How the challenge flow works
The merchant's 3-D Secure server sends an authentication request with details of the payment and its own preference. The issuer's access control server reviews the request and, if further checks are needed, answers by requesting a challenge.
The merchant side can proceed or stop there. If it proceeds, the buyer's browser or app connects directly to the issuer's server, which tells the cardholder what to do and judges the answer. The issuer then sends the outcome back in a results message.
EMVCo's white paper says the challenge flow occurs when a transaction cannot be authenticated through a frictionless flow, or when the issuer's server deems the transaction high-risk. The methods EMVCo names include a one-time code sent to a mobile device and validation in the mobile banking app, known as out-of-band authentication.
Why the challenge flow matters to a checkout
In the EU and the UK, the challenge is how strong customer authentication is carried out for an online card payment that has no exemption. Elsewhere, issuers challenge by their own risk appetite.
A challenge adds a step, and some buyers fail or give up. Gateways track the challenge rate and the success rate by issuer, ask for exemptions where the rules allow, and take care that the challenge window displays properly on a phone.
Challenge flow or frictionless flow?
- Frictionless flow
- The issuer authenticates the payment on its risk assessment of the data received. The buyer sees nothing.
- Decoupled authentication
- The issuer reaches the cardholder outside the checkout, for example through the banking app, and the result can arrive later.
Where the challenge flow shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.