---
title: "Dynamic 3D Secure"
description: "Set up rules to determine which card payments are routed through 3D Secure authentication, and if they should be challenged."
url: "https://docs.adyen.com/risk-management/dynamic-3d-secure"
source_url: "https://docs.adyen.com/risk-management/dynamic-3d-secure.md"
canonical: "https://docs.adyen.com/risk-management/dynamic-3d-secure"
last_modified: "2023-03-08T13:44:00+01:00"
language: "en"
---

# Dynamic 3D Secure

Set up rules to determine which card payments are routed through 3D Secure authentication, and if they should be challenged.

[View source](/risk-management/dynamic-3d-secure.md)

When you support [3D Secure 2](/online-payments/3d-secure) in your website or mobile app, and send in a payment request, 3D Secure authentication can be triggered for the transaction. You can use the [default 3D Secure rule](#default-rules) and [Dynamic 3D Secure](#configuring-dynamic-3d-secure-rules) rules to make sure 3D Secure is requested and, in special cases, to request a 3D Secure challenge.

## Requirements

Before you begin, take into account the following requirements and limitations.

| Requirement                                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Integration type**                                 | Make sure that you have built an [online payments integration](/online-payments/build-your-integration/), and that you have implemented [3D Secure 2](/online-payments/3d-secure/).                                                                                                                                                                                                                                                                                       |
| **[Customer Area roles](/account/user-roles/#risk)** | To add or change [Dynamic 3D Secure rules](#configuring-dynamic-3d-secure-rules), make sure that you have one of the following role(s):- **Merchant change risk settings**
- **Management Dynamic 3D Secure Rules**                                                                                                                                                                                                                                                       |
| **Limitations**                                      | To use Dynamic 3D Secure in combination with risk management, [risk must be enabled](/risk-management/configure-risk-settings/). Protect [premium features](/risk-management/configure-risk-settings/#risk-general) must be enabled to:- Use [risk-based authentication](#risk-based-authentication).
- Create custom rules to link to [Dynamic 3D Secure rules](#configuring-dynamic-3d-secure-rules).                                                                   |
| **Setup steps**                                      | Implement [3D Secure 2](/online-payments/3d-secure/). Then:- To use Dynamic 3D Secure:

  * [Configure the default 3D Secure rule](/risk-management/dynamic-3d-secure#default-rules) to specify your overall preferences.
  * Configure [Dynamic 3D Secure rules](#configuring-dynamic-3d-secure-rules) to create rules with more specific conditions.

- To override any Dynamic 3D Secure rules:
  * Specify parameters in the [payment request](#3ds-payment-request). |

## How Dynamic 3D Secure works

To ensure that you stay compliant, we always authenticate transactions with 3D Secure if this is required by regulations such as [PSD2](/online-payments/psd2-sca-compliance-and-implementation-guide) or other market specific regulations. To mitigate any effects on conversion, we do not trigger 3D Secure for out-of-scope transactions, or when the issuing bank does not enforce 3D Secure. For transactions within the scope of PSD2, we also handle requesting [exemptions](/online-payments/psd2-sca-compliance-and-implementation-guide/sca-exemptions).

You can use Dynamic 3D Secure to make sure 3D Secure is requested and, in special cases, to request a 3D Secure challenge. You can do this even if 3D Secure is not required by regulations or the issuer. This can be useful, for example, to make sure a liability shift takes place or to add more friction for high-risk transactions.

You can specify your 3D Secure preferences using Dynamic 3D Secure as follows:

* Use the [default rule](/risk-management/dynamic-3d-secure#default-rules) as the setting to indicate your general preference to request 3D Secure. You can set this to **Prefer not** or **Always**. When set to **Prefer not**, Adyen can still decide to send the payment through 3D Secure because the issuer requires it, to ensure compliance with regulations, or to improve conversion. When set to **Always**, we will always request 3D Secure on your behalf.
* Create more specific [Dynamic 3D Secure rules](/risk-management/dynamic-3d-secure#configuring-dynamic-3d-secure-rules). You can set conditions to determine for which payments to [request 3D Secure authentication](#request-3ds), and if you prefer to request a [3D Secure challenge](#request-3ds-challenge).

Alternatively, you can include [parameters in your payment request](#3ds-payment-request) to specify when a transaction should go through 3D Secure 2. And, when you use Protect premium, you can also benefit from [risk-based authentication](#risk-based-authentication). Risk-based authentication sends transactions that would have been blocked by the machine learning fraud risk rule to 3D Secure 2.

## Default 3D Secure rule

When you create a new [company account](/account/account-structure#company-account) or [merchant account](/account/account-structure#merchant-accounts), the default rule is set to **Prefer not**.\
Choose from the following possible settings:

* **Always**: Use 3D Secure whenever possible. With this rule, there will still be transactions that do not go through 3D Secure authentication, for example, when the issuer doesn't support 3D Secure yet, or when the card isn't enrolled.
* **Prefer not**: Do not apply 3D Secure authentication unless it is required by regulation or the issuer, or if it can help optimize performance.

