Skip to main content
Commerce Security Authority
Category: 3-D Secure

Frictionless Flow

Also known as: Frictionless Authentication Flow, Frictionless 3DS Flow
Simply put

Frictionless flow is a type of 3-D Secure authentication in which the card issuer verifies a transaction in the background using risk assessment, without asking the shopper to complete an extra step such as entering a one-time code. It is intended to reduce checkout friction for lower-risk transactions while still applying identity checks. It does not eliminate the possibility of fraud, and higher-risk transactions may instead be routed to a challenge that requires additional customer interaction.

Formal definition

In 3-D Secure authentication, frictionless flow is the outcome in which the issuer's Access Control Server (ACS) authenticates a transaction using risk-based assessment of the data provided during the authentication request, without invoking an interactive challenge to the cardholder. It contrasts with the challenge flow, where the ACS requires additional cardholder interaction (for example, a one-time passcode or biometric step) to complete authentication. Frictionless flow is a decisioning outcome within the 3-D Secure protocol and should not be equated with a specific outcome guarantee, liability position, or fraud-prevention control; the routing decision reflects the issuer's risk evaluation, and outcomes, liability shift, and applicable rules are governed by card brand and network rules that vary by region and change over time. This term belongs to 3-D Secure (addressed under PCI 3DS for supporting components) and is distinct from PCI DSS controls governing storage and protection of cardholder data.

Why it matters

Frictionless flow matters because checkout friction is a well-documented cause of shopper abandonment in card-not-present commerce, and every additional authentication step introduces the risk that a legitimate customer will drop out of the purchase. By allowing the issuer's Access Control Server to authenticate lower-risk transactions in the background using risk-based assessment, frictionless flow is intended to preserve identity checks while avoiding an interactive step such as a one-time passcode. For merchants, this can help balance conversion against the security and liability benefits associated with 3-D Secure authentication.

At the same time, frictionless flow should not be mistaken for a fraud-elimination control. It is a decisioning outcome within the 3-D Secure protocol that reflects the issuer's evaluation of the data supplied during the authentication request, not a guarantee that a given transaction is legitimate. A frictionless outcome does not automatically fix any specific liability position; liability shift, applicable outcomes, and the rules that govern them are set by card brand and network rules that vary by region and change over time. Teams that treat a frictionless result as proof of a safe transaction may misjudge their residual fraud exposure.

Understanding the distinction between frictionless flow and challenge flow also helps organizations avoid conflating 3-D Secure with other layers of their control environment. Frictionless flow belongs to the 3-D Secure protocol, with supporting components addressed under PCI 3DS, and is separate from the PCI DSS controls that govern storage and protection of cardholder data. Confusing these domains can lead to gaps in both authentication strategy and data-protection compliance.

Who it's relevant to

Merchants and e-commerce teams
Merchants rely on frictionless flow to reduce checkout abandonment on lower-risk card-not-present transactions while still applying issuer identity checks. They should understand that a frictionless outcome is an issuer decisioning result, not a guarantee against fraud, and that any associated liability treatment depends on card brand and network rules that vary by region and change over time.
Fraud analysts and merchant risk teams
Fraud teams need to interpret frictionless outcomes correctly when assessing residual card-not-present exposure. A frictionless result reflects the issuer's risk assessment of the authentication data and does not eliminate fraud risk, so it should be considered alongside other detection signals rather than treated as a definitive assurance of legitimacy.
Issuers and Access Control Server operators
Issuers and ACS operators make the risk-based decision that determines whether a transaction proceeds frictionless or is routed to a challenge. Their tuning of that decisioning affects the trade-off between customer friction and authentication assurance, with implications for both false positives that challenge legitimate shoppers and false negatives that allow risky transactions to pass without a challenge.
Payment processors and 3-D Secure providers
Processors and providers implement the 3-D Secure protocol and pass authentication data between merchants and issuers. They should distinguish 3-D Secure components (addressed under PCI 3DS for supporting elements) from PCI DSS controls governing cardholder data storage and protection, and confirm current protocol behavior against the applicable card brand and network rules.

Inside Frictionless Flow

Frictionless Flow (3-D Secure)
An authentication path within the EMV 3-D Secure protocol in which the cardholder is not prompted for an additional challenge. The issuer (ACS) assesses the risk of the transaction using data shared during the authentication request and, if satisfied, approves authentication without requiring interactive input from the cardholder.
Risk-Based Decisioning by the Issuer
The frictionless outcome depends on the issuer's Access Control Server evaluating device, transaction, and contextual data elements to decide whether a challenge is needed. The decision to route a transaction as frictionless or to step up to a challenge flow rests with the issuer.
Data Elements Exchanged
EMV 3-D Secure supports the sharing of expanded data (such as device and transaction context) between the merchant/3DS environment and the issuer to support risk assessment. Handling of any data exchanged should be governed by applicable data protection and PCI 3DS requirements, which are separate from PCI DSS.
Relationship to the Challenge Flow
Frictionless flow is one of two possible outcomes; the alternative is the challenge flow, in which the cardholder completes an interactive step-up authentication (for example, a one-time passcode or biometric prompt handled by the issuer).
Governing Standard
Frictionless flow is a concept defined within EMV 3-D Secure and is addressed by the PCI 3DS standard for the security of the 3DS environment. It is distinct from PCI DSS, PCI P2PE, PCI PIN, and the PCI Software Security Framework.

