The conversion paradox: 3DS trends in regulated markets

Authentication volume doesn't predict conversion outcomes

In regulated markets, the expectation has often been that higher rates of 3D Secure (3DS) authentication mean more checkout friction and, consequently, lower conversion. Data from Stripe's analysis of businesses in the European Economic Area (EEA), the United Kingdom, and Japan suggests otherwise. The relationship between how often transactions are challenged and how often they convert is not straightforward.

The key finding: France, the UK, and Japan all maintain high conversion rates even with very high two-factor authentication trigger rates. The data points to implementation quality—not usage volume—as the determining factor for business impact.

France: High challenge rates, steady performance

In response to elevated fraud levels, the Banque de France introduced requirements aimed at boosting 3DS adoption, such as recommending that issuers decline merchant-initiated transactions that were not set up with strong authentication. The result has been a markedly different challenge profile compared to neighboring markets.

In the first half of 2024, French issuers challenged transactions with two-factor authentication at rates nearly 100% higher than the rest of the EEA and 200% higher than UK issuers. Over the same period, 3DS request rates rose 15% while frictionless authentication flows—which skip the challenge step—increased by 40%.

Despite the higher challenge frequency, French conversion performance has remained strong. Part of the explanation is that French issuers now approve more Strong Customer Authentication (SCA) exemption requests when richer transaction data accompanies them over 3DS rails. Cultural factors play a role as well: France's early adoption of chip-and-PIN cards accustomed cardholders to two-factor authentication well before many other countries, making challenge completion more likely.

UK: A mature ecosystem with higher success rates

Among regulated markets, the UK leads in both authentication and challenge success. UK authentication success rates run 5%–10% higher than comparable SCA markets, and UK issuers accept exemption requests at rates 10 percentage points above EEA issuers.

The UK's regulatory timeline contributed directly to this performance. The Financial Conduct Authority granted UK businesses an extra year for SCA implementation, giving issuers time to invest in risk-based decisioning. Infrastructure improvements also reduced friction during challenges: over 75% of UK challenges are now authenticated through a bank app, predominantly using biometrics, rather than one-time passwords.

Japan: A new mandate without the usual conversion dip

Regions newly subject to strong authentication rules historically see conversion dip as banks, businesses, and processors adjust their interpretations. Japan's April 2025 mandate tells a different story. Transaction volume routed through 3DS quadrupled after the mandate, yet payments performance held steady: 60% of transactions flowed through the frictionless pathway, and businesses recorded an average 93% conversion rate.

Japanese cardholders' existing familiarity with one-time password– and banking app–based authentication contributed to high challenge success rates from the start. Early dispute data also indicates the mandate is meeting its fraud-reduction objective: dispute rates are more than 30% lower than the same period last year.

Some pockets of transactions did see lower authentication success initially. Stripe reports resolving these by working directly with issuers and using AI models to configure the data fields in each 3DS request based on issuer preferences.

Strategy implications for regulated markets

The data suggests that businesses operating across these regions should tailor authentication approaches per market rather than applying one uniform European strategy. Exemption requests, challenge design, and local cardholder norms all influence the relationship between authentication and conversion.

On average, businesses in SCA regions can see a 1.20% uplift in conversion along with a 7.67% reduction in fraud on all transactions when using AI-powered optimizations, per Stripe's data. Businesses in Japan averaged 93% conversion following the mandate's launch with no reported incidents.

Practical levers for authentication strategy in regulated markets include:

• Using built-in AI-based optimizations to select the optimal protocol and authentication pathway automatically, including relevant risk-based regulatory exemptions.
• Running 3DS authentication through Stripe while authorizing the payment with another processor.
• Applying intelligent 3DS triggers that optimize for payments, fraud, or conversion outcomes. Early users of a new multihead decisioning model have recorded over 30% fraud reduction on eligible transactions.