Step-Up Authentication

Step-up authentication, also called the challenge flow, is the 3DS2 / EMV 3-D Secure path triggered when the issuing bank's Risk-Based Authentication (RBA) engine cannot approve a transaction through Frictionless Authentication and requires the cardholder to actively verify their identity. In a step-up flow, the cardholder is presented with an authentication challenge, typically a one-time passcode sent to their phone, a biometric verification, or a push notification in their banking app, which they must complete before the transaction proceeds.

Step-up authentication is not a failure state, it is the appropriate response to genuinely higher-risk transactions or insufficient authentication data. When an issuer lacks enough contextual data to confidently approve a transaction silently, or when the transaction's risk profile exceeds their frictionless threshold, requesting additional verification is the correct and responsible decision. The step-up challenge confirms cardholder identity with a degree of assurance that passive data analysis alone cannot provide.

The mechanics of step-up in 3DS2 are considerably more consumer-friendly than the password-based challenges of 3DS1. Modern challenge flows use push notifications that redirect cardholders to their banking app for a biometric confirmation, one-tap approvals, and other low-friction interactions. EMV 3DS v2.3 introduced Out-of-Band (OOB) automation that streamlines the transition between merchant and banking app, further reducing challenge abandonment rates.

From a merchant's perspective, the goal is not to eliminate step-up authentication entirely but to minimize it on low-risk transactions where it adds friction without meaningful security value. This is achieved through high-quality 3DS2 data submission, Exemption Management for eligible transactions, and Risk-Based Authentication calibration at the merchant level.