3DS 2.3: challenge flow decisions
EMV 3DS 2.3 moves several decisions from the issuer to the ACS, and from the ACS to real-time context. What that means for merchants.
EMV 3-D Secure 2.3 has been rolling out through 2024 and 2025. It's an incremental update on 2.2, but the incremental changes matter — several decisions moved from the issuer to the access control server, and from the ACS to real-time contextual signals.
Written February 2026 from ACS integration reviews.
What's actually new
Three things worth reviewing:
- Delegated authentication. The merchant can authenticate the cardholder using its own credentials (biometric on the merchant app, for instance) and pass the result to 3DS. The issuer's ACS decides whether to trust it.
- Split SDK / Server data collection. The data payload the ACS sees can be enriched from both the SDK on the device and the merchant's server, with more nuance about which channel provided which fact.
- Better signal for out-of-band verification. OOB flows have more structured status updates, which improves the merchant's UX in the middle of the flow.
What integrations should audit
- Which signals your MPI is sending. More is not always better; the ACS uses the signals to make challenge decisions, but incomplete or inconsistent data raises challenge rates.
- Delegated authentication support at your issuer set. Not every issuer's ACS trusts delegated authentication; the merchant benefit only shows up where it's honored.
- Fallback for out-of-band success without redirect. Some OOB flows complete without the browser being redirected back; the merchant's session state has to handle that gracefully.
The decision that matters
Whether your merchant flow accepts a "challenge" as a failure or a step. If a challenge is friction to be avoided at all costs, you'll under-authenticate and eat fraud losses. If a challenge is a normal branch, you'll authenticate more and lose less. The right ratio depends on the merchant category, not on the technology.