Billions of rands in transactions lost as 3DS remains underutilised
Global card networks are increasing mandated data requirements for 3-D Secure (3DS) authentication to enhance payment security and reduce friction by providing banks with certain minimum data fields they need for informed authentication decisions.
Banking and payment authentication specialist, Entersekt, says this will benefit local merchants who continue to resist 3DS authentication, cutting themselves off from billions of rands in potential revenue as a result.
Mastercard is rolling out a new Essential Data Requirement mandate for its version of 3DS, called Identity Check. This came into effect on 1 April 2026. Visa has a similar mandate for Verified by Visa, which is coming into full compliance on 24 October 2026.
Both these mandates aim to improve 3DS authentication by feeding more reliable data signals into the risk engines at issuers.
Original intent fails to deliver
The original goal of 3DS version 2 (3DS 2.1) was for merchants to share richer contextual data about each transaction, allowing issuers to verify the cardholder silently in the background, reserving step-up challenges only for genuinely risky transactions.
3DS 2.2 is now widely used. However, Gerhard Oosthuizen, Chief Technology Officer at Entersekt, says many issuers are still hovering at authentication success rates of around 80%, adding that in many markets, most transactions are still challenged by default, with higher-than-expected failure rates.
“This is due to a chicken and egg situation. e-Commerce links thousands of merchants together with thousands of issuers, and each side must play well together to get the promised improvement. However, merchants have not really seen a benefit in sending the additional fields through to the issuer. Similarly, issuers have seen large inaccuracies in the data, with some fields set to hardcoded values. This means issuers have not been able to use the merchant signals to reduce friction, resulting in a stalemate that is ultimately hurting e-commerce and driving merchants to look for alternatives,” he says.
According to SABRIC, card-not-present (CNP) fraud contributed to 85.6% of gross fraud losses on locally issued credit cards. With fewer transactions benefiting from the added security offered by 3DS, local merchants are facing significant risk without the safety of the liability shift.
Step-up challenges significantly increase user friction and lead to cart abandonment. In fact, while the global cart abandonment rate is around 70%, South Africa’s is around 84%.
Stasis not sustainable
Oosthuizen says in response to this situation, global card networks have issued new mandates to allow issuers to confidently make authentication decisions. At the same time, the card associations are setting minimum standards for e-commerce outcomes. These will ensure issuers use the data to the benefit of cardholders, and raise their authentication success rates.
“The move will benefit both merchants and their consumers. Failed or abandoned transactions cause frustration to the cardholders, lost sales to merchants and lower card volume to issuers — all of which result in billions of rands being lost every year. Improving authentication outcomes benefits all the players, but collaboration is key and this is why Entersekt is engaging with all players in the ecosystem to help drive this change,” Oosthuizen explains.
South Africa still has a friction-filled mindset
In South Africa, 3DS is widely recognised by consumers as the pop-up window that appears during online checkout. Most understand that their bank is checking in to protect them, but growing numbers are frustrated by failed approvals and abandoned checkouts, especially with merchants they use regularly.
Oosthuizen argues that 3DS remains misunderstood and underutilised. “The default behaviour across much of the local payment ecosystem is still to challenge almost every transaction, with challenge rates sitting around 98 percent at some of our major banks,” he says. “This has entrenched the perception that 3-D Secure is, by nature, a clunky, intrusive step rather than a flexible framework that can support a genuinely seamless user experience”.
Oosthuizen says this misconception has led to many large merchants exploring how to bypass 3DS, rather than leveraging it to their benefit.
Fortunately, he says by optimising their integration, they can drop their challenge rates for regular customers, while still protecting themselves from fraud and chargebacks.
Oosthuizen says that merchants can start with two concrete steps to achieve this effect. The first is to run the 3DS data collection script (called MethodURL) before checkout. And the second is to send through the information they have about the customer.
The highway is built, it just needs to be driven
With all the 3DS 2 rails and standards in place, Oosthuizen says it is realistic to bring challenge rates down towards 50% or lower in many segments and to aim for around 90% transaction success rates, without compromising fraud.
“Early results of our work at a very large merchant show more than 60% of customers can now go through frictionlessly, with no reported surge in fraud. We believe that codifying these kinds of numbers as ‘what good looks like’ gives CISOs and product owners a concrete business case,” he says.
Looking ahead, Oosthuizen says merchants must understand that 3DS2 is no longer a blunt instrument that must always hurt conversion.
“Entersekt is engaging with large merchants, payment service providers and issuers to help create momentum and start changing our ecosystem. I’m confident we can make a dramatic change to the e-commerce experience in South Africa. We can and should do better,” he says.
