3D Secure Payment Failed? What It Means and What to Do

A customer messages to say their card payment failed. They have tried twice. Their card works everywhere else. Is your website broken?

Almost always, no. Very often the reason is that the customer’s bank asked them to confirm the payment, and that check did not complete. The card is fine, your website is fine, and no money has been taken. The check is called 3D Secure, and once you know how it works, these messages take a minute to answer.

What 3D Secure is

3D Secure is the extra step where a customer’s bank asks them to prove it is really them before an online payment goes through. Usually it is a prompt in their banking app. Sometimes it is a code sent by text, or a fingerprint or face check.

It is not optional. Since 14 March 2022 the Financial Conduct Authority has required strong customer authentication for online card payments in the UK, and 3D Secure is the main way it is done. Banks can decline payments that do not meet the requirement. Some lower value or lower risk payments are approved quietly in the background without the customer seeing anything, which is why the check appears on some purchases and not others.

What “failed authentication” actually means

When we looked into a failed order for one client, the payment record gave the exact reason: the payment method had failed authentication. In Stripe, which handles payments on a great many small business shops, that shows as the error code payment_intent_authentication_failure, described as a payment “declined because the payment method failed to pass authentication”.

In plain English: the bank’s 3D Secure check ran, and it did not come back as a yes. That is a different thing entirely from a card declined for lack of funds, a card that has expired, or a fault in your checkout. It is worth knowing which one you are looking at, because each has a different answer.

Why the check fails

The reasons are nearly always on the customer’s side, and most have nothing to do with fraud.

• They did not approve it in time. The banking app prompt arrived and they did not open it before the check timed out.
• They closed the window. The bank’s confirmation screen opened, they took it for a pop-up advert, and closed it.
• They switched apps on their phone. Leaving the browser to open the banking app and coming back can drop the session on some phones.
• A code went to an old number. The bank sent the confirmation code to a phone number they no longer use.
• They typed the code wrong, or used an old one.
• Their bank said no. Now and then the bank’s own fraud checks decline an unusual purchase, especially a first order with a shop they have not used before.

Was the customer charged?

No. When the 3D Secure check fails, the payment does not go through and no money is taken. If the customer can see a pending amount in their banking app, it is not a charge. It drops off on its own, on the bank’s timetable rather than yours.

That is the reassurance most customers actually want, so say it first.

What to tell the customer

A short, calm reply solves most of these. Something like:

Thanks for letting us know. Nothing has been taken from your account. Your bank asked you to confirm the payment and that step did not complete, which usually means the confirmation in your banking app timed out or the window was closed. If you try again with your banking app open and ready, it should go through. If it still will not, a quick call to your bank will sort it, or you can pay with a different card.

If you offer other ways to pay, such as Apple Pay, Google Pay or PayPal, mention them. They often handle the confirmation step more smoothly on a phone.

What to check on your side

One failed payment is usually the customer’s bank. Several in a short space of time are worth a look.

• Read the reason, not just the word “failed”. Your payment dashboard records why each payment did not go through. Authentication failures, card declines and insufficient funds all need different responses.
• Put through a real test order. Before we call payments live on a shop, we place a small live order of £1 and check that both the customer’s confirmation email and the shop’s own order alert arrive. Doing the same now tells you whether the whole route still works.
• Try the checkout on a phone. Most of your customers buy on one. Go through the whole payment, including the bank’s confirmation step, on your own phone.
• Know what your payment settings switch on. Payment providers sometimes enable extra options by default. Stripe, for example, can show a pay later option such as Klarna at checkout until you switch it off, which can surprise you and your customers alike.

If lots of customers are failing authentication rather than the odd one, something in the checkout may be getting in the way of the bank’s confirmation screen, such as a script, a pop-up blocker or an out of date payment setup. That is a job for whoever looks after your site.

Keeping payments working

Payments are one of the things that quietly stop working when software goes out of date, which is a large part of why we look after the shops we build. If your shop takes card payments and nobody is watching it, our website maintenance plan covers updates, monitoring and a person to ask when a customer reports a problem. Planning a shop? Our guide to what an ecommerce website costs sets out what to expect. And for the faults we find most often on live shops, read ten faults we found auditing an online shop.