How does the challenge flow work?
The merchant’s 3-D Secure server sends transaction and device data to the issuer. If the issuer’s risk assessment cannot approve the payment frictionlessly, it returns a challenge-required result and the customer sees the issuer’s own screen: a pop-up, iframe or redirect on the web, or a native screen in an app. EMVCo lists one-time passcodes, knowledge-based questions and biometrics as challenge methods, and Stripe’s test screens also cover out-of-band confirmation in a banking app. The authentication result then travels with the authorization request.
Can the merchant influence it?
It can state a preference, but the issuer decides. Adyen’s API reference lists challenge indicator values that include no preference, no challenge requested, challenge requested by the merchant and challenge requested due to a mandate. Stripe lets merchants request 3-D Secure with a preference for a challenge flow and notes that it cannot guarantee the preference. In Europe, Stripe triggers 3-D Secure automatically where strong customer authentication rules mandate it.
What are the trade-offs?
A challenge is a point of drop-out. Stripe’s documentation says issuers must support set window sizes, from 250 by 400 pixels up to full screen, and that app timeouts must be at least five minutes to stay compliant with strong customer authentication. As an illustrative example: of 5,000 challenged payments a month, 4,250 complete and 750 are abandoned or time out. That 15% loss on orders of 60 euros is 45,000 euros of attempted sales a month.
Where does Omno use it?
3-D Secure is performed by the connected PSP. In Omno’s hosted checkout the challenge is handled inside the same flow, the payment waits in the PENDING_3DS status and the final status arrives by webhook. Issuers may still challenge saved-card payments. When testing with fake providers, card 378282246310005 triggers a challenge with a simulated page to pick the result.