Feedzai Connects 3DS Authentication With Broader Fraud Intelligence
Feedzai has launched an API for 3DS Authentication decisions that connects authentication risk intelligence with fraud decisioning across the card payment journey. The company says the approach can help issuers balance stronger fraud detection with less unnecessary checkout friction.
- Feedzai launched an API for 3DS Authentication decisions.
- The API returns a real-time risk score and recommendation to the issuer's ACS.
- Authentication and Authorization remain separate decisions with different thresholds.
- 3DS signals can contribute to the wider cardholder risk picture.
- TFB can connect intelligence across cards and digital banking.
3DS becomes part of a wider fraud picture
Card-not-present fraud continues to grow. UK Finance reported 3.2 million remote purchase fraud cases in 2025, up 13% year on year, with losses reaching £423.5 million.
Feedzai says 3-D Secure, or 3DS, has evolved from a primary cardholder verification mechanism into a source of risk context. A 3DS interaction can provide information about the transaction, merchant, cardholder, device, browser and previous authentication activity before a payment reaches authorization.
That information can support a more tailored response. Lower-risk activity may remain in a frictionless flow, while higher-risk activity can be directed to additional verification when more confidence is needed.
Authentication and authorization remain separate
Feedzai distinguishes between two questions in the card payment process. Authentication asks whether the person is the legitimate cardholder. Authorization asks whether a payment can and should be approved.
Under the new setup, Feedzai sits alongside an issuer's Access Control Server, or ACS, as a real-time risk intelligence layer. The ACS sends relevant authentication data to a dedicated 3DS Authentication workflow, which evaluates the information using rules, metrics, models and historical context. It then returns a risk score and recommendation to help inform the authentication decision.
The ACS remains responsible for the final authentication outcome. Depending on the risk, the customer may proceed without additional interaction or may be asked to complete a challenge, such as app-based approval, a biometric check or a one-time passcode. If authentication succeeds, the payment can proceed to authorization.
Connected signals can give fraud teams more context
Feedzai says keeping authentication and authorization in silos can cause valuable context to be lost. Fraud teams may see an authorization outcome without the authentication signals that preceded it, while authentication decisions may lack broader customer and account information from transactional and digital activity.
Its Transaction Fraud for Banking, or TFB, brings intelligence across the card fraud journey, spanning Authentication and Authorization. Relevant context can include transaction and merchant information, cardholder details, device and browser signals, IP information and authentication history.
The company gives an example in which a customer abandons a 3DS Authentication, tries again and then generates a high-value authorization shortly afterward. Each event remains subject to its own workflow and threshold, but the combined signals can provide a richer risk picture. Feedzai also says intelligence from channels such as digital banking can influence the assessment of a subsequent 3DS card attempt.
For issuers and fraud teams, the change is therefore about connecting intelligence rather than merging decisions. Authentication and Authorization keep their own rules, models and thresholds, while information from the wider cardholder journey can contribute to a more complete view of risk over time.
