Fictional scenarios and synthetic data. Reviewed 6 November 2026.
Brightwater Tickets asks Northbank Pay to reduce checkout friction before a major on-sale. The commercial benefit is plausible. The request still needs to distinguish authentication, authorisation, an exemption request and liability protection before anyone changes a production setting.
What is actually being decided.
EMV 3-D Secure supports online cardholder authentication. A frictionless 3DS flow is not necessarily an SCA exemption, and a completed challenge is not the same as a successful payment authorisation. Label the actual paths in the data rather than splitting the entire checkout into “3DS” and “no risk”.
Where SCA rules apply, exemption eligibility depends on the applicable conditions and participants. The EBA’s TRA methodology clarification addresses the payment service provider’s fraud-rate calculation. A single merchant’s recent low dispute rate is not, by itself, proof that the provider qualifies for a particular exemption band.
Three decisions, three records.
First identify the authentication or exemption path requested. Then record the issuer’s response and any required next step. Finally determine the actual liability treatment through the scheme and acquirer records. Do not infer all three from a frontend flag or promise that authentication transfers every category of dispute to the issuer.
A synthetic comparison.
Imagine 10,000 attempts on each of two comparable experimental paths. One produces 8,800 approvals and nine subsequently confirmed fraudulent approvals. The other produces 9,500 approvals and 38 confirmed fraudulent approvals. The observed difference is 700 approvals and 29 fraud outcomes.
These invented counts do not prove causality. Traffic allocation, customer mix, outcome maturity and uncertainty need to be examined. Nor do they establish who bears those losses. Add the actual liability evidence and customer-impact estimates before evaluating the commercial tradeoff.
The issuer response matters.
An issuer can require further authentication in a supported flow. Follow the provider’s documented response and recovery contract rather than retrying every decline unchanged. Distinguish a request for authentication, a failed challenge, an abandoned journey, an explicit authorisation decline and a technical failure.
Measure the actual path.
Track request type, authentication result, authorisation result, customer completion and later fraud or dispute outcomes. Compare mature cohorts at the same horizon. Do not assume every frictionless journey was exempt or that every abandoned challenge represents fraud prevented.
Brightwater’s on-sale may also differ from an ordinary weekday in legitimate demand, automation and ticket availability. Keep that alternative explanation visible before attributing any change to the exemption setting alone.
A way to work it.
- Confirm scope and applicable eligibility with the responsible provider.
- Separate frictionless authentication from exemptions in event records.
- Verify response handling and actual liability evidence.
- Compare matched or appropriately designed cohorts.
- Include legitimate-customer interruption and delayed outcomes.
- Set an owner, review point and stop conditions before a controlled change.
Take it to the desk.
Which checkout paths can you identify from authoritative records, and which are currently guesses based on whether the customer saw a challenge?
Continue with reading decline codes and the threshold cost matrix.
Fictional scenario. Synthetic data. No real customer records.
The desk card.
- Frictionless 3DS is not synonymous with an exemption.
- Confirm provider-level eligibility, not just merchant dispute rate.
- Authentication, authorisation and liability need separate records.
- Compare mature outcomes and customer impact by actual path.
One question for your team.
Which of our exemptions would we still choose if the liability shift did not exist?