Who Carries the Risk When the Challenge Fails? Configuring 3D Secure for Offshore Acquiring in 2026

For a UK merchant processing through an offshore acquirer, 3D Secure is rarely a simple on-or-off decision. It sits at the intersection of regulatory expectations, conversion performance and contractual risk. The acquirer will look at authentication not only as a compliance box but as evidence that the merchant understands where fraud risk sits and how it is controlled. In 2026, with UK and European issuers applying strong customer authentication (SCA) in different ways and scheme rules continuing to evolve, the practical question is less “Do we use 3DS?” and more “Which transactions should be challenged, which should be frictionless, and who bears the loss when something goes wrong?”

Authentication as an underwriting signal

Offshore acquirers underwrite uncertainty. A UK merchant that presents a clear authentication policy, monitors its results and can explain exception cases is easier to underwrite than one that applies a blanket challenge rule or disables 3DS to protect conversion. The acquirer may ask for challenge rates by card origin, fraud ratios, exemption usage and chargeback performance. Those figures are not merely operational statistics; they indicate whether the merchant is managing the tension between friction and fraud deliberately.

This is particularly relevant for cross-border acquiring. An offshore acquirer may be less familiar with the merchant’s domestic market and more reliant on data. A well-documented 3D Secure configuration gives the acquirer a reason to trust the merchant’s controls before a live test purchase or a review of historical disputes.

The liability question is narrower than many assume

It is common to hear that 3DS “shifts liability” to the issuer. In practice, the position is more limited. Liability shift generally applies to certain fraud chargebacks when a transaction is successfully authenticated under the relevant scheme rules. It does not cover every dispute. Claims that a cardholder did not receive goods, that goods were not as described, or that a refund was not processed can still fall to the merchant or acquirer under the applicable rules and contract.

For UK-issued cards, the starting point is the UK’s SCA framework and the scheme rules that apply to authenticated e-commerce. A fully authenticated transaction may benefit from liability shift for specified fraud categories, but an exemption used without authentication may not. Attempted authentication can have a different treatment from successful authentication, and the evidence required can vary by scheme and acquirer.

For cross-border transactions, the picture becomes less uniform. A card issued in the European Economic Area may be subject to SCA expectations that resemble the UK’s, while a card issued elsewhere may follow different local rules. The merchant’s offshore acquirer may impose its own authentication requirements by merchant category code, transaction value, card origin or risk score. The contract matters: an acquirer can allocate risk to the merchant in ways that go beyond the headline liability-shift rules. UK merchants should therefore compare the scheme position with the acquirer agreement rather than assuming that a successful challenge resolves all exposure.

Setting the dial: frictionless first, challenge by policy

A workable configuration usually begins with 3DS2 and a frictionless first attempt. The issuer can authenticate the cardholder without a challenge where its risk assessment permits. If the issuer requests a challenge, the cardholder completes the additional step. The merchant’s role is to ensure the request carries sufficient data for the issuer to make a sound decision and to define when it will seek an exemption rather than a challenge.

Exemptions should be selective. The scheme-defined low-value exemption, transaction risk analysis, recurring and merchant-initiated transactions, and trusted-beneficiary arrangements can all reduce friction, but each has conditions and monitoring obligations. A low-value exemption may be subject to cumulative amount or count limits. Transaction risk analysis depends on the acquirer’s fraud thresholds and the quality of the merchant’s data. Recurring arrangements require clear cardholder consent and the correct transaction indicators. Used carelessly, exemptions can reduce conversion friction while weakening the merchant’s liability position and attracting acquirer concern.

Challenge thresholds should be documented by channel, card origin, amount band and merchant category code. A UK merchant selling low-risk digital goods may accept a higher frictionless rate than one selling high-value electronics. The policy should also cover velocity, device change, mismatch between billing and shipping country, and repeated failed attempts. The objective is not to challenge every transaction or to avoid challenges entirely, but to apply a consistent rule that can be explained to an acquirer and tested against outcomes.

The evidence file the acquirer expects

Authentication control is demonstrated through records. The merchant should be able to show, for a sample of transactions, the 3DS version, authentication result, electronic commerce indicator, exemption code where used, risk score, device and browser data, card issuer country, transaction amount, challenge outcome and timestamp. Where an exemption was applied, the merchant should be able to explain the rationale and show that monitoring was in place.

This evidence should be reconciled with the acquirer’s reporting. If the merchant’s checkout logs show a successful authentication but the acquirer records an attempted or failed result, the discrepancy needs investigation. Offshore acquirers often review authentication data during onboarding, periodic risk reviews and dispute investigations. A clean evidence file shortens those conversations.

A practical configuration checklist

• Document an authentication policy covering UK-issued and non-UK cards, channels, amount bands and merchant category codes.
• Use 3DS2 with frictionless processing first, and define the circumstances in which a challenge is required.
• Apply exemptions selectively, with named owners, monitoring and a review date.
• Confirm how the acquirer treats liability for authenticated, attempted and exempted transactions under the contract.
• Retain transaction-level authentication logs and exemption rationales for the period required by the acquirer and applicable rules.
• Monitor approval rates, challenge rates, exemption usage, fraud and chargebacks by card origin and issuer.
• Test checkout behaviour across major UK and overseas issuers before and after configuration changes.
• Review the policy after material changes to products, pricing, delivery models or acquirer requirements.

Conclusion

The 3D Secure configuration is a risk control, not merely a checkout preference. For UK merchants using offshore acquirers, the sensible approach in 2026 is to treat authentication as a documented policy: frictionless where the data supports it, challenged where risk warrants it, and evidenced in a form the acquirer can audit. Liability shift is part of the calculation, but it is not a substitute for understanding the contract, the scheme rules and the merchant’s own dispute exposure.