How 3RI works
Every EMV 3-D Secure request names a device channel. In the app and browser channels the buyer is present and the issuer can show a screen. In the 3RI channel the merchant's 3-D Secure server sends the authentication request on its own, with data about the payment and about its earlier dealings with the cardholder.
EMVCo's white paper on EMV 3-D Secure describes the requestor-initiated flow for cases where the merchant needs to authenticate a transaction with the issuer but the cardholder is not present. EMVCo's examples include mail and telephone orders, recurring payments and subscriptions, and split or delayed shipments.
The issuer cannot show a challenge screen in this channel. EMVCo states that decoupled authentication, in which the issuer reaches the cardholder separately, for example through the banking app, is the only method for challenging a cardholder in a 3RI transaction.
Why 3RI matters to a payment gateway
A gateway that serves subscriptions, marketplaces or travel bookings meets 3RI when a payment is taken after the buyer has left. Each card scheme decides which 3RI requests its own programme accepts, in Visa Secure and in Mastercard Identity Check.
Support also differs by 3-D Secure version and by issuer. A 3RI request is therefore a capability to test market by market, not one to assume.
3RI or a merchant-initiated transaction?
- Merchant-initiated transaction
- An authorisation that a merchant sends under an earlier agreement with the cardholder. 3RI is an authentication request, and a merchant-initiated transaction can be sent without one.
- Challenge flow
- The issuer asks the buyer to confirm during checkout. 3RI has no checkout session, so a challenge can only take place by decoupled authentication.
Where 3RI shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- EMVCo, EMV 3-D Secure White Paper v2: Decoupled Authentication and the 3DS Requestor-Initiated flow
- EMVCo, EMV 3-D Secure
General information, not legal advice: what applies to you depends on your services and your market.