Challenge flow
The branch of 3-D Secure where the issuer doesn't trust the risk score and asks the customer to prove who they are.
In EMV 3DS the merchant first sends an authentication request packed with device and purchase data. The issuer's Access Control Server replies with a status: Y means the purchase sailed through frictionlessly, C means a challenge is required. The ACS then takes over through the CReq/CRes message pair, either in an embedded browser frame or inside the merchant's app via the 3DS SDK. The challenge might be a one-time code by SMS, a biometric prompt or, increasingly, a tap in the banking app. Version 2.2 added a decoupled mode where the customer can approve later, up to a week afterwards.
Every challenge costs conversions, which is why issuers use them sparingly and merchants lobby for exemptions from strong customer authentication. A successful challenge still earns the liability shift, which is what the merchant is really paying for.