Deep Dive·8 min read·May 12, 2026·Updated November 11, 2026

3DS2 Fallback Strategies for US Merchants

For US merchants 3DS2 is optional, so the strategy is choosing when to use it: authenticate risky orders, skip low-risk ones, and retry European soft declines (Visa code 1A) with 3DS. Under Visa's rules, a Visa Secure authentication with the CAVV voids card-absent fraud disputes. Visa retired 3DS 1.0.2 in 2022.

3DS2 fallback strategies for US merchants: risk-based 3DS, EU exemptions, and soft-decline retry, now that Visa has retired 3DS 1.0.2.

myPayAdvisor Editorial

Reviewed by Barak Bachar, Global Payments Manager

Audio overview · 8 min listen

Download

Key findings

Under Visa's rules, a card-absent fraud dispute is invalid when the sale was authenticated through Visa Secure with the CAVV in the authorization (ECI 5), or was an attempted authentication with the CAVV (ECI 6).
Visa ended support for 3DS 1.0.2 on October 15, 2022, so a 3DS1 fallback path no longer authenticates anything.
Visa's code 1A (additional customer authentication required) is listed for Europe and CEMEA. Retry those sales with 3DS instead of dropping the cart.
EU rules exempt remote payments up to EUR 30 (with cumulative caps of EUR 100 or five payments), and set TRA reference fraud rates of 0.13% up to EUR 100, 0.06% up to EUR 250 and 0.01% up to EUR 500.
In the US there is no SCA mandate, so run 3DS where the fraud risk outweighs the friction, and price any per-attempt 3DS fee against the fraud you avoid.

TL;DR

3DS2 authentication protects you from card-absent fraud disputes under Visa's rules, but a challenge adds friction that can cost sales. Treating 3DS2 as a binary on or off switch leaves money on the table. A tiered strategy, frictionless first, exemptions where they apply, soft-decline retry with 3DS next, recovers sales without giving up protection on risky orders. 3DS 1.0.2 is no longer a fallback: Visa ended support for it on October 15, 2022. The lever lives in your gateway routing rules, not the merchant agreement.

What this actually is

3DS2, the second generation of the 3-D Secure protocol, is the EMV 3-D Secure standard managed by EMVCo that authenticates a cardholder during a card-not-present transaction. Visa says EMV 3DS was published in October 2016 and provides enhanced data exchange for better fraud management and authorization decisions. The merchant sends transaction and device data to the issuer through a Directory Server, letting the issuer score the transaction in real time and decide whether to authenticate without challenging the buyer (frictionless flow) or to request a step-up (challenge flow).

Visa runs its 3DS program as Visa Secure and sets the rules in its Core Rules. Mastercard publishes its equivalent under Identity Check (see Mastercard interchange and rules).

Protection is the lever. Under Visa's rules, a card-absent fraud dispute is invalid when the transaction was authenticated through Visa Secure with EMV 3DS and the CAVV was in the authorization request (ECI 5), or when the issuer returned an attempt response with a CAVV (ECI 6, except non-reloadable prepaid cards). Mastercard, American Express and Discover have their own rules, so check them. That is the trade the protocol offers: lower fraud loss, at the cost of friction that can cost sales. In the EU, PSD2 requires strong customer authentication, which card payments usually meet with 3DS. In the United States there is no equivalent mandate, so US merchants choose when and how to invoke it. That choice is the entire fallback strategy.

3DS2 is a real-time data exchange between merchant, card network, and issuer that authenticates a cardholder and, under Visa's rules, protects the merchant from card-absent fraud disputes when the cardholder is verified.

How it works under the hood

A 3DS2 authentication flow runs in five steps:

The merchant's gateway initiates 3DS2 by sending the cardholder's PAN, device data, billing data, and other transaction data to the Directory Server operated by the relevant card network.
The Directory Server routes the request to the issuer's Access Control Server (ACS).
The ACS scores the request using its own fraud models plus the data the merchant supplied. Risk score, transaction amount, prior history, and device reputation are the heaviest signals.
The ACS returns one of three outcomes: frictionless approval (no buyer interaction), challenge (the buyer completes a one-time passcode or biometric step), or denial.
If authenticated, the merchant submits the authorization with a CAVV (cardholder authentication verification value) and an ECI flag that tells the acquirer the transaction was 3DS2 authenticated.

