3DS Success Rates by Country: Why Your Authentication Strategy Needs Market-Level Calibration

The 59-Point Gap

Your London checkout just cleared 3D Secure with a 95% success rate. Your São Paulo checkout hit 36%. Same protocol, same integration, completely different outcomes.

That 59-point spread is a revenue leak you built into your payment stack. If you're running the same 3DS strategy across every market, you're donating conversions to cart abandonment in your worst-performing regions.

Ravelin's 2026 Global Payments Report tracked 3DS performance across 37 countries and found success rates ranging from the UK's 95% down to Brazil's 36%. Italy sits at 93%, the US at 88%, Germany at 87%, India at 72%, and South Africa at 67%. The data confirms what many payment teams suspect but rarely quantify: 3D Secure is not one protocol with one effect. It behaves differently in every market because the regulations, issuer behaviors, and consumer habits that shape it are different everywhere.

The Regulatory Map: Mandated, Encouraged, or Optional

Before you can calibrate your 3DS strategy, you need to understand the regulatory terrain. The rules vary widely, and they set the baseline for how consumers and issuers interact with authentication.

Europe and the UK enforce Strong Customer Authentication (SCA) under PSD2 and the FCA's local rules. Every card-not-present transaction must pass through 3DS unless it qualifies for an exemption. This mandate has been live for years, and both issuers and cardholders are well-adapted.

Japan introduced a national 3DS mandate in April 2025. The Ministry of Economy, Trade and Industry (METI) required EMV 3DS 2.0 for all ecommerce credit card transactions in response to record card-not-present fraud losses of ¥55.5 billion in 2024 (92.5% of total card fraud). Post-mandate, 3DS-routed transactions quadrupled, yet conversion held at 93% with 60% of transactions going frictionless.

India has required authentication since 2009. The Reserve Bank of India's Additional Factor of Authentication mandate predates PSD2 by nearly a decade. Visa and Mastercard deprecated 3DS 1.0 for India in November 2023, pushing all volume to 3DS 2.

Australia uses a threshold-based framework under AusPayNet's Card Not Present Fraud Mitigation framework. Merchants who exceed a defined fraud rate threshold for the prior quarter are required to implement 3DS. It's not a universal mandate or a per-transaction value trigger; it's a merchant-level compliance obligation tied to fraud performance.

The US and Brazil have no formal SCA mandate. Adoption is driven by individual issuer risk appetite and fraud pressure, not regulation. This creates a patchwork: some issuers embrace 3DS, others actively resist it.

The lesson here is straightforward. In mandated markets, your strategy centers on optimizing within the framework. In optional markets, the question is whether to apply 3DS at all, and to which transactions.

High Performers: UK, Italy, Japan

The data splits cleanly into three tiers. The top tier tells a story of mature infrastructure and well-adapted consumers.

The UK leads at 95% 3DS success. Over 75% of UK challenges are completed through bank apps using biometrics, not one-time passwords. UK issuers also accept exemption requests at rates 10 percentage points higher than their EEA counterparts, giving merchants more flexibility to skip authentication on low-risk transactions.

Italy tracks closely at 93%.

Japan's post-mandate performance is equally strong: 93% conversion with dispute rates dropping more than 30% year-over-year. Stripe's data shows that early issuer-specific issues in Japan were resolved by configuring data fields per issuer preference using AI.

Mid Performers: France, US, Germany

France is the most interesting case in this tier. French issuers challenge transactions at 2x the EEA average and 3x the UK rate. That sounds like a conversion killer.

But France maintains a 91% 3DS success rate. The explanation is cultural: France was an early adopter of chip-and-PIN cards, so French consumers are comfortable with two-factor authentication. Challenge volume alone does not predict conversion loss.

The US sits at 88%, a decent number on paper. But a 2014 Adyen analysis (still the industry's most granular per-country conversion dataset) found that applying 3DS universally drops conversion by an average of 43% across China and the United States combined. American consumers resist additional authentication steps, and without a regulatory mandate normalizing the process, friction tolerance is low. More recent Ravelin and Stripe data confirm the directional pattern: non-mandated markets consistently underperform mandated ones.

Germany rounds out the mid-tier at 87%.

Low Performers: India, South Africa, Brazil

India's 72% overall 3DS success rate tells a misleading story. Despite ranking near the bottom third globally for overall 3DS success and frictionless rate, India ranks 4th globally for challenge success rate. Research shows that 3DS actually increases Indian ecommerce conversion by approximately 30% because consumers perceive authentication as a trust signal. (Note: this conversion lift figure originates from Adyen's 2014 study and should be read as directional rather than precise for today's market.)

However, UPI now handles 83% of India's digital payment volume, which means the card-based 3DS question is becoming less relevant for domestic transactions.

South Africa clocks in at 67%.

Brazil's 36% success rate is the starkest warning. The same 2014 Adyen analysis found that universal 3DS application drops Brazilian conversion by as much as 55%. The country's ecommerce payments are dominated by Pix (real-time payments) and Boleto Bancário. Many Brazilian consumers are unfamiliar with card-based authentication, turning 3DS into a friction wall rather than a security feature.

Why Frictionless Rates Are Falling

If you've noticed your frictionless approval rates declining over the past year, you're not alone.

