The Authentication Challenge

Key Takeaways

• Cross‑border CNP fraud in Australia accounts for 51% of losses
• EMV 3DS 2.x protocol identical; issuer economics drive outcomes
• Issuers choose between fraud, conversion, or compliance cost absorption
• ACS vendor selection locks in issuer’s fraud‑vs‑conversion stance
• No industry metric tracks false‑challenge impact on genuine shoppers

Pulse Analysis

Authentication is no longer a pure technical step; it is a strategic lever where issuers decide which cost to internalize. The EMV 3DS 2.x message set is uniform, but each issuer configures its Access Control Server (ACS) to favor fraud tolerance, conversion preservation, or regulatory compliance. Those choices dictate exemption thresholds, challenge frequencies, and ultimately the balance between lost revenue from fraud and abandoned carts. Because the ACS contract is often negotiated by procurement rather than the cards‑P&L owner, the chosen vendor embeds a long‑term posture that ripples through fraud‑risk models and conversion KPIs.

Regional regulatory frameworks cement these divergent postures. The United States, lacking a Strong Customer Authentication mandate, lets issuers absorb fraud, resulting in a CNP loss estimate of roughly $10 billion in 2024. Europe’s PSD2 SCA forces conversion absorption, with the European Banking Authority reporting €1.329 billion (≈$1.46 billion) in fraud losses in 2024 and a TRA exemption ladder that caps fraud rates at $110, $275, and $550 per transaction. Latin America moves toward regulator‑mandated device authentication, while APAC is phasing out SMS OTP in favor of in‑app or biometric checks. These differing equilibria explain why the same 3DS flow can yield a fraud rate ten times higher when the transaction crosses a regulatory border.

The fragmentation creates a lucrative niche for Visa and Mastercard, whose stand‑in ACS services and value‑added fraud tools generated $3.4 billion in net revenue in Q3 2025. Yet the industry lacks a standard metric for the "false‑challenge rate," the hidden cost of legitimate shoppers who abandon a purchase after an unnecessary prompt. Without this data, issuers optimize for chargeback reduction at the expense of conversion, and networks profit from the resulting heterogeneity. Introducing a transparent measurement framework would enable issuers to balance fraud and conversion more precisely, potentially reshaping vendor contracts and regulatory expectations across the global payments ecosystem.