Three flow outcomes drive approval rate math:

Frictionless: the issuer authenticates without challenging the buyer. Conversion stays high, liability shifts to the issuer. Best case.
Challenge: the buyer is asked to authenticate, typically in a modal or redirect, with a passcode or app push. Some buyers abandon at this step; measure your own rate.
Fallback: authentication is unavailable or fails to complete. The gateway can send the authorization without 3DS or decline. 3DS 1.0.2 is no longer an option: Visa ended support for it on October 15, 2022.

Two regulatory regimes shape how often each path fires. PSD2 strong customer authentication (SCA) binds payment providers in the European Economic Area. A US merchant on a US acquirer is not directly bound, but EEA issuers can still decline and ask for authentication. Inside the US there is no SCA mandate. Issuers and merchants run 3DS2 selectively, usually on high-risk transactions or above defined dollar thresholds.

Operator note

Soft-decline response codes are not refusals. Visa's response code 1A (additional customer authentication required), which Visa lists for its Europe and CEMEA regions, means the issuer wants authentication before approving. Mastercard issuers use their own code, so ask your gateway how it maps them. Treating these as hard declines throws away sales the issuer was willing to approve.

This is where the fallback strategy lives. A merchant that hard-codes 3DS2 on every transaction pays a conversion tax that PSD2 forces in the EU but does not apply in the US. A merchant that turns 3DS2 off entirely loses the liability shift and absorbs more fraud chargebacks. The correct configuration sits between the two, tuned to card mix, fraud rate, and average ticket.

Where it goes wrong for operators

Four patterns burn merchants who do not tune their 3DS2 fallback logic.

The 3DS1 fallback that no longer works. Visa ended support for 3DS 1.0.2 on October 15, 2022, and said merchant plug-ins still sending 3DS 1.0.2 traffic would get an error response. If your gateway still has a 3DS1 fallback path, those requests do not authenticate. Check what your gateway does when EMV 3DS is unavailable. For example, if 30 percent of $300,000 a month hits a broken fallback path and 4 percent more of it abandons, that is $3,600 a month in lost sales.

The exemption you never asked for. The EU rules on strong customer authentication let payment providers skip it in set cases: remote payments up to EUR 30 (while the payer's total since the last authentication stays within EUR 100 or five payments, per Article 16), trusted beneficiaries the payer has whitelisted, and transaction risk analysis (TRA), where the provider's fraud rate must stay under reference rates of 0.13 percent up to EUR 100, 0.06 percent up to EUR 250 and 0.01 percent up to EUR 500 (Annex). Merchant-initiated charges on a stored card are handled separately. These matter for EEA cards. Many gateways do not request exemptions by default, so ask how yours does it.

The soft-decline blind spot. A soft decline asking for authentication (Visa code 1A, used in Europe and CEMEA) means the issuer wants 3DS before it will approve. If your gateway treats this as a hard decline and dumps the cart, you lose every one. Retry-with-3DS logic gives those sales a second chance.

The contract clause that backloads the cost. Some processors charge a per-attempt 3DS fee on top of interchange. If your gateway invokes 3DS2 on every transaction, that fee runs on 100 percent of CNP volume. For example, at $1 million monthly CNP volume with an $80 ticket, you process 12,500 transactions; a 5-cent fee on every one adds $625 a month, $7,500 a year. Frictionless authentications still earn Visa's dispute protection, so weigh the fee against the fraud you would otherwise absorb.

Watch out

Some processors bundle a flat "authentication fee" into their CNP rate, then bill the network's 3DS2 fee separately as a pass-through. Read the addenda. If both line items appear on the same statement, you are paying the markup twice.

