3-D Secure 2.0: SCA и frictionless flow

3DS2 — обновлённый протокол аутентификации карточных платежей, обязательный по PSD2 SCA в EU.

Отличия от 3DS 1.0

3DS 1.0: popup с password. Bad UX, высокий cart abandonment. 3DS 2.0: 100+ data points → risk-based решение. Мобильные SDK для in-app. Biometric authentication. Frictionless flow для low-risk: без challenge для 80–90% транзакций.

Frictionless vs Challenge

Frictionless: issuer authorizes без interaction с cardholder. Основано на device, behavior, transaction history. Challenge flow: OTP, biometric, banking app confirmation. Selection: issuer's risk engine + acquirer's data.

SCA exemptions

Low-value: до €30. Recurring same amount. Trusted beneficiaries. Corporate cards. TRA (Transaction Risk Analysis): risk score → exemption. MIT (Merchant Initiated Transactions) для recurring. Ответственность за корректность применения на merchant/acquirer.

Liability shift

Успешный 3DS: chargeback fraud liability shifts от merchant к issuer. Financial impact: сокращение chargebacks 40–60%. Trade-off: небольшое падение conversion от frictionless. Best practice: 3DS2 для всех депозитов + exemptions для recurring.