Common questions

Answers to the questions practitioners most commonly ask about Frictionless Flow.

Does the frictionless flow mean the cardholder is never challenged for authentication?
No. The frictionless flow is a 3-D Secure authentication path in which the issuer (ACS) assesses risk using data shared during the transaction and approves authentication without an interactive challenge to the cardholder. It does not guarantee that a challenge will never occur; the issuer may still route a transaction to the challenge flow based on its risk assessment, and behavior varies by issuer, region, and applicable card brand and network rules. Readers should treat the frictionless outcome as issuer-determined rather than merchant-guaranteed.
Does completing a frictionless flow eliminate fraud or fully shift liability to the issuer?
No. The frictionless flow is intended to help reduce card-not-present fraud friction while still supporting authentication, but no single control eliminates fraud. Whether a liability shift applies is governed by card brand and network rules, which change over time and vary by region, and it is not determined by the frictionless label alone. 3-D Secure addresses authentication at one point in a card-not-present transaction and does not by itself address other fraud types such as account takeover, friendly or first-party fraud, or synthetic identity fraud.
What data elements typically support a frictionless flow decision?
The frictionless flow relies on risk-relevant data shared during the 3-D Secure message exchange between the merchant/requestor environment and the issuer's ACS, which the issuer uses to assess whether an interactive challenge is needed. The specific data elements and how they are exchanged are defined by the applicable 3-D Secure specification and associated card brand and network implementation rules. Teams should confirm the exact required and optional fields against the current published specification and their processor's integration guidance rather than assuming a fixed set.
How should we handle transactions that begin as frictionless but are stepped up to a challenge?
Implementations should be built to support both outcomes, because the issuer may return a challenge decision even when a frictionless result was anticipated. Design the requestor flow so that a step-up to the challenge flow is handled gracefully in the user experience and so that the authentication result is correctly captured and passed into subsequent authorization processing. Validate this fallback behavior in testing, since routing behavior can vary by issuer and region under applicable card brand and network rules.
Does using the frictionless flow change our PCI DSS scope?
3-D Secure requirements for the merchant/requestor role are addressed under PCI 3DS, which is a separate standard from PCI DSS; do not conflate the two. Handling of cardholder data in your environment remains subject to PCI DSS, and any effect on scope depends on your specific implementation and how data flows through your systems, not on the presence of a frictionless flow. Confirm applicable requirements against the current published standards rather than assuming a fixed requirement number.
How do we monitor whether our frictionless flow is performing as intended?
Teams typically monitor authentication outcomes such as the proportion of transactions completing frictionlessly versus being stepped up to a challenge, along with downstream authorization results, to understand issuer behavior and user experience impact. Because authentication is a detection-oriented control, monitoring should account for trade-offs: increasing frictionless outcomes may reduce friction but should be evaluated alongside fraud and dispute signals. Exact performance figures depend on source, period, and methodology and should be measured from your own data rather than assumed.

Common misconceptions

A frictionless flow means the transaction was not authenticated.
Frictionless flow still represents an authentication outcome; the issuer performed a risk-based assessment and chose not to require an interactive challenge. The absence of a cardholder prompt does not mean authentication was skipped.
Choosing frictionless flow eliminates fraud or guarantees the transaction is legitimate.
3-D Secure, including its frictionless path, is intended to help reduce certain card-not-present fraud risks but does not prevent all fraud. It does not address every fraud type (for example, first-party or friendly fraud), and outcomes involve false-positive and false-negative trade-offs. Liability and chargeback treatment are governed by card brand and network rules that vary by region and change over time.
The merchant decides whether a transaction is frictionless.
The final decision to route a transaction as frictionless or to require a challenge is made by the issuer's Access Control Server based on its risk assessment. The merchant can supply data to support that assessment but does not control the outcome.

Best practices

Treat the frictionless outcome as issuer-controlled: supply complete and accurate data elements to support the issuer's risk assessment rather than assuming a specific outcome.
Secure the 3DS environment in line with applicable PCI 3DS requirements, and confirm your obligations against the current published standards rather than assuming fixed requirement numbers.
Do not rely on frictionless 3-D Secure as a sole anti-fraud control; layer it with additional fraud detection appropriate to your card-not-present risk and account for false-positive and false-negative trade-offs.
Keep 3-D Secure scope separate from PCI DSS controls for cardholder data storage; never store sensitive authentication data after authorization, and apply defined controls to any cardholder data you retain.
Verify liability shift and chargeback expectations against current card brand and network rules for your regions, since these vary and change over time.
Validate that data exchanged to enable frictionless decisioning is handled under the applicable data protection and 3DS security requirements, confirming implementation and validation rather than relying on labels.