These four patterns each have a different fix. The shared lever is tuning the gateway, not switching processors.

Worked example with real numbers

Consider a hypothetical US-based DTC apparel brand at $1.2 million monthly card-not-present volume, $95 average ticket, currently on a flat-rate plan at 2.9 percent plus 30 cents. Roughly 18 percent of their volume comes from EEA cardholders, 82 percent from US cardholders (3DS2 optional). Their current approval rate is 87 percent, with a fraud chargeback rate of 0.18 percent of card-not-present volume.

The math on a blanket 3DS2-on-all-transactions policy, assuming it causes 5 percent abandonment on US traffic:

12,632 transactions a month
5 percent abandonment on US traffic: 12,632 x 0.82 x 0.05 = 518 lost transactions
Lost revenue at $95 ticket: $49,200 a month, $590,000 annualized

Illustrative example

The same brand, after tuning its rules: keep 3DS for EEA cardholders, whose issuers may require it. Skip 3DS on US tickets under $250 with a low gateway risk score, assumed to cover roughly 70 percent of US volume. Run 3DS on US tickets above $250 or those flagged by the gateway's risk score. Retry every response code 1A with 3DS.

Assume tuning recovers 350 of the 518 lost transactions: about $33,250 a month, $399,000 a year. Fraud exposure rises because more US transactions are unauthenticated. Assume the US fraud rate goes from 0.18 percent to 0.24 percent of US volume ($984,000 a month): about $590 more in fraud losses, plus about 6 more chargebacks at an assumed $80 fee (about $500), or about $1,090 a month. Net benefit: $33,250 minus $1,090 equals about $32,160 a month, or about $385,900 a year, from gateway configuration alone.

TRA is an EU exemption that the payment provider applies based on its own fraud rate, using the reference rates in the EU rules (0.13 percent up to EUR 100, 0.06 percent up to EUR 250, 0.01 percent up to EUR 500). It matters for EEA cardholders, not US ones; for US cards you simply decide when to run 3DS.

Turning 3DS2 on across all US CNP volume trades sales for fraud protection on every order, including the safe ones. The trade pencils best when you target the higher-risk subset.

Operator playbook

Pull a 90-day report from your gateway segmented by 3DS2 outcome. You need volumes, conversion, and chargeback rate for: frictionless approved, challenge approved, challenge abandoned, authentication unavailable, and no 3DS attempted. If your gateway will not give you this split, that is the first thing to fix.
Identify your EEA cardholder bucket by BIN. EEA issuers work under PSD2 strong customer authentication and may decline without it. Run 3DS on that bucket by default and retry any 1A declines with 3DS.
For US cardholders there is no SCA mandate, so set gateway rules to skip 3DS on low-risk transactions, for example under twice your average order value. For EEA cards, ask your gateway whether it can request exemptions such as TRA or low-value. Read the docs, do not assume default behavior.
Configure soft-decline retry. A response code 1A on Visa (a Europe and CEMEA code) is the issuer asking for authentication; ask your gateway which Mastercard code it treats the same way. Your gateway should retry that transaction with 3DS2 invoked, not dump the cart. Confirm in writing with your processor that soft-decline retry is enabled.
Audit the 3DS2 fee on your statement. Look for line items like "3DS2 transaction fee," "3DS authentication fee," or "ACS fee." If you have 3DS2 on every transaction, calculate the annualized cost and ask the processor to cut or waive the per-attempt fee.
Push first-party data accuracy at checkout. Matching billing address, persistent device ID, account age, and email reputation all raise your TRA qualification rate. Make sure your checkout passes every data point the gateway accepts.
A/B test 3DS2 on US tickets between $100 and $300. Most merchants find a threshold where the conversion lift from skipping 3DS2 outweighs the fraud exposure. Run 30-day windows and measure both approvals and chargebacks.
Renegotiate the 3DS2 line item at contract renewal. If your processor cannot give you per-flow pricing (charge only on challenge, not on frictionless), that is a quote worth running against competitors.

