Strong authentication: when to require verification in checkout

What happens when checkout requires authentication?

After the customer enters their card details, they're redirected to their bank's page where they enter a password, use their banking app, or confirm with biometrics. This page feels like an extra blocker. The customer sees their purchase is paused waiting for confirmation, and some abandon right there.

But in the background, that abandonment has value. When the customer authenticates, the bank keeps a record. If they later open a dispute claiming they didn't make the purchase, the bank compares against the authentication record and denies the chargeback most of the time. The responsibility shifts: from you to the customer.

Without strong authentication, every dispute gets treated as potentially your fault. With authentication, the bank has proof that whoever made the purchase authenticated themselves. That's gold for reducing chargebacks, but the cost is conversion that drops because some customers abandon the extra verification screen.

Is strong authentication mandatory in Europe?

In many cases, yes. Since 2019, the PSD2 (Payment Services Directive 2) established SCA, Strong Customer Authentication. It's not exactly the same as 3D Secure, but it works similarly: it requires the customer to prove who they are.

Rules vary by transaction type and bank. Single purchases above a certain amount, recurring purchases (subscriptions), and transfers between accounts generally require SCA. Your payment gateway must respect these local rules automatically when you sell in Europe.

Don't try to bypass the law by activating authentication only sometimes or for select customers. Banks and regulators monitor this. Confirm with your payment processor that they apply local authentication rules. If the law requires authentication and you don't activate it, the bank can block the transaction or deny coverage if a dispute occurs.

Does authentication really reduce chargebacks?

Yes, significantly. When the customer authenticates at their bank, a record is created. If they later open a dispute claiming they didn't make the purchase (friendly fraud), the bank sees the authentication record and denies the chargeback. You stay protected.

Strong authentication is a powerful tool against disputes, especially if you sell to multiple countries where some customers tend to open disputes and challenge transactions when results don't meet expectations.

But there's a catch: some genuine customers also abandon when they see the authentication screen. They're scared they'll lose the purchase if they enter their password wrong, or they just find it annoying. That's why you need to balance: authentication for high security and minimal authentication for high conversion.

When does authentication drop conversion?

When you require it on every purchase, without exception. If every customer, even repeat buyers, goes through authentication, conversion drops. This impact is especially visible with new customers and high-value transactions.

The right approach is to require authentication selectively, only when risk is high. Most payment gateways let you set rules based on:

• Large purchase: transactions above an amount you set (example: USD 100) trigger authentication.
• New customer: first purchase on your account, or card never seen before, triggers authentication.
• High-risk country: some countries have higher dispute rates. Trigger authentication just for those.
• Suspicious pattern: multiple purchases in sequence or unusual times can trigger authentication.

Start with authentication required only on high-value purchases. Measure conversion and chargebacks. If the chargeback reduction justifies the conversion drop, keep it. If conversion drops too much and chargebacks don't budge, adjust the rules with your payment processor.

How to configure authentication in your checkout?

Authentication configuration depends on your payment processor. Each gateway has its own documentation and control panel. In general, you'll need to:

1. Access your processor's configuration panel.
2. Find the authentication, security, or strong authentication section.
3. Set the rules (minimum amount, by country, by customer type).
4. Save the changes and test with a real transaction.

After setup, test with a real purchase to confirm that authentication is asking for verification in the situations you chose, and letting purchases through when you don't require it. Monitor your conversion rate and chargebacks to adjust the rules as you learn how customers react.

Where does Mundpay fit in authentication?

Mundpay's proactive risk team works to resolve chargebacks before they're finalized. Learn more in how to protect your operation against chargebacks and how the pre-chargeback system works.

If you sell internationally, confirm with your payment processor how it respects country differences: Europe requires SCA, some countries require mandatory authentication above a threshold, others leave it to the merchant's discretion. The important thing is choosing a payment gateway that complies with these local rules automatically, without you having to program for each market.

Sources consulted

• European Banking Authority: PSD2 SCA Regulatory Technical Standards
• EMVCo: 3D Secure Protocol