Smart 3DS routing
ACS outages and issuer latency can stall authentication before authorisation begins. Cardflo supports 3DS routing orchestration for multi-acquirer merchants, using endpoint availability and response times to switch authentication traffic to a responsive acquirer partner.
- Category
- Security
- Capabilities
- 10
- Available on
- All plans
Cardflo manages routing for your EMV 3D Secure traffic, directing requests to the most appropriate acquirer. Rules are configurable per transaction on an array of fields, ensuring frictionless authentication can be deployed alongside step-up challenges only where required for regulatory or risk mitigation purposes.
Merchants can ensure each transaction is routed to the solution which can best handle authentication attempts, meeting obligations under Strong Customer Authentication. Cardflo helps you control delegated authentication and manage exemptions, such as those related to low-value transactions or transactions identified as low-risk via Transaction Risk Analysis.
PCI scope is minimised through hosted fields and network tokens, and sensitive credentials never touch your servers. Strong Customer Authentication is applied intelligently to keep both regulators and conversion teams happy.
Smart 3DS routing overview
Cardflo's Smart 3DS routing optimises how transactions are authenticated, ensuring compliance with payment regulations like PSD2's Strong Customer Authentication (SCA) requirements while minimising unnecessary friction for genuine customers. The platform intelligently assesses each transaction against a pre-defined set of rules, determining the optimal 3D Secure flow.
This approach balances the need for robust security with a smooth customer experience, allowing businesses to adapt to diverse market demands and regulatory landscapes efficiently.
Our system processes incoming authentication requests and applies a sophisticated rules engine to decide the appropriate 3D Secure action. This might involve initiating a frictionless flow, where authentication occurs without customer interaction, or triggering a step-up challenge when higher risk is detected or regulatory mandates require it.
Cardflo supports various authentication protocols, including 3DS2, ensuring compatibility across different card schemes and issuer systems. The configuration allows granular control over parameters such as transaction value, merchant category code, and geographical location.
Cardflo facilitates delegated authentication, where control over the authentication decision is shifted to the merchant, and can manage PSD2 exemptions. Exemptions for low-value transactions (under €30) and those identified as low-risk through Transaction Risk Analysis (TRA) are applied automatically where conditions are met.
This capability reduces the instances of step-up challenges, improving conversion rates while still adhering to regulatory stipulations. Merchants maintain flexibility in configuring TRA thresholds and exemption application based on their specific risk appetite.
How smart 3DS routing works
Ingress of Authentication Request
A payment initiation request from the merchant includes specific 3DS parameters. These parameters can include cardholder data, transaction value, merchant details, and device information. Cardflo's system receives this comprehensive dataset, preparing it for rule-based evaluation. The initial request determines the potential for either a frictionless or challenge flow.
Rule-Based Decision Engine
Cardflo applies a predefined set of merchant-configured rules to the incoming data. These rules evaluate attributes such as the transaction amount against TRA thresholds, issuer location, and merchant category code. The decision engine determines if the transaction qualifies for a PSD2 exemption, a frictionless flow, or requires a step-up challenge, or can proceed with delegated authentication. Each rule is prioritised to prevent conflicts.
Dynamic Routing to 3DS Server
Based on the rule engine's output, the request is routed to the most appropriate 3D Secure server or acquirer. If a delegated authentication is configured, the system routes the request accordingly. For SCA-required transactions, the system communicates with the relevant 3DS server to either complete a frictionless flow or initiate the challenge process. Routing considers acquirer capabilities and scheme requirements.
Authentication Outcome Processing
The 3DS server returns the authentication result to Cardflo, indicating whether the transaction was authenticated, challenged, or declined, including specific ECI (Electronic Commerce Indicator) values. Cardflo logs this outcome and relays it back to the merchant, along with any relevant authentication data. This closed-loop process ensures the merchant has full visibility of the authentication journey for each transaction.
Why smart 3DS routing matters
Precise Control Over Authentication Flows
Smart 3DS routing allows merchants to define exact conditions for frictionless authentication versus step-up challenges. This granular control is vital for balancing fraud prevention with customer convenience. By applying rules based on transaction value, risk scores, and geographical data, businesses can ensure only necessary challenges are presented, minimising abandonment rates while maintaining regulatory compliance. Adjusting TRA thresholds permits dynamic risk management tailored to evolving threat landscapes.
Optimised Regulatory Compliance
Adhering to Strong Customer Authentication (SCA) requirements under PSD2 is critical. Cardflo’s routing system automates the application of exemptions, such as for low-value transactions or those with Transaction Risk Analysis (TRA) scores below a specified threshold. This automation ensures compliance without manual intervention, reducing the operational burden and the risk of non-compliance fines. It also provides mechanisms for managing delegated authentication, where permitted by scheme rules, ensuring a compliant and efficient process.
Smart 3DS routing use cases
Ticketing traffic across acquirer partners
Stadium operators face concentrated card traffic when reserved seats go on sale, and an acquirer partner’s ACS path can slow or time out while inventory remains temporarily held. Cardflo monitors authentication response health and routes new 3DS requests through another acquirer partner without changing the operator’s ticket allocation workflow.