## Dynamic 3D Secure rules

When you [configure a Dynamic 3D Secure rule](#configure-a-dynamic-3d-secure-rule), you first specify the conditions to trigger the rule, and then you determine what happens when it triggers. When the rule triggers, you can specify what you want to do: [request 3D Secure](#request-3ds) and [request a challenge](#request-3ds-challenge).

#### Request 3D Secure

When you proactively request 3D Secure, you add an extra authentication layer to the payment flow. The transaction either goes through the [challenge flow](/online-payments/3d-secure#challenge-flow) or the [frictionless flow](/online-payments/3d-secure#authentication-flows) depending on the issuer.

This can reduce the risk of fraud because a transaction with a successful 3D Secure authentication will result in a liability shift. This way, you can use Dynamic 3D Secure rules to mitigate the risk for certain transactions.

It is important to understand that there is a trade-off. By requesting 3D Secure, you add friction. This friction impacts conversion because some shoppers might drop off. However, at the same time, if the authentication is successful, you reduce fraud and obtain a liability shift.

#### Request a challenge

You can set your preference to present a challenge even if the frictionless flow is available. Both a successful [challenge flow](/online-payments/3d-secure#challenge-flow) and a successful [frictionless flow](/online-payments/3d-secure#authentication-flows) result in a liability shift. By default, to optimize conversion, a transaction will use the frictionless flow if it is available.

Requesting a challenge is a way to add more friction because it requires additional shopper interaction. We recommend that you only set your preference to always request a 3D Secure challenge in special circumstances. This because the challenge adds significant friction and could lead to a higher shopper drop-off rate. Use it, for example, when you are experiencing extremely high fraud rates and requesting 3D Secure alone does not help.

### Configure a Dynamic 3D Secure rule

There are few things to keep in mind when configuring Dynamic 3D Secure rules:

* Rules are evaluated in order, from first to last.
* If a rule is triggered, the remaining rules are not evaluated.
* You can configure rules on the company account, or on a merchant account. Rules configured on the merchant account have priority and only affect payments for that specific merchant account.
* Wherever possible, create several simple rules instead of combining many logic points into a single rule.
* Consider each separate condition that you specify within the rule as an AND statement. The rule will trigger if both conditions are met. However, when you select multiple values within a condition, the rule will trigger when any of these values are true.

To configure a rule, in your [Customer Area](https://ca-test.adyen.com/):

1. Go to **Revenue & risk** > **Dynamic 3D Secure**.

2. Select **Create new rule** to make a new rule or select the name of the rule if you want to modify an existing rule.

3. Configure the criteria shown in the following table.

   You can combine criteria to create nested rules. For example, you may decide to use 3D Secure for every transaction where the issuing card is from Mexico and the transaction value is above USD 100.

   | Criteria          | Description                                                                                                                                                                                                                                                                                                                           |
   | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Issuer country    | The country where the card was issued.                                                                                                                                                                                                                                                                                                |
   | Shopper country   | The country of the shopper, based on the IP address submitted with the payment.                                                                                                                                                                                                                                                       |
   | Payment method    | The card type (for example, American Express, Visa Platinum, etc. For more information, see [PaymentMethodVariant](/development-resources/paymentmethodvariant)).                                                                                                                                                                     |
   | Device type       | The type of device that submitted the transaction. You can indicate mobile, desktop, or tablet devices.The transaction must have device data submitted with it for this feature to work.                                                                                                                                              |
   | Amount            | The transaction value. When you configure this for a specific currency, the rule will automatically convert to other currencies. For example, a EUR 20 rule will automatically trigger for the equivalent amount in GBP.                                                                                                              |
   | Risk score        | Do not use this condition, it does not apply to Protect. The risk score condition was used in the classic risk engine to target transactions for 3D Secure when they met a certain risk score threshold.                                                                                                                              |
   | BIN and BIN Range | The first six digits on a credit card. This identifies the Issuing bank of the card. For more information, read [Bank Identification Number (BIN)](/get-started-with-adyen/adyen-glossary/#bank-identification-number-bin). You can target a set or range of BINs, to use 3D Secure only for transactions from certain issuing banks. |
   | Risk check        | The pre-authorization [custom risk rule](/risk-management/configure-your-risk-profile/custom-rules/#create-a-custom-rule) with the **Check for 3DS** action that you want to use to trigger 3D Secure.                                                                                                                                |

4. For each condition met, assign actions to request 3D Secure authentication, and your preference to present a challenge:

   * **Request 3DS**: If the condition is met, choose to apply any of the [default 3D Secure rules](#default-rules) (**Prefer not** or **Always**).

   * **Request challenge**: If you set up a rule where **Request 3DS** is set to **Always**, you also have the option to set your preference to request a challenge (**Prefer not** or **Always**).

