Handle 3-D Secure in every card flow

How to do it

In the EU and EEA, PSD2 requires Strong Customer Authentication (SCA) for most online payments a customer starts. The UK has the same rule. The card's bank decides, and it asks through EMV 3-D Secure. Handle three outcomes, which are succeeded, requires action and failed. On requires action, call the provider's browser library to show the bank's challenge. Mark the order paid only from the webhook. Let the provider request exemptions, such as payments of 30 euros or less, instead of building your own. A passed challenge usually moves fraud chargeback liability to the bank. PSD3 and the Payment Services Regulation keep SCA. Their final texts were agreed in 2025 and endorsed by the Council in April 2026. Most of their rules apply 21 months after they enter into force, so look up that date on EUR-Lex.

Example

// Browser: the provider's library shows the bank's challenge when the bank asks for one
const { error } = await stripe.confirmPayment({
  elements,
  confirmParams: { return_url: 'https://example.com/orders/ord_8f2k/status' },
})
if (error) showPaymentError(error.message)

# Server: create the payment from the stored order, never from browser amounts
intent = stripe.PaymentIntent.create(
    amount=order.total_minor,
    currency=order.currency.lower(),
    automatic_payment_methods={"enabled": True},
    metadata={"order_id": order.id},
    idempotency_key=f"order-{order.id}-attempt-{order.attempt}",
)

How to check

Run checkout on staging with a test card that always asks for authentication, such as Stripe's 4000 0027 6000 3184. The challenge appears, and the order becomes paid only after you approve it. Failing the challenge leaves the order unpaid.