Most Merchants Have 3DS2 Turned On. Few Have It Configured Right.

Practical questions to ask your processor to find out where you actually stand

Having 3DS2 turned on and having it configured well are two very different things. The gap between a well-implemented setup and a poorly-implemented one can run 5-15 percentage points of approval rate on the same volume. Here's how to find out which side of that gap your business is on.

Send Every Data Element You Can

Your frictionless authentication rate lives and dies on data completeness: device fingerprint, billing and shipping address match, account history, and prior order history all feed into the issuer's risk decision. Skipping fields to simplify integration is the most common way merchants quietly sabotage their own approval rate without realizing it.

Ask Whether You're Defaulted Into Every Challenge

Some integrations are configured to challenge every single transaction "to be safe," which defeats much of the purpose of upgrading to 3DS2 in the first place. Ask your processor directly whether your setup is running true risk-based authentication, or simply defaulting to a challenge screen for everyone regardless of actual risk level.

 

Ask Who Owns The Exemption Strategy

Depending on your processor and gateway, exemptions for low-value transactions or trusted recurring billing can route certain payments around a challenge screen entirely. Ask specifically whether your integration is requesting these exemptions on your behalf, or whether that option has simply never been configured.

 

Review Your Frictionless Rate Like A KPI

Ask your processor to show you the actual frictionless-versus-challenge breakdown on your account. 80%+ frictionless is the practical benchmark for a well-configured setup. If your numbers are meaningfully below that, something in your data submission or configuration needs attention.

The Takeaway

Where is your own checkout quietly losing approval rate right now? Most merchants can't answer that with confidence, simply because no one has asked their processor to show the actual numbers. These four questions are a direct way to find out, rather than assuming the setup is fine because it's technically turned on.