Frictionless flow is the term used in the 3-D Secure specification for frictionless authentication: the issuer verifies an online card payment using data sent in the background and returns a result without asking the cardholder to do anything. The shopper sees only a brief pause, if that, before the order is confirmed. The alternative path is the challenge flow, in which the issuer requires a further step such as approving the payment in a banking app or entering a one-time code.
Under EMV 3-D Secure, the merchant's provider sends the issuer a large set of data about the transaction, the device and the customer's history with the merchant. The issuer's risk engine scores the request, a form of risk-based authentication. Low-risk requests are authenticated at once; uncertain ones trigger step-up authentication; clearly risky ones can be refused.
Merchants favour the frictionless flow because challenges cause some shoppers to abandon their purchase. A transaction authenticated this way still normally carries the liability shift to the issuer for fraud. In Europe, where strong customer authentication is mandatory, a frictionless outcome is possible only when an exemption applies, for example for low-value payments or where the issuer's or acquirer's fraud rates are low enough to allow transaction risk analysis.