Beyond 3DS: Bringing Authentication and Fraud Decisioning Together

Card-not-present fraud continues to grow. UK Finance reported 3.2 million remote purchase fraud cases in 2025, up 13% year on year, with losses reaching £423.5 million.¹ But preventing more fraud is only part of the challenge. Issuers also need to recognize legitimate customers and keep unnecessary friction out of the checkout experience.

3-D Secure (3DS) plays an important role in that balance, helping issuers assess risk before an online card payment reaches authorization. Yet the intelligence generated during any risk-based authentication can have value beyond the authentication decision itself.

Feedzai recently launched a new API for 3DS Authentication decisions, designed to assist issuers with critical authentication decisions.

In this article, we’ll explore how this new API helps banks connect data across the card decision lifecycle, creating richer context by combining 3DS Authentication with Cards Authorization.

Key Takeaways

• 3DS Authentication adds an extra layer of risk intelligence to Feedzai’s TFB for Cards solution, creating a more complete view of the cardholder journey.
• 3DS Authentication and Cards Authorization remain distinct decisions with different risk thresholds, but the intelligence around them can be connected.
• Through a dedicated 3DS Authentication workflow, Feedzai applies 3DS-specific rules, metrics, and models to authentication decisions and relevant risk context, returning a real-time risk score and recommendation to the issuer’s ACS.
• Authentication signals and challenge outcomes can contribute to the wider cardholder risk picture, providing additional context for the fraud decisions that follow. 

The Changing Role of 3DS in Payment Fraud Prevention

3-D Secure has evolved. It’s shifted from a primary cardholder verification mechanism to a rich source of risk context within the online payment journey. Modern 3DS interactions can provide issuers with information about the transaction, merchant, cardholder, device, browser, and previous authentication activity before a payment reaches authorization.

That additional context allows issuers to make more informed authentication decisions. Lower-risk interactions can remain frictionless, while higher-risk activity can be directed to additional verification when greater confidence is needed.

The opportunity, however, goes beyond the authentication decision itself. Signals generated during 3DS, including the ACS risk score and relevant reason codes or risk features, can provide valuable context for the fraud decisions that follow. 

For fraud teams, this shifts 3DS from a standalone authentication step to a more connected part of the overall card fraud journey.

Feedzai Transaction Fraud for Banking (TFB) helps financial institutions detect and prevent transaction fraud using real-time risk intelligence. Within TFB for Cards, Feedzai brings that intelligence across the card fraud journey, spanning both the Authentication and Authorization stages.

The Fraud Decision Is Bigger Than Authentication

The distinction between Authentication and Authorization is essential. Authentication asks, “Can I trust that this is the legitimate cardholder?” Authorization asks, “Can and should this payment be approved?” They are related decisions, but they are not the same decision.

When a customer makes an online purchase at a 3DS-enabled merchant, the 3DS ecosystem passes authentication data to the issuer’s Access Control Server (ACS). The ACS evaluates the authentication request and determines the appropriate path.

Feedzai sits alongside the issuer’s ACS as a real-time risk intelligence layer. The ACS sends relevant authentication data to Feedzai, where a dedicated 3DS Authentication workflow evaluates risk and returns a risk score and recommendation to help inform the authentication decision. The ACS remains responsible for the final authentication outcome.

For lower-risk activity, the customer may move through a frictionless flow with no additional interaction. If more confidence is needed, the ACS can require a challenge, such as app-based approval, a biometric check, or a one-time passcode. If authentication succeeds, the payment can then proceed to authorization.

When 3DS and Fraud Intelligence Operate in Silos

When Authentication and Authorization are assessed in isolation, valuable context can be lost between the two stages of the card journey. Fraud teams may know the outcome of an authorization without having the richer authentication signals that preceded it. In contrast, authentication decisions may be made without the broader customer and account context available across transactional and digital activity.

That separation can make it harder to identify patterns across the journey, tune friction appropriately, and build a more complete view of cardholder risk. Connecting intelligence across both decisions can make each stage more informed without turning Authentication and Authorization into a single decision.

Bringing 3DS Intelligence Into the Fraud Decision

With 3DS Authentication, Feedzai moves fraud intelligence upstream into the Authentication stage, enabling financial institutions to assess risk before the payment reaches Authorization.

Feedzai acts as a real-time risk intelligence layer for the issuer’s ACS. A dedicated 3DS Authentication capability evaluates the transaction data using rules, metrics, models, and historical context, returning a risk score and recommendation to help inform whether an interaction can remain frictionless or requires additional authentication. The ACS remains responsible for the final authentication outcome.

Within TFB for Cards, Authentication and Authorization remain distinct decisions, each with its own risk strategy and thresholds. The intelligence generated across both, however, can be connected, creating richer context around cardholder activity across the card journey.

