Frictionless flow is a 3-D Secure authentication that completes without the customer doing anything: no code, no app prompt, no visible redirect. Under 3-D Secure 2 the checkout sends device and transaction data, potentially more than a hundred elements, through the scheme's directory server to the issuer before authorization. The issuer's risk engine compares fingerprint, addresses, account age and purchase history and, if the profile fits, returns an authenticated result in under a second; anything unusual triggers a challenge. Merchants that populate the optional fields get challenged materially less. Unlike an SCA exemption, which skips authentication and leaves fraud liability with the merchant, a frictionless flow completes it, so chargeback liability shifts to the issuer.
What the issuer sees before it decides
Under 3-D Secure 2 the checkout collects device and transaction data and passes it to the issuer through the scheme's directory server, before the payment goes for authorization. The payload can carry more than a hundred elements: device and browser fingerprint, billing and shipping addresses, how long the account has existed, how many successful payments this cardholder has made with this merchant, and the merchant's own risk score for the order.
The issuer's risk engine compares that against what it already knows. Familiar profile, unremarkable purchase, recognized device, and it returns an authenticated result in under a second. Anything that does not fit, and it asks for a challenge.
Two identical baskets, opposite answers
A subscriber renews a 29 euro plan from the phone they have used for two years, on an account eighteen months old with a dozen prior payments behind it. The data reads as routine and the customer sees only a confirmation screen. The same card, the same amount, from a new device with a shipping address that does not match billing, reads as an account takeover and gets challenged — and a share of that traffic never comes back.
Data quality is the whole game
The optional 3DS fields are optional to send, not optional to the outcome. Merchants that populate cardholder name, email, phone, full billing and shipping detail and account history are challenged materially less than those sending the minimum, because they give the risk engine something to recognize. Consistency compounds: the same customer on the same device at the same address builds a history the issuer can price.
Silent is not the same as skipped
An SCA exemption removes the authentication step; a frictionless flow performs it invisibly. The difference appears when fraud arrives, because a completed authentication moves chargeback liability to the issuer while an exemption leaves it with the merchant. Two checkouts that look identical to the customer can have opposite consequences for whoever pays the loss.
What the rate is worth
Every challenge costs completions — codes arrive late, sessions time out, and the order joins the cart abandonment statistics — so the share of authentications running silently is one of the more valuable numbers in a payments operation and a standing target in checkout optimization. Track it by issuer and by device type rather than as one blended figure; the weak segment is usually narrow, and fixing the data there moves the total.