--- title: Improving Authentication in your Payment Flow slug: 3d-secure-2-emv-3d-secure docTags: createdAt: 2024-05-28T16:13:05.408Z --- In the 3D Secure 2 payment flow, the Issuer will make a decision on whether they have enough **authentication data** to proceed with the transaction, or if they require the cardholder to further authenticate the transaction with **additional **Strong Customer Authentication (SCA) checks. The authentication request gathers the device and card details. Depending on the authentication data that is being sent, the response will determine whether: - The consumer is **challenged** for additional information. - The consumer is **not challenged**, the authentication is successful and the transaction continues. *** ## Maximise the Frictionless Flow To leverage the authentication data sent in your payment flow and maximise the chances of your consumers experiencing a frictionless payment, see below: ### Data Points Ensure that you’re collecting and sending all of the recommended data points. This includes: - [Device Details](docId\:nnhSdT3Gbi4J2lnTGnIkC) - Browser IP address - Transaction history - Customer behaviour :::hint{type="info"} As 3D Secure continues to evolve, updates are often made to the types of data points that need to be sent with every transaction. Keeping up to date with these changes can lead to higher approval rates and a better customer experience. For more details on the mandatory data points, see [Device Data Collection](docId\:nnhSdT3Gbi4J2lnTGnIkC)**.** ::: *** ## Recommended Fields It is recommended to send the following parameters in **every** 3D Secure authentication request: - `cardHolderName` - `emailAddress` - `mobileNumber` *** ### Mastercard Recommended 3D Secure 2 Fields From 1 July 2026, **Mastercard recommends** providing the following information for Mastercard 3D Secure authenticated transactions: - **Cardholder name** The cardholder’s full name. - **Billing address line 1** The first line of the cardholder’s billing address. - **At least one contact method** Either the: - Cardholder’s email address or - A supported telephone number - **Phone country code** The international dialling code associated with the mobile telephone number, when a mobile number is provided. Supplying this information may improve issuer authentication and authorisation decisions. These fields are recommended rather than mandatory. :::hint{type="info"} Transactions will continue to be processed if the fields are not supplied. ::: For more information on the field names, formats and locations within each request type, see our [Transaction API Reference](https://docs.judopay.com/api-reference). *** ### Exempt Transactions Merchants can request specific Customer-Initiated-Transactions (CIT)s be exempt from strong customer authentication (EMV 3D Secure). This has the benefit of reducing friction for your customers and related checkout drop-outs. :::hint{type="warning"} Judopay will not currently automatically apply for transaction exemptions on behalf of the merchant. ::: For more information on the available exemptions, see [Exemptions to SCA](docId\:SaSeq4PpWBNsJt_if_0kX). *** ## Best Practices Follow these best practices, to ensure that your 3D Secure 2 implementation will be both effective and customer friendly. As a first step, ensure that your 3D Secure requests include the recommended authentication data where available. For more information, see [Recommended Fields](docId:0YQDP4kpyOiJJ6UNudn9f). ### Step-Up Authentication If an Issuer is unsure whether a transaction is legitimate, a transaction may be **soft declined**. To tackle this and improve approval rates, one feature you can benefit from is [step-up authentication](https://help.judopay.com/hc/en-gb/articles/12421174101276-What-is-Step-Up-Authentication). With step-up authentication, if a transaction is soft declined the customer can be prompted to provide additional information such as an OTP. This sends **additional data** to the Issuer to help prove that the cardholder is legitimate, allowing the transaction to proceed successfully. Tips for step-up authentication: - **Offer multiple authentication methods** - Provide customers with a variety of authentication options, such as SMS, OTP etc. This flexibility ensures that customers can complete the authentication in a way that is most convenient for them. - **Optimise the step-up flow** - Ensure that the step-up flow is as seamless as possible. This means optimising the UI for mobile devices, reducing load times, and providing clear instructions to the customer. *** ### Optimise for Mobile With the rise of mobile and app commerce, it is critical that your 3DS2 flow is optimised for mobile devices. This isn’t just about making sure that your payment page is responsive, it is ensuring that the entire authentication flow is smooth and user-friendly on smaller screens. Considerations for mobile optimisations include: - **In-app authentication** Do you have a mobile app? Consider implementing in-app 3DS2 authentication. This approach keeps the customer within the app during the authentication process, reducing the risk of drop-off. - **Test across multiple devices** - Ensure that the 3DS2 flow works smoothly across a wide range of devices and operating systems. *** ### Monitor and Optimise Performance It is crucial to continuously monitor performance and make updates as and when needed. Tips for optimising your 3DS2 flow include: - **Monitoring approval rates** Keeping an eye on your approval rates will be a key indicator if your flow is working well or needs adjusting. - **A / B testing** - It can be tricky to find that balance between security and user experience. A / B testing can help determine which authentication methods and flows give the best conversion rates while keeping your transactions secure. *** ### Stay Compliant with Regulations Regulations regarding online payments and customer authentication are regularly updated, and can vary region by region. To remain compliant: - **Understand local requirements** Ensure that your 3DS2 implementation meets the specific requirements of the regions where your business is operating. - **Update, as and when, regulations evolve** - It is important to stay informed and update your flows accordingly. Work with a payment provider that will keep you up-to-date with regulatory changes and ensure that you stay compliant.