Four Shifts Redefining Trust in Digital Payments

For years, 3-D Secure (3DS) has played a critical role in protecting card-not-present (CNP) payments. By adding an additional layer of authentication at checkout, it helps issuers verify cardholders, reduce fraud, and meet regulatory requirements.

But the payment landscape is changing. And at pace.

Fraudsters are becoming more sophisticated. Identity compromise can happen long before a transaction takes place. Strong authentication does not always tell us whether a payment is genuinely intended. And as wallets, tokens, and AI-driven experiences increasingly embed payments into everyday journeys, the traditional “payment moment” is becoming less visible.

The result? The future of payment security cannot be about adding more authentication. It is about making better trust decisions at the right moments.

That means evolving 3DS from a protocol used primarily for authentication and compliance into an intelligent decision layer — one that brings together identity, intent, risk, and evidence to determine whether a transaction should proceed.

Here are four shifts driving that evolution.

1. AI is industrializing scams

Artificial intelligence (AI) is changing the economics of fraud.

Fraudsters can now create convincing phishing messages, impersonate trusted individuals, automate social engineering, and adapt attacks at a scale that would have been difficult to achieve manually. Where the target was once the payment system itself, now it is the person using it.

That makes detecting suspicious transactions after the fact less effective. Financial institutions need to make informed risk decisions before fraud succeeds.

This is where the 3DS Access Control Server (ACS) can become more than an authentication endpoint.

Entersekt’s ACS acts as an adaptive decision point, combining 3DS data with device, behavioral, transaction, and fraud-risk signals. Instead of treating every transaction in the same way, issuers can use available intelligence to determine when a transaction can proceed frictionlessly, when additional authentication is appropriate, or when a transaction should be challenged or blocked.

This doesn’t necessarily signal more friction as the end goal. Instead, it is smarter intervention when the risk demands it.

2. Identity compromise is moving upstream

The payment transaction is often not where fraud begins.

Account takeover can start with compromised credentials, a phishing attack, a malicious app, a SIM swap, or an attacker gaining access to a customer’s digital identity. By the time a fraudulent payment reaches checkout, the fraudster may already be operating inside an apparently legitimate account.

This changes the role authentication needs to play.

Financial institutions need to move towards continuous, context-aware authentication, connecting identity and risk across the customer journey — from enrollment and login through to payment.

Entersekt’s broader authentication capabilities allow institutions to build this continuity. Risk intelligence can inform authentication decisions across different journeys, while 3DS provides a critical layer of protection when a card payment takes place.

The opportunity is to stop thinking of authentication as a single event and start treating it as an ongoing assessment of trust.

Because knowing who is accessing an account is just as important as knowing who is making a payment.

3. Authentication works. But intent is the gap.

Strong customer authentication has made digital payments significantly harder for fraudsters to compromise through stolen credentials alone.

But authentication cannot answer every fraud question.

A legitimate customer can be manipulated into authorizing a transaction themselves. This is particularly relevant as social engineering and authorized push payment scams continue to evolve. The customer may be correctly authenticated, yet the payment itself may not reflect their genuine intention.

This requires a shift in the conversation: from “Was the user authenticated?” to “Was this payment genuinely intended?”

That distinction is increasingly important for financial institutions.

The answer lies in combining authentication with richer context and risk intelligence. Transaction characteristics, device signals, behavioral patterns, historical activity, and other indicators can help establish whether a payment makes sense in context.

3DS remains an essential part of this framework, but its value increases when authentication is informed by the broader risk picture. The objective is not simply to prove that a customer is present. It is to give the institution greater confidence that the transaction is legitimate — and to intervene when the evidence suggests otherwise.

4. The payment moment is disappearing

The traditional payment journey is changing.

Digital wallets, network tokens, embedded payments, one-click experiences, and increasingly AI-powered agents are making transactions more seamless. Customers may no longer consciously move through a conventional checkout flow. In some cases, an AI agent could initiate or complete a purchase on their behalf.

As the visible payment moment disappears, so does the opportunity to rely on a single, familiar authentication event.

Trust therefore needs to become portable.

Financial institutions and the wider payment ecosystem need security that can operate consistently across channels, devices, wallets, merchants, and emerging agentic experiences — while preserving the critical principles of approval, intent, and accountability.

This is where an intelligent 3DS infrastructure becomes increasingly valuable.

Rather than viewing 3DS as a standalone protocol that exists only at checkout, institutions can use it as part of a broader trust architecture — one that connects payment data with identity and risk signals to make decisions wherever the transaction journey takes place.

From authentication to intelligent trust

These four shifts point to the same conclusion:

The future of payment security isn’t about authenticating more transactions. It’s about making better decisions about trust.

• For issuers, that means using every available signal to distinguish legitimate customers from sophisticated fraud attempts, while keeping genuine transactions moving.

• For merchants, PSPs, and processors, it means supporting secure payment experiences without introducing unnecessary friction or creating fragmented authentication journeys.

• And for the payment ecosystem as a whole, it means building an infrastructure capable of adapting as fraud, customer behavior, and payment experiences continue to evolve.

Entersekt’s 3-D Secure solutions are designed for that reality. With EMVCo-certified 3DS capabilities across the payment ecosystem, Entersekt helps issuers, merchants, PSPs, and processors strengthen payment security, improve transaction outcomes, and deliver more intelligent authentication experiences.

Because the next generation of payment security won’t be defined by how often we authenticate.

It will be defined by how intelligently we decide whom — and what — to trust.

Explore Entersekt’s 3-D Secure solutions for the entire payment ecosystem → https://www.entersekt.com/platform/3-d-secure