3D Secure (3DS) is a protocol used to authenticate cardholders during online card payments. It helps reduce fraud and supports regulatory requirements such as Strong Customer Authentication (SCA).
When 3DS is required
3DS authentication can be:
Frictionless, where no user interaction is required
Challenge-based, where the user must actively authenticate
Types of authentication
Cards can be enrolled for one or both methods. When both are enabled, biometric authentication takes priority.
In case both methods are enabled, cardholders can choose the preferred one for each payment.
SMS One-Time Password (OTP) and Static Password
Authentication is performed using an SMS-delivered OTP and a static password set by the cardholder. This method requires a verified phone number for the end customer.
Biometric Authentication
Biometric authentication can be integrated into a partner’s mobile application. Paynetics sends an authorisation request via webhook, which the partner must present to the end customer. The customer can approve or reject the transaction using Strong Customer Authentication (SCA). Once approved, the partner must confirm authorisation via API.
3DS page modifications
*Additional costs may apply on the Partner side. Please contact the Paynetics Project Manager or Account Manager to support you with providing a quotation.
What CAN be customized
A. Text content (within strict limits)
Across almost all screens (Choice, OTP, OOB, Biometric, KBA, Error, Blocked):
Headline text
Typically 45–50 characters
Body / message text
Up to 350 characters (browser & most native flows)
Some native error / fail screens: 170 characters
Error messages
OTP errors (empty input, incorrect code, max retries)
OOB / Biometric validation errors
Button labels
e.g. Submit, Continue, Resend code, Close
Informational expandable text
“Need help?”, “More information” sections
B.Replaceable (dynamic) values
You cannot invent new replaceables, but you can include or exclude supported ones in your message text:
Supported replaceables include:
{Merchant Name}{Purchase Amount}(omit for NPA flows){Date}(format selectable:mm/dd/yyyyordd/mm/yyyy){Masked PAN}{Credential Type}(SMS, email, app, etc.){Credential Text}(masked phone/email)
These count toward the 350-character limit
C. Optional elements (show / don’t show)
You can configure visibility of:
Authentication methods
SMS, Email, OOB App, Biometric, Voice (if supported)
Optional buttons
“Choose another method”
“Having trouble?”
Expandable informational links
Browser: only on Choice & Validate
Native app: available on all screens
Fail with Feedback / Blocked / Error screens
These are optional flows
D. Branding
Issuer logo (required)
Network logo (Visa / Mastercard placement fixed)
Logo format: PNG with transparency, recommended 200×70 px
What CANNOT be customized
A. Screen structure & layout
You cannot change:
Screen flow or order
Zones (Header, Branding, Challenge, Info)
Field placement (OTP input, buttons, errors)
Visual hierarchy
B. Mandatory buttons & labels
The following must appear and are not editable (text change only allowed via translation):
EXIT
CONTINUE (Native App OOB & Biometric)
CLOSE (Blocked / Error / Fail screens)
C. Authentication logic & behavior
You cannot control:
OTP generation / retry logic
Max resend attempts
When a card becomes blocked
When Fail with Feedback vs Error is triggered
Frictionless vs Challenge decisioning
D. Dynamic RDX response content
RDX response text (shown on Fail / Blocked / Error screens)
Returned from backend
Not editable in templates
E. Styling & visual design
You cannot customize:
Fonts
Colors
Button shapes
Icons
Spacing
Animations
Only content, not design system, is customizable.