Connecting Intelligence Across Authentication and Authorization 

3DS Authentication provides an opportunity to bring relevant fraud context into the Authentication decision before Authorization. Depending on the interaction, this can include transaction and merchant information, cardholder context, device and browser signals, IP information, and authentication history. While some of these signals may already be available elsewhere in the card journey, bringing them into the 3DS Authentication workflow helps build a more complete risk picture at the point of authentication.

Within TFB for Cards, that context does not have to end with the authentication decision. Authentication risk signals and outcomes can contribute to the wider cardholder risk picture, providing additional context alongside Cards Authorization activity. 

Consider a customer who abandons a 3DS Authentication, attempts authentication again, and then generates a high-value authorization shortly afterward. Each interaction is assessed independently, using the strategy and thresholds appropriate to that decision. Viewed together, however, they present a much richer risk story.

Connecting 3DS to broader context does not stop at cards. Feedzai’s TFB connects intelligence across other channels, such as digital banking. Consider a fraudster attempting a high-risk login to a victim’s online banking account. That intelligence from the digital channel can be shared with and influence the risk assessment of a subsequent 3DS card attempt.

Two different decisions combine to offer a new, richer view of risk. 

Authentication and Authorization retain their own distinct workflows, rules, and thresholds. What connects them is intelligence across the broader cardholder journey, including Authentication, Authorization, settlement, and subsequent cardholder disputes, helping TFB for Cards build a more complete view of cardholder risk over time. 

Why a Dedicated Workflow Matters

Authentication and Authorization serve as separate risk assessments. The criteria for requiring a cardholder to fulfill a challenge differ from the parameters used to decline a transaction.

Dedicated workflows matter because Authentication and Authorization answer different risk questions, even when some underlying data points are shared. A dedicated 3DS workflow lets fraud teams apply authentication-specific thresholds, rules, metrics, and models; meanwhile, Card Authorization retains its own strategy for assessing payment risk.

This keeps the two decisions independent while allowing relevant intelligence from Authentication to contribute to the broader cardholder risk context.

Turning Authentication Outcomes Into Fraud Intelligence

The value of 3DS intelligence does not end with the initial authentication assessment. When a challenge takes place, the outcome can be associated with the authentication event and become part of the wider risk context.

A pass, fail, abandonment, or timeout provides additional information about what happened when the cardholder was asked to verify their identity. These outcomes can provide context for subsequent interactions and fraud assessments.

The opportunity is not only to assess risk during the initial 3DS interaction. It is also to learn from what happens next.

Why a Connected Approach Matters for Fraud Teams

Connecting intelligence across Authentication and Authorization gives fraud teams more context across the card journey. These insights include:

• Earlier risk intelligence. Assess risk during authentication, before the payment reaches authorization.
• Smarter friction. Focus additional verification where the risk justifies it.
• Richer context. Use relevant authentication signals and outcomes to enrich the wider cardholder risk picture.
• Stronger fraud decisions. Surface patterns that may be harder to identify when Authentication and Authorization are viewed in isolation.

The Value of a More Connected Cards Journey

Bringing richer authentication intelligence into TFB for Cards creates value beyond the individual 3DS decision. By connecting context across Authentication and Authorization, financial institutions can:

• Strengthen fraud detection by building a more complete picture of cardholder activity across the card journey.
• Reduce unnecessary friction by using richer risk context to distinguish genuine customers from higher-risk interactions.
• Improve decision quality by reducing unnecessary disruption and false positives for legitimate cardholders.
• Improve operational efficiency by giving fraud teams richer, more connected context for fraud strategy and investigation.

Strengthen Card Fraud Prevention with Feedzai

With 3DS data enriching TFB for Cards, financial institutions can bring more context into the card journey, connecting intelligence across Authentication and Authorization to strengthen fraud detection while protecting the cardholder experience.

For issuers, this means better-informed risk decisions earlier in the payment journey, greater confidence in distinguishing legitimate customers from fraudsters, and less unnecessary friction for genuine cardholders. For fraud teams, connected intelligence provides richer context to investigate risk, adapt strategies and respond as fraud patterns evolve.

By bringing fraud intelligence into 3DS Authentication and connecting it with the wider card journey, Feedzai helps issuers strengthen fraud prevention without treating Authentication and Authorization as the same decision.

Additional Resources

• Blog: What We Feel the New Gartner® Hype Cycle™ Reports Signal About Fraud Prevention Trends
• Analyst Report: Chartis “Fraud Platforms, 2026” Vendor Spotlight
• Solution Brief: Transaction Fraud for Banks Prevents Card Fraud in Real Time
• Solution: Stop Transaction Fraud and Protect Honest Customers