"The conversion tax of blanket 3DS2 is invisible until you split the statement by outcome. Once you see the abandonment rate on challenge flow, you can price the change."

Visual summary

The story in three slides.

Frequently asked questions

What is the difference between 3DS2 and 3DS1, and why does it matter for approval rates?

3DS 1.0.2 is the original version of the specification; Visa described it in 2021 as introduced over 15 years ago. EMV 3DS was published in October 2016 and, per Visa, provides enhanced data exchange for better fraud management and authorization decisions, and support across more channels and devices. That lets more transactions authenticate without a challenge, and challenges can use app or one-time-code steps instead of a static password. The practical point in 2026: Visa ended support for 3DS 1.0.2 on October 15, 2022, so EMV 3DS is the only version that authenticates Visa transactions.

Does using 3DS2 always shift chargeback liability to the issuer?

Not always. Under Visa's rules, a card-absent fraud dispute is invalid when the transaction was authenticated through Visa Secure with EMV 3DS and the CAVV was included in the authorization request (ECI 5). Attempted authentications are also covered when the issuer, or Visa on its behalf, returned an attempt response with a CAVV (ECI 6), except on non-reloadable prepaid cards. The protection covers fraud disputes, not disputes about defective products, services not rendered, or duplicate processing. It does not apply if you authenticate but then submit the authorization without the CAVV. Confirm your processor forwards the CAVV and ECI on every authenticated transaction, and check Mastercard's Identity Check rules separately.

Should US merchants use 3DS2 if there is no PSD2 equivalent in the US?

Selectively, yes. The US has no regulatory mandate for SCA, so blanket 3DS2 on all transactions can cost more in lost sales than it saves in fraud. The sweet spot is risk-based 3DS2: trigger it on high-ticket transactions, on cards with prior chargeback history, on mismatched billing or IP addresses, and on accounts with thin order history. Measure your own invocation and frictionless rates by segment. That blend captures most of the fraud protection on the risky transactions while protecting conversion on the easy ones.

What is a soft decline and how do I retry it with 3DS2?

A soft decline of this kind is an issuer response that says the issuer will consider approving if you authenticate the cardholder. On Visa, the response code is 1A (additional customer authentication required), which Visa lists for its Europe and CEMEA regions. Mastercard issuers use their own code, so ask your gateway how it maps it. If your gateway treats these as hard declines, you lose the transaction. Proper handling is to catch the soft decline, run 3DS2, and resubmit. Ask your processor for soft-decline retry with 3DS2 by name, then measure how many of those sales you recover.

What exemptions can let me skip 3DS2 while keeping fraud protection?

The exemptions come from the EU rules on strong customer authentication (Commission Delegated Regulation 2018/389), not from Visa or Mastercard. They include low-value remote payments up to EUR 30, as long as the payer's total since the last authentication stays within EUR 100 or five payments; transaction risk analysis (TRA), where the payment provider's fraud rate stays under reference rates of 0.13 percent up to EUR 100, 0.06 percent up to EUR 250 and 0.01 percent up to EUR 500; and trusted beneficiaries the payer has whitelisted. Merchant-initiated charges on a stored card are handled separately. Under Visa's rules, the fraud-dispute protection depends on a Visa Secure authentication or attempt with a CAVV, so an exempted sale does not get it. These exemptions matter for EEA cards; US cards have no SCA mandate. Each gateway implements exemption flags differently, so check the API docs.

How do I tell from my statement what 3DS2 is costing me?

Three line items to look for. First, any 3DS authentication fee or ACS fee, charged on every transaction where 3DS2 is invoked, not just challenge flows. Second, your card-not-present interchange. Visa's October 2026 schedule gives CPS-qualified consumer credit card-not-present transactions a 0.10 percentage point incentive for its Digital Commerce Authentication Program, which can offset part of the fee; debit categories show no such incentive. Third, your fraud chargeback rate before and after enabling 3DS2. Fewer fraud chargebacks cut both chargeback fees and monitoring-program risk. Pull six months of statements and run the diff.