Dynamic 3DS (3-D Secure) is a setup in which a merchant or its payment provider decides per transaction whether to send a card payment through 3-D Secure authentication, request an exemption or go straight to authorisation, based on real-time risk and regulatory rules. A risk engine scores order value, card country, device history, IP location and past disputes, then maps the score to a challenge, a frictionless attempt or an exemption request. In Europe, PSD2 exemptions such as low-value payments and transaction risk analysis set the limits. Authenticated payments generally move fraud chargeback liability to the issuer, while approved exemptions leave it with the merchant in exchange for fewer abandoned checkouts.
How does dynamic 3DS work
A risk engine scores each payment using signals such as order value, card country, device history, IP location, account age and past disputes. Rules then map the score to an action. A typical configuration routes high-risk orders to 3DS with a challenge preference, sends medium-risk orders to 3DS and lets the issuer decide on the frictionless flow, and sends low-risk orders with an exemption request.
Outside the European Economic Area and UK, where authentication is not mandated, dynamic 3DS is mainly a fraud tool: a merchant may run 3DS only on first orders above a set value or on cards from high-fraud regions, and skip it everywhere else.
Dynamic 3DS under PSD2 strong customer authentication
In Europe the rules engine has to respect PSD2. Commission Delegated Regulation (EU) 2018/389 lets a payment skip strong customer authentication under defined exemptions. The low-value exemption covers remote payments of €30 or less, until cumulative spend since the last authentication passes €100 or five consecutive payments have been made.
The transaction risk analysis (TRA) exemption depends on the provider's own fraud rate for remote card payments. A provider at or below 0.13% can exempt payments up to €100, at or below 0.06% up to €250, and at or below 0.01% up to €500. Real-time analysis must also find no abnormal spending pattern, unusual device, malware, known fraud scenario or abnormal location. A dynamic 3DS engine therefore needs to know which TRA band the acquirer currently qualifies for.
The liability trade-off
When a payment is fully authenticated, fraud chargeback liability generally moves to the issuer. When an exemption is requested and approved, that shift does not apply, so the merchant keeps the fraud risk in exchange for a smoother checkout. Issuers can also refuse an exemption with a soft decline, which forces a retry with authentication.
A worked example
An illustrative merchant processes 100,000 European card orders a month at an average of €80, with a 92% completion rate on challenged 3DS and 99% on frictionless or exempted payments. Sending every order to a challenge loses about 8,000 orders. If dynamic rules challenge only the riskiest 15% and exempt or pass frictionlessly the rest, losses fall to roughly 1,200 plus about 850 more from frictionless and exempt flows, recovering nearly 6,000 orders, or around €475,000 of monthly sales, while fraud liability rises only on the exempted share.
For a buyer of a PSP or acquirer, the dynamic 3DS rule set, its exemption approval rates by issuer, and the fraud rate that keeps it inside a TRA band are commercial assets that need to survive migration to a new owner's platform.