When youaccept credit and debit cards, you must protect the customer’s payment details and minimize the chances of payment fraud. Authentication is the payment industry best practice for increasing payment security: it gives the cardholder the chance to prove they’re legitimately making the payment.

Authentication functions as an identity check at the point of payment. Biometric authentication methods such as fingerprint, face scan or a passkey work well to quickly and easily verify the customer, because these are hard for a criminal to spoof or steal. Authenticated payments are more likely to be approved by the issuer, as well as triggering liability shift away from the merchant in the event of payment fraud.

With some forms of payment authentication, there can be trade-offs between user experience and payment security that may affect conversion. When customers are asked to authenticate a payment – such as verifying through a separate app or entering a code – it can cause frustration, confusion or suspicion which leads to an abandoned purchase.

Lately, there are more convenient and behind-the-scenes methods of payment authentication, such as “frictionless” authentication, which involves little or no user interruption.

What is payment authentication?

Payment authentication is the process of ensuring that the person attempting to make a payment is the legitimate cardholder.

Authentication verifies that it’s really the customer trying to transact – and not a fraudster using stolen card details. From a technical perspective, authentication typically refers to following the 3D Secure (3DS or “three domain secure”) protocol, which is the dominant global standard for card-not-present card transactions.

From a business perspective, authentication is an effective tool against many differenttypes of online payment fraud, which typically cause financial loss, higher processing costs, and reputation damage. As such, payment authentication is an effective tool against costlychargebacks.

Under standard EMV 3-D Secure and card brand rules, merchants that successfully authenticate digital transactions benefit from a liability shift to the issuer specifically for unauthorized fraud disputes. This is a key benefit of payment authentication.

Note: To quickly explain the difference between authentication and authorization: authentication is focused on verifying the cardholder’s identity, while authorization attempts to validate the payment itself (for instance, checking the bank account is available for use, and contains sufficient funds).

How does payment authentication work?

This is an overview of a typical authentication request on a customer-initiated transaction online. It takes place prior to authorization.

The merchant collects data points such as dive ID, browser, IP address, OS, (and more) and initiates an Authentication Request (AReq) containing both transaction details and this contextual payload.
The merchant’s payment services provider (PSP) may help to correctly format the data and choose the most suitable authentication pathway. It routes the request to the relevant card issuer’s Access Control Server (ACS) via the card network.
The issuer carries out risk analysis and routes the request via frictionless or challenge flow. If the latter, then the customer will need to manually authenticate the payment.
The issuer then sends a Authentication Response (ARes) which indicates if the authentication failed (perhaps due to timeout or the customer inputs incorrect credentials), requires another attempt (in the event of a soft decline) or if it succeeds. A successful ARes contains a cryptographically signed token known as a CAVV (Cardholder Authentication Verification Value) or AAV (Accountholder Authentication Value).
If authentication was successful, the merchant sends the CAVV/AAV cryptographic token along with the authorization request down the traditional payment rails (Merchant → Acquirer → Card Network → Issuer).

What data is needed for authentication?

To authenticate payments, merchants, payment service providers, and issuers typically rely on a combination of three core factors. These include something the cardholder:

Knows (such as a PIN, a password, or the answer to a security question)
Has (a device, such as a smartphone, tablet, or computer)
Is (their unique biometric identifiers, such as their facial pattern, iris, voice, or fingerprint)

Some of the specific ways a customer might authenticate a payment include:

Validating the payment request via a notification on the customer’s payment app
Entering a password or using a passkey
Biometric verification: scanning their face or fingerprint

These factors are called knowledge, possession, and inherence. They’re best practice security standards promoted by the National Institute of Standards and Technology (NIST) in the US, as well as being mandated in the EEA and UK under PSD2.

What is Strong Customer Authentication (SCA)?

Strong Customer Authentication (SCA) is a regulatory requirement for payment service providers under PSD2 in the European Economic Area (EEA), and in the UK under equivalent rules. It applies when a customer initiates an electronic payment, accesses a payment account online, or takes certain remote actions that could carry a risk of payment fraud (unless an exemption applies).

