IT lexicon › Security › Decoupled authentication

Decoupled authentication

Security På svenska → Updated: 2026-10-31

The 3-D Secure mode in which the cardholder confirms a purchase later, and somewhere other than the checkout.

Regular 3DS assumes the customer is sitting at the screen and can answer a challenge while the purchase is in progress. That falls apart when an order is taken over the phone, when a subscription is changed, or when someone is shopping on another person's behalf. EMV 3DS 2.2, released in 2018, therefore added decoupled authentication: the merchant requests authentication, the issuer's ACS reaches the cardholder through its own channel, usually the banking app, and the result is delivered after the fact.

The merchant ends up waiting minutes rather than seconds for an answer and has to design its flow around that. In return, strong customer authentication becomes possible even when the customer isn't at the checkout — precisely the case the regulation forgot about.

← Back to the lexicon