Frictionless Authentication

Frictionless authentication is a way of confirming that a customer is who they claim to be without requiring them to take any extra step, such as entering a code or approving a request in an app. The issuer or bank analyses information sent with the payment, including details of the device, browser, purchase, merchant and the customer's history, and decides that the risk is low enough to authenticate the customer automatically. The customer simply sees the payment go through.

The term is most closely associated with 3-D Secure 2, the card authentication protocol for online payments, in which a transaction can follow either a frictionless flow or a challenge flow. It also describes background authentication in banking apps and other channels. Frictionless authentication is a form of risk-based authentication.

1. At checkout, the merchant's 3DS software collects data about the transaction and the device, such as browser settings, IP address, shipping and billing details, and whether the customer has an account with the merchant.
2. The data is sent through the card network's directory server to the issuer's access control server.
3. The issuer's risk engine assesses the data against the cardholder's history and known fraud patterns.
4. If the risk is low, the issuer returns an authentication result without a challenge, together with a cryptographic value proving that authentication took place.
5. The merchant includes this value in the authorisation request, and the payment is processed with the benefits of an authenticated transaction, including the usual shift of fraud liability to the issuer.

If the risk is higher, the issuer instead challenges the cardholder, for example by asking them to confirm in their banking app or enter a one-time passcode. The richer data in 3DS2 compared with the original 3-D Secure is what allows most transactions to be authenticated without a challenge.

In the European Economic Area and the United Kingdom, strong customer authentication requires two independent factors for most online payments. A frictionless 3DS result on its own does not satisfy SCA, because the customer has not provided two factors. It is therefore used where an SCA exemption applies, such as transaction risk analysis or low-value payments, or where SCA is outside scope, such as some transactions with cards issued outside Europe. Outside Europe, issuers can use frictionless authentication more broadly, since there is no general legal requirement for two factors. This difference means challenge rates vary considerably by region.

• Higher conversion. Customers are less likely to abandon purchases when no extra step is required.
• Liability protection. Merchants still receive the fraud liability shift associated with authenticated transactions under card scheme rules.
• Better risk decisions. Issuers receive more data than in a plain authorisation, which can improve approval rates.
• Consistent experience. Mobile and in-app purchases can be authenticated smoothly across devices.

The share of transactions authenticated without a challenge depends on the quality and completeness of the data the merchant sends, the issuer's risk policies and the regulatory environment. Merchants can improve frictionless rates by sending all recommended data fields, using device data collection correctly and using features such as delegated authentication or trusted beneficiary listing where available. Network tokens and consistent customer accounts also help issuers recognise genuine customers. Issuers set their own thresholds, so rates vary between banks.

Frictionless authentication depends on accurate data and good risk models. If fraudsters can imitate a genuine customer's device and behaviour, for example through device spoofing after an account takeover, they may pass without a challenge. Issuers must therefore monitor outcomes, adjust thresholds and accept that some fraud will occur on frictionless transactions, for which they usually bear liability. Customers may also be unaware that authentication happened, which can cause confusion if they later dispute a charge.

Similar techniques are used in online banking and digital wallets. Banks may authenticate a returning customer on a trusted, bound device using passive signals such as device keys and behavioural biometrics, asking for further checks only when something unusual happens. Passkeys, which use cryptographic keys stored on the customer's device and unlocked by a fingerprint or face, are another way to make authentication feel almost frictionless while remaining strong. The general aim across channels is to apply friction only where risk justifies it.