS one

Data is the lever you control most. Visa’s better data guide reports that, on average, merchants completing the 3DS Method URL, which collects device data, at least 95% of the time saw a 127% frictionless rate lift, an 8% authentication success lift and an 8% approval lift, compared with merchants at lower completion. Merchants filling in more than half of the priority data elements saw lifts of 57%, 4% and 6%. The data comes from February and March 2022, and it compares groups of merchants, so stronger merchants may simply do both. It is still a clear place to look first.

Abandonment has a cost on the other side of the ledger. The December 2025 EBA and ECB report found that card payment fraud was 17 times higher when the recipient was outside the EEA, where SCA is not legally required and often not used. It also says SCA remains effective, while new fraud increasingly targets exempted payments. So never judge a 3DS change on conversion alone. Put abandoned revenue next to fraud and disputes for the same segment. Fraud and dispute data lags by weeks, so decide over a long enough window, and read our guide to false declines on estimating what a lost customer costs.

Worked example: two markets, one 3-D Secure rate

Example figures, for illustration only.

An online electronics store sends 10,000 payments to 3-D Secure in a month. The total looks healthy: 88% authentication success. Split by issuing market, it does not.

	Market A	Market B
Sent to 3DS	6,000	4,000
Frictionless success	4,000	1,600
Challenged	1,800 (30%)	2,200 (55%)
Challenge completed	1,540 (85.6%)	1,660 (75.5%)
Abandoned or cancelled	180	380
Rejected	80	160
Technical failure	200	200
Lost to abandonment and rejection	260 (4.3%)	540 (13.5%)

Market B has nearly twice the challenge rate, a higher drop-off per challenge and three times the share of payments lost at this step. The team checks three things. Device data collection is completing less often on Market B’s mobile traffic, which points to a fix on the merchant’s side. Rejections sit mostly on first purchases at high amounts, so those stay. In Market B, 3-D Secure is the merchant’s choice, not a legal requirement, so the team also tests authenticating first purchases only and compares abandonment with fraud over the next quarter.

What are the common mistakes?

• Reporting one failure rate. Abandonment, rejection and technical failure need different fixes.
• Blaming the acquirer for a checkout problem. If 3DS failures sit inside approval rate, a worse challenge flow looks like a weaker provider.
• Comparing rates with different denominators. Check whether a provider’s number divides by all payments, by 3DS attempts or by challenges.
• Reading the last hour. The timeout means recent abandonment is understated.
• Letting wallets distort the trend. Wallet payments do not use 3DS, so keep them out of these rates.
• Optimising for frictionless alone. A falling challenge rate with rising fraud is not an improvement.

How does Omno help measure 3-D Secure?

Omno’s transaction trail records every attempt, cascade step, provider response and webhook, with reports and widget analytics on top, so a payment can be followed from first attempt to final status and an authentication result told apart from a later decline. Routing rules can use card BIN, country, currency, amount, browser information or customer segment, so a segment with a weak result can go to a different provider by rule. The reporting and analytics page shows what is included.