// Case study · Fintech / payments
3-D Secure 2.0 & SCA
Browser-based 3-D Secure 2.0 authentication wired through the payment gateway — PSD2 Strong Customer Authentication without breaking the checkout flow.
The problem
PSD2 mandated Strong Customer Authentication. 3-D Secure 2.0 moves the challenge into a browser-driven, data-rich flow — device and browser fingerprint, frictionless vs. challenge paths — and it had to work across acquirers, each with slightly different 3DS behavior, without bleeding conversions.
The approach
Implemented the browser-authentication flow end to end: collecting browser info from request headers, driving the authenticate-browser step and the challenge / redirect back to the return URL, and mapping each acquirer's 3DS 2.0 statuses into the platform's flow-action state machine.
The decision & trade-off
Kept the 3DS step a first-class flow action rather than a special case bolted onto card charges — more upfront modeling, but it made SCA composable with routing, retries and every acquirer instead of a per-provider hack.
Architecture
The card flow yields to an authenticate-browser flow action; browser data flows in, the challenge is orchestrated, the result maps back to a normalized status, and the charge resumes — provider-agnostic.
Outcome
SCA-compliant card payments across acquirers, with the frictionless path preserved where possible and the challenge path handled cleanly where required.
What I'd do differently
Invest earlier in a shared 3DS conformance test-suite across acquirers — the long tail of provider-specific 3DS quirks is where the time went.
Architecture diagram
Stack
- PHP
- Symfony
- 3-D Secure 2.0
- PSD2 SCA
Have a similar problem?
Tell me about it — I reply within a day.