     Setting request challenge to **Always** adds [friction and can impact conversion negatively](#request-3ds-challenge). We recommend to use this in special circumstances only.

5. When you have created your rule, add a name for the rule and select **Save**. If you have updated an existing rule, also select **Save**.

6. Rules are applied in the order they appear in the list. To set your preferences, move the most important rule to the top of the list, and order the rest of the rules in the order that you want them to be applied in and select **Save**.

## Example scenarios

The following scenarios are some fictional examples to illustrate how you could set up Dynamic 3D Secure rules. You can create your own rules that follow your specific business needs and logic.

### Scenario 1

You are planning on expanding your business in Canada. You have previously used 3D Secure in the UK (where conversion rates are high), and you want to avoid using 3D Secure in Canada. All your traffic is from the UK and Canada.

Rules you should set up:

1. [Dynamic 3D Secure rule](#configuring-dynamic-3d-secure-rules): When the issuer country is **Canada**, then **Prefer not** to request 3D Secure.
2. [Default 3D Secure rule](#default-rules): **Always** request 3D Secure for all other transactions.

Only a **Prefer not** rule is needed since the default action is for transactions to use 3D Secure. With this setup, all UK transactions will use 3D Secure.

### Scenario 2

You are experiencing significant fraud in transactions above USD 200 in the US. You want an extra layer of authentication for these payments and a liability shift.

Rules you should set up:

1. [Dynamic 3D Secure rule](#configuring-dynamic-3d-secure-rules): When the amount is **greater than USD 200** AND the issuer country is **United States**, then **Always** request 3D Secure and **Prefer not** to request challenge.
2. [Default 3D Secure rule](#default-rules): **Prefer not** to request 3D Secure authentication for all other transactions.

### Scenario 3

After you have implemented the rule mentioned in scenario 2, you are still experiencing significant fraud in transactions above USD 200 in the US.

One of the card schemes reached out to you that the number of Notifications of Fraud is becoming too high. As an emergency measure, you want to make sure that you always trigger a 3D Secure challenge to increase friction.

Rules you should set up:

1. [Dynamic 3D Secure rule](#configuring-dynamic-3d-secure-rules): When the amount is **greater than USD 200** AND the issuer country is **United States**, then **Always** request 3D Secure and **Always** request challenge.

   Setting request challenge to **Always** adds [friction and can impact conversion negatively](#request-3ds-challenge). We recommend to use this in special circumstances only.

2. [Default 3D Secure rule](#default-rules): **Prefer not** to request 3D Secure authentication for all other transactions.

## Override using the payment request

Instead of using Dynamic 3D Secure, you can include parameters in your payment request directly to influence when to use 3D Secure, and if it is, if the shopper should be challenged.

Parameters sent in the payment request override any Dynamic 3D Secure rules that you have configured.

Include the following fields in the payment request to:

* Request 3D Secure authentication: [authenticationData.attemptAuthentication](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-authenticationData-attemptAuthentication).\
  For Checkout API v68 and earlier, use [executeThreeD](https://docs.adyen.com/api-explorer/Checkout/68/post/payments#request-additionalData-AdditionalData3DSecure-executeThreeD).
* Present a challenge: [threeDS2RequestData.threeDSRequestorChallengeInd](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-threeDS2RequestData-threeDSRequestorChallengeInd). This parameter will only be used if 3D Secure is requested.\
  For Checkout API v67 or earlier, use [threeDS2RequestData.challengeIndicator](https://docs.adyen.com/api-explorer/Checkout/67/post/payments#request-threeDS2RequestData-challengeIndicator).

## Risk-based authentication

Risk-based authentication for [Protect premium](/risk-management/configure-your-risk-profile/#new-profile-risk-rules) complements the machine learning evaluation. You can save more transactions by sending them to 3D Secure and, as a result, further increase your conversion rate. Risk-based authentication increases authentication costs, but leads to more settled transactions and more revenue.

Risk-based authentication sends transactions that would have been blocked by the machine learning fraud risk rule to 3D Secure 2. This way, legitimate transactions can be saved, and fraudsters can be stopped when they fail to authenticate.

When the authentication is successful, the transaction is authorized, and there is a liability shift. When the 3D Secure challenge fails, the transaction stays blocked. If 3D Secure is not available, you will not be charged an authentication fee, and Protect reverts the transaction to a decline.

You can view the impact of risk-based authentication in the [risk profile analytics](/risk-management/configure-your-risk-profile#view-risk-profile-analytics) section. You can enable or disable risk-based authentication in the [risk settings](/risk-management/configure-risk-settings).

When you open the [risk results](/risk-management/configure-your-risk-profile#new-profile-results) page for a transaction, you can identify if it went through risk-based authentication.

## See also

* [3D Secure integration guides](/online-payments/3d-secure)
* [PSD2 SCA compliance and implementation guide](/online-payments/psd2-sca-compliance-and-implementation-guide)
* [3D Secure for regulation compliance](/online-payments/3d-secure-for-regulation-compliance)