SCA requires you to authenticate your customer using at least two of the three authentication factors: knowledge, possession, and inherence. It applies when the relevant financial institutions (i.e. the acquirer and issuer) are in the EEA or UK.

Certain payments fall under SCA exemptions, and you should take care to apply these where relevant. Doing so can improve the customer experience while remaining compliant. For instance, Klarna saw a 6% increase in acceptance rate for transactions under €30 across four key markets (UK, Norway, Spain, and Denmark) by dynamically applying exemptions to low-value transactions.

Note that merchant-initiated transactions and mail-order/telephone order (MOTO) payments are generally not in scope. Read our SCA compliance docs for further guidance.

Payment industry trends in authentication

There is a wider global industry trend towards increasing payment security in online transactions, with countries such as Singapore moving away from one-time passwords and embracing use of stronger authentication methods such as biometrics and FIDO-compliant tokens. The 2024 release of the Shared Responsibility Framework in Singapore is an example of the modernization of fraud-prevention methods that broadens responsibility for protecting customers from phishing scams and monetary loss.

Broadly speaking, multi-factor authentication (MFA) is becoming more important in online transactions. This refers to collecting at least two different types of authentication data, such as one thing you know (for example, a password), one thing you have (such as a device) or one thing you are (such as your face scan). For instance, in 2025 the Reserve Bank of India mandated at least two factors of authentication for all digital payments.

Authentication standards vary globally, as regions introduce regulations at their own pace. While European regulation introduced Strong Customer Authentication requirements back in 2019, the Central Bank of the UAE voiced stronger support for authenticating online payments more recently, in 2025. The unevenness of global authentication policy is one reason why consulting with a payments partner experienced in your regions of business can benefit strategy development.

Trend towards frictionless and biometric mobile authentication methods

As the number of online payments grows, consumers want convenient experiences without sacrificing security. Regulators, banks, and industry bodies are introducing new standards for convenient payment security data collection, and merchants now have more options for speedy authentication.

Since 2016, EMVCo has allowed for two different authentication paths: the frictionless flow (needing no additional actions from the customer) or the challenge flow (which requires customer input). Nowadays, frictionless flow can take the form of data sharing, which means the merchant submits rich contextual, device, and behavioral telemetry (such as device fingerprints, IP location, account age, and checkout history) to help the issuer risk-assess the payment in the background without prompting the user.

In some cases, you can avoid redirect to 3DS challenge by using solutions such as Google Secure Payment Authentication (SPA), which can improve the user experience.

Biometric authentication is increasingly common because modern devices are typically equipped with high-quality cameras and sensors, making it quick and convenient for customers to authenticate payments. For instance, WePay, the Chinese payment app, scans the customer’s hand to authenticate a payment and improve payment security, and Google SPA also uses biometric authentication through Google’s web experience.

Modern mobile payments such as Apple Pay and Google Pay combine several of the above technologies to meet today’s authentication requirements. Both include the Device Primary Account Number (DPAN), a secure form of the customer’s payment details cryptographically bound to the device hardware. And users typically unlock their device with a passcode, face ID or fingerprint – data points which are conveniently included in payment flows. These help to reduce the number of times a user has to perform additional actions to authenticate digital payments.

How Checkout.com can help you benefit from authentication

With Checkout.com, there are three different models for your authentication integration:

Integrated Authentication: Use Authentication with Checkout.com via 3DS or Google SPA, with optional fallback between them.
Standalone Authentication (Sessions API): Authenticate first, then authorize through Checkout.com or another PSP, either through hosted sessions (where Checkout.com manages the flow), or non-hosted sessions (where you control more of the experience.)
Third-party authentication: If you already use another 3DS provider, you can send its authentication data with the payment authorization request via Checkout.com.

Competitive merchants will use a dynamic authentication strategy that adapts payments according to context, and improve the chances of a successful outcome. You can use Intelligent Acceptance to decide when to use 3DS, which protocol version or exemption to request, and whether to use frictionless or challenge flows. This can lead to improved performance and revenue, for example, NordVPN saw a 1.9% Acceptance Rate uplift in SCA-managed traffic since using Intelligent Acceptance.