Handle 3-D Secure in every card flow

Region

European Union (EU), United Kingdom (UK). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

Review by

2027-04-30

How to do it

In the EU and EEA, PSD2 requires Strong Customer Authentication (SCA) for most online payments a customer starts. The UK has the same rule. The card's bank decides, and it asks through EMV 3-D Secure. Handle three outcomes, which are succeeded, requires action and failed. On requires action, call the provider's browser library to show the bank's challenge. Mark the order paid only from the webhook. Let the provider request exemptions instead of building your own. The rules in Regulation (EU) 2018/389 allow a few. Low-value payments of 30 euros or less are exempt until five in a row or 100 euros in total. Transaction risk analysis lets a provider with a low fraud rate skip SCA up to 100, 250 or 500 euros. A series of payments of the same amount to the same merchant needs SCA only for the first. Payees the customer added to a trusted list at their bank, and dedicated corporate payment processes, are also exempt. Charges you start without the customer, such as renewals, are outside SCA entirely, as Save cards with consent and charge renewals off-session says. The bank may refuse any exemption and ask for a challenge, so the challenge path must always work. A passed challenge usually moves fraud chargeback liability to the bank. PSD3 and the Payment Services Regulation keep SCA. Their final texts were agreed in 2025 and endorsed by the Council in April 2026. In October 2026 they still await formal adoption by the Parliament and the Council. Most of their rules apply 21 months after they enter into force, so look up that date on EUR-Lex. Test the challenge path as Test every payment outcome with test cards says.

Examples

JavaScript example

// Browser: the provider's library shows the bank's challenge when the bank asks for one
const { error } = await stripe.confirmPayment({
  elements,
  confirmParams: { return_url: 'https://example.com/orders/ord_8f2k/status' },
})
if (error) showPaymentError(error.message)

Python example

# Server: create the payment from the stored order, never from browser amounts
intent = stripe.PaymentIntent.create(
    amount=order.total_minor,
    currency=order.currency.lower(),
    automatic_payment_methods={"enabled": True},
    metadata={"order_id": order.id},
    idempotency_key=f"order-{order.id}-attempt-{order.attempt}",
)

How to check

Run checkout on staging with a test card that always asks for authentication, such as Stripe's 4000 0027 6000 3184. The challenge appears, and the order becomes paid only after you approve it. Failing the challenge leaves the order unpaid.

Sources

• PSD2 Directive (EU) 2015/2366, Article 97
• Regulation (EU) 2018/389 on strong customer authentication

Related rules

• PAY-3 Save cards with consent and charge renewals off-session in Payments and billing
• PAY-6 Test every payment outcome with test cards in Payments and billing