Skip to main content
The system provides flexible 3-D Secure integration options that let you choose the approach best suited for your use case. Each method handles Strong Customer Authentication (SCA) with varying levels of control and customization. Most integrations automatically handle the device fingerprinting, card enrollment checks, authentication, challenge, and other 3DS nuances. Additionally, the system supports Dynamic 3-D Secure, allowing you to dynamically skip or force 3-D Secure based on anti-fraud decisions, cart items, or any other transaction-level data. The flexible solution offers the following 3-D Secure integration methods.
  • Embed automatically detects 3-D Secure for a transaction and handles all the user interactions to complete the transaction.
  • Hosted 3DS offers 3-D Secure via the API, allowing capture of card data that then relies on the hosted 3-D Secure to handle the user interaction. This can also be used in combination with Secure Fields.
  • Native 3DS provides a fully customizable 3-D Secure experience built directly into your app. Available for web (Secure Fields), iOS (Swift), and Android (Kotlin). Requires merchant account-level 3DS configuration.
  • External 3-D Secure data can be passed in to create a card checkout experience including a custom 3-D Secure integration.
Whichever method you use, the authentication result follows the same set of values. See Authentication results for the full reference.

​
Issuer-mandated 3-D Secure

This feature is available in most environments, but not all. Contact the support team to confirm availability for your account.
Some card issuers require Strong Customer Authentication (SCA) on every transaction, regardless of your own 3-D Secure preferences. This is common for issuers in the European Economic Area (EEA) and the United Kingdom under the Second Payment Services Directive (PSD2). Some issuers in other regions apply equivalent mandates. To reduce authorization declines on these cards, Gr4vy identifies issuers with a known authentication mandate using bank identification number (BIN) data. When the issuer requires authentication, Gr4vy runs 3-D Secure even if a Flow rule would otherwise skip it. The behavior depends on the transaction’s resolved 3-D Secure outcome.
  • No rule matches, or no 3-D Secure rule is configured. Gr4vy attempts 3-D Secure. This is unchanged from the standard behavior.
  • A rule skips 3-D Secure. For an issuer with a known mandate, Gr4vy overrides the rule and attempts 3-D Secure instead. Cards without a known mandate continue to skip.
  • A rule forces 3-D Secure. Gr4vy forces 3-D Secure for all cards. This is unchanged.
When the issuer’s authentication requirement can’t be determined — for example, the BIN isn’t present in the dataset — Gr4vy treats the card as having no mandate and follows your configured behavior. Issuer mandates never override a connection with 3-D Secure turned off: in that case Gr4vy doesn’t run 3-D Secure, even for a mandated issuer. An overridden skip rule is still recorded as having matched, so Authentication Insights continue to reflect the rule that applied.