Of the 37 countries Ravelin tracks, 28 registered declining or plateauing frictionless rates in 2026. Issuers are tightening their fraud models and denying exemption requests more frequently. Meanwhile, 78% of merchants now use exemptions (up from prior years), creating more competition for a shrinking pool of frictionless approvals.

The core problem is a data gap. Merchants request exemptions but often fail to submit the rich contextual data that would help issuers approve those requests with confidence.

The upcoming 3DS 2.3 standard introduces new data fields (device binding, payment token data, enhanced recurring transaction support) that could help close this gap. But adoption timelines remain uncertain, and issuer readiness varies by market.

As James Hogan, Senior Product Manager, Payments Engineering at Ravelin, puts it: "The key to reversing the frictionless decline is sophisticated optimization."

The Exemption Trap: Why "Always Request Maximum Exemption" Fails

A common piece of advice in payment operations circles is to always request the highest available exemption on every transaction. The logic seems sound: more exemptions mean fewer challenges, which means less friction.

The reality is more complicated. Hogan explains it directly (Ravelin, March 2026): "There is a common misconception that merchants should always request the highest available exemption, at any cost. This is suboptimal because issuer risk tolerances vary widely."

Consider the variation across just two markets:

• UK issuers accept exemption requests at rates 10 percentage points higher than EEA issuers. Aggressive exemption strategies work here.

• French issuers soft-decline non-3DS authorization exemptions above €100 per cardholder per day. The same aggressive approach hits a wall.

A blanket exemption strategy treats every issuer the same way. But a French issuer managing Banque de France compliance and a UK issuer operating under FCA rules have fundamentally different risk tolerances. What gets approved in one market gets declined in the other.

The fix requires per-issuer, per-transaction optimization: calculating the right exemption type for each specific combination of issuer, transaction value, and risk profile.

Building a Market-Calibrated 3DS Strategy

Here's a practical framework for moving from a one-size-fits-all approach to a calibrated one:

1. Segment your markets by regulatory posture. Separate mandated markets (EU, UK, Japan, India) from optional ones (US, Brazil). Your baseline strategy differs fundamentally between these two groups.

2. Map issuer behavior within each market. Track exemption acceptance rates, challenge rates, and frictionless approval rates per issuer. UK issuers and French issuers live under the same SCA regulation but behave very differently.

3. Match your data submission to issuer expectations. Submit the richest possible transaction context. Japan's post-mandate success came partly from configuring data fields to match individual issuer preferences. The same principle applies everywhere.

4. Use transaction risk analysis to route selectively. In non-mandated markets, apply 3DS only where the risk profile warrants it. Sending every Brazilian transaction through 3DS when your success rate is 36% is not a fraud strategy. It's a conversion tax.

5. Monitor and iterate continuously. Issuer behavior changes. Frictionless rates shift. New regulations take effect. Authentication strategy should never be static.

As the Stripe Payments Intelligence Team notes: "Markets with authentication regulations can have the best of both worlds: a decrease in fraud while maintaining high conversion rates. This highlights the importance of understanding your authentication performance and business needs across regions."

3DS Is a Revenue Lever, Not a Compliance Checkbox

The 59-point gap between the UK and Brazil proves that 3D Secure is not a uniform protocol with a uniform effect. It's a geo-calibrated revenue lever that works differently in every market you sell into.

The merchants who treat authentication as a set-and-forget compliance checkbox leave revenue on the table in their best-performing markets and actively destroy it in their worst. The merchants who calibrate per market, per issuer, and per transaction protect both their fraud rates and their approval rates.

Corgi Labs helps payment teams move from static authentication rules to dynamic, data-driven 3DS routing. Corgi Intelligence surfaces the market-level and issuer-level patterns in your transaction data, and Corgi Model optimizes decisioning at the individual transaction level, so your 3DS strategy works as well in São Paulo as it does in London.

Book a Demo →

Sources

1. Ravelin, "3D Secure rates 2026: Analysis & country comparison," March 19, 2026. https://www.ravelin.com/blog/3d-secure-rates-2026

2. Stripe, "The conversion paradox: 3DS trends in regulated markets," August 26, 2025. https://stripe.com/blog/3ds-trends-in-regulated-markets

3. GPayments, "The Secure Future of Digital India: 3D Secure as Growth Catalyst," September 2, 2025. https://www.gpayments.com/blog/article/the-secure-future-of-digital-india-3d-secure-as-growth-catalyst/

4. Adyen (with Edgar, Dunn & Company), "Analysis Reveals Worldwide Impact of 3D Secure on Transaction Conversion Rates," January 8, 2014. https://www.adyen.com/press-and-media/adyen-analysis-reveals-worldwide-impact-of-3d-secure-on-transaction-conversion-rates

5. PCI-Proxy, "3D Secure Mandates by Country: Which Markets Require 3DS in 2026?," June 10, 2026. https://www.pci-proxy.com/blog-posts/3d-secure-mandates-by-country-which-markets-require-3ds-in-2026

6. Ravelin, "Why do 3D Secure acceptance rates vary by country – and how can you manage this?," July 24, 2025. https://www.ravelin.com/blog/why-do-3d-secure-acceptance-rates-vary-by-country-and-how-can-you-manage-this