Issuer specific ACS failover
Multi-acquirer merchants can encounter an ACS outage affecting cards from a particular issuer range while other authentication routes remain available. Cardflo analyses timeout and error patterns by BIN and acquirer path, then switches subsequent 3DS authentication traffic to a responsive acquirer partner while retaining the transaction reference and authentication result.
Authentication before acquirer selection
Payment orchestrators may need to complete 3DS authentication before commercial routing rules select the acquirer partner that will receive the authorisation. Cardflo supports auth-only routing, retains the resulting cryptogram and electronic commerce indicators, and passes the authenticated payment data into the merchant’s separate authorisation routing workflow.
Regional acquirer maintenance windows
Merchants operating several regional MIDs may face planned acquirer maintenance that leaves a configured 3DS endpoint unavailable while checkout traffic continues. Cardflo applies scheduled routing rules and live endpoint checks to direct authentication requests through an available acquirer partner, then restores the preferred path after service health is confirmed.
Smart 3DS routing by the numbers
This range reflects typical industry improvements when moving from a static 3DS implementation to a dynamic routing model that accounts for issuer-specific technical preferences.
Merchants often observe this reduction in soft declines as smart routing ensures that transactions requiring SCA are correctly identified and authenticated before being sent for authorisation.
This represents the industry standard for transactions that can be authenticated without a manual challenge when sufficient data is passed through the most compatible 3DS2 pathway.
Methodology: these figures are illustrative ranges drawn from published industry data and observed merchant cohorts, not guarantees. Actual results depend on your risk profile, card mix, geography and acquiring setup, and are confirmed only in your own pricing and approval terms.
Related terms
Talk to our team about a live rollout across our acquirer partners' rails.
What you get with Smart 3DS routing
- Configure bespoke rules for frictionless 3DS authentication based on transaction attributes.
- Define thresholds for triggering step-up challenges aligned with your risk appetite.
- Manage delegated authentication requests, specifying which acquirer processes them.
- Automate the application of PSD2 Low Value Exemption for eligible transactions under €30.
- Implement Transaction Risk Analysis (TRA) exemptions, adjusting thresholds as needed.
- Route 3DS traffic to specific acquirer partners based on scheme and geography.
- Utilise detailed 3DS request data fields for granular rule-based decision making.
- Configure rules for domestic versus cross-border authentication challenge behaviour.
- Ensure compliance with Strong Customer Authentication across all payment channels.
- Monitor authentication success rates per acquirer and scheme to refine routing rules.
A short scoping call, then a written plan for your MIDs.
Questions about Smart 3DS routing
How does smart 3DS routing impact the checkout latency for the end user?
The routing decision typically occurs in milliseconds, as the logic is processed server-side before the 3DS challenge is initiated.
By selecting the provider with the lowest current latency and the highest success rate for a specific BIN, smart routing can actually reduce the total time a customer spends in the authentication phase.
It avoids the delays associated with directing traffic to unresponsive or slow Access Control Servers, which are often the primary cause of checkout lag during the 3DS handshake.
Can smart routing help in bypassing 3DS for certain low-risk transactions?
Smart routing logic evaluates transaction data against SCA exemption criteria defined under PSD2.
If a transaction is eligible for an exemption, such as being below 30 Euros or falling under a low-risk category through Transaction Risk Analysis (TRA), the system can request an exemption from the acquirer.
However, the final decision to honour the exemption remains with the issuer. Smart routing maximises the chance of approval by only requesting exemptions when the issuer is known to support them.
What happens if a 3DS provider goes offline or experiences a service outage?
In a smart routing configuration, the system monitors the health of connected 3DS providers. If a specific provider or directory server fails to respond, the engine automatically redirects the authentication request to an alternative secondary provider.
This redundancy is critical for maintaining high availability, as 3DS outages can otherwise lead to a total inability to process payments for merchants required to perform SCA.
Does using smart 3DS routing affect the merchant's liability for chargebacks?
Liability shift is generally tied to the successful completion of the 3DS process, regardless of the routing path taken.
By ensuring the 3DS challenge is handled by the most compatible and updated protocol for the issuer, smart routing increases the likelihood of achieving a 'successful authentication' status.
This status provides the merchant with a defence against fraudulent transaction disputes, as the liability shifts to the issuer once the multi-factor authentication is confirmed.
How does the system distinguish between 3DS1 and 3DS2 during the routing process?
The routing engine queries the issuer's capabilities during the initial phase of the transaction. While 3DS1 is largely deprecated, some regions or niche card types may still require it.
Smart routing prioritises 3DS2 for its better user experience and data-sharing capabilities, but it can maintain the logic to fall back to 3DS1 if it is the only method supported by the issuer to avoid an outright decline.
Is smart 3DS routing necessary if my acquirer already handles 3DS?
While many acquirers offer basic 3DS services, they often use a single internal provider. Smart 3DS routing adds a layer of orchestration that allows for multiple providers and more complex logic across different acquirers.
This is particularly valuable for merchants using a multi-acquirer strategy, as it centralises authentication data and allows for consistent performance optimisation that is not tied to a single bank's infrastructure.
Related features.
Related guides.
See how Cardflo compares.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.