3D Secure 2.0 Risk-Based Authentication Engine

Risk Engine Controls

Frictionless ceiling (SCA exemption) 30 Transactions scoring at or below this pass with no challenge.

Step-up ceiling (challenge cutoff) 70 Above this, the transaction is declined outright instead of challenged.

Attacker rate 6% Share of incoming transactions that are actually fraudulent.

Transaction rate 6/s

Live Metrics

Fraud caught

—

Fraud missed

—

False declines

—

Frictionless rate

—

Transactions processed

Frictionless approval

Approved after step-up (OTP)

Blocked / declined

Dark ring = actually fraudulent (ground truth)

How it works

Every transaction gets a 0–100 risk score from a weighted blend of signals, the same shape real 3DS2 / PSD2 risk-based authentication (RBA) engines use:

S = 0.25·D + 0.25·G + 0.20·A + 0.15·M + 0.15·B

D = device/browser trust anomaly
G = geo-velocity anomaly (impossible travel, new IP)
A = amount-vs-history anomaly
M = merchant-category risk
B = behavioral-biometric anomaly (typing, motion)

The decision follows PSD2-style thresholds:

S ≤ low    → frictionless (SCA exemption, issuer liable)
low < S ≤ high → step-up challenge (OTP / biometric)
S > high   → declined outright

Legitimate and fraudulent traffic have overlapping score distributions — no threshold is perfect. Lowering the frictionless ceiling catches more fraud but pushes honest customers into a challenge; raising the decline floor blocks fewer legitimate sales but lets more fraud slip through frictionlessly.
A step-up challenge (simulated OTP/biometric) is assumed to stop about 85% of fraud that reaches it — the rest is a missed detection even after friction.
The dark ring marks a transaction that is actually fraudulent regardless of the engine's decision, so you can see false negatives (green ring) and false positives (red, no ring) directly.

This is the real tension every card network and issuer tunes daily: fraud loss vs. checkout friction vs. lost legitimate revenue.

Frictionless Step-up (OTP) Decline

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.