3D Secure (3DS) Authentication Failure
3D Secure (3DS) authentication failure occurs when a customer does not successfully complete the additional verification step required by their bank. Under regulations like PSD2 in Europe, many transactions require Strong Customer Authentication (SCA) — the customer must verify via SMS code, banking app, or biometric confirmation. When this step fails or is abandoned, the payment is declined. This is technically a hard decline (the same attempt won't succeed), but the customer can easily retry with proper authentication, making recovery rates of 50-65% achievable.
Affected Percentage
~8% of all declines (higher in Europe/PSD2 regions)
Recovery Rate
50-65% with outreach
Recommended Action
Do not retry
Common Causes
Customer abandoned the verification step
The most common cause — the customer saw the 3DS popup or redirect and closed it without completing verification. They may not have recognized it as legitimate or found it confusing.
Verification code expired or not received
The SMS code sent by the bank expired before the customer entered it, or the SMS was delayed or never arrived due to phone issues.
Banking app not installed or not working
Some 3DS implementations require the customer to confirm in their banking app. If the app isn't installed, not updated, or having technical issues, verification fails.
Browser or device compatibility issue
The 3DS verification popup may not render correctly on certain browsers, devices, or in certain iframe configurations, preventing the customer from completing the step.
Incorrect verification attempt
The customer entered the wrong SMS code or password multiple times, causing the bank to reject the authentication.
Recommended Retry Strategy
Timing
Do not automatically retry. Send an email asking the customer to complete the purchase again with their bank verification ready. Include clear instructions about what to expect.
Max Retries
0 automatic retries — the customer must actively re-authenticate
Reasoning
3DS authentication requires active customer participation. Automatic retries won't work because the customer needs to complete the verification step themselves. The only recovery path is to bring the customer back and have them try again.
Best Practices
- 1
Send a clear, immediate email explaining that the payment requires bank verification and inviting the customer to try again with instructions on what to expect.
- 2
Use 3DS2 (the newer version) instead of 3DS1 — it provides a smoother in-app experience rather than a clunky redirect, reducing abandonment.
- 3
Test your 3DS flow across different browsers, devices, and screen sizes to ensure compatibility.
- 4
For recurring subscriptions in 3DS-required regions, authenticate the first payment and use merchant-initiated transaction (MIT) exemptions for subsequent charges.
- 5
Provide visual guidance in your outreach showing what the bank verification popup looks like so customers recognize it as legitimate.
How Rezoki Handles This Automatically
Rezoki detects 3DS authentication failures and immediately sends a user-friendly email explaining what happened in plain language — many customers don't understand why they were asked to verify or what went wrong. The email includes a retry link and clear visual instructions showing what the bank verification screen looks like, so the customer can complete it confidently on the next attempt. For recurring subscriptions, Rezoki ensures the initial authentication uses 3DS2 with proper SCA flags, enabling merchant-initiated transaction exemptions for future renewals to avoid repeated 3DS challenges.