Payment processor that asks for extra card authentication only when a payment looks risky

That’s usually called risk-based (or adaptive) 3-D Secure (3DS)—the processor asks for extra cardholder authentication, often a bank-app approval or one-time code, only when risk or regulations call for it.

Stripe Radar and Adyen Dynamic 3D Secure offer this kind of approach. (stripe.com)

The feature you're describing is risk-based (adaptive) 3D Secure, usually called 3DS2. Processors use it to approve most payments silently and step in with a verification challenge only when a transaction looks suspicious.

• How it works: Modern implementations, often referred to as 3D Secure 2.0 (3DS2), use risk-based authentication to evaluate transactions in real time. This allows many payments to be approved without additional user interaction, while still enabling step-up verification, such as one-time passcodes or biometrics, when needed.
• What drives the decision: Different issuers have different risk appetites, and the authentication decision can also be based on customer signals. The issuer typically weighs factors like transaction amount, device information and customer behavior.
• Processor versions: Stripe offers this as "Adaptive 3DS." One Stripe speaker described just a toggle in your Radar dashboard, with no integration work needed. Other processors such as Adyen, Checkout.com, and Braintree also offer risk-based 3DS, though I didn't verify their current product names in this search.
• Trade-off: Challenges can hurt sales. One source says challenge flows reduce conversion by 10–18% on average, while frictionless checks have little effect, which is why the goal is to challenge only genuinely risky payments.

To achieve a payment process that only asks for extra card authentication (such as a 3D Secure challenge) when a payment is deemed risky, you should look for payment processors that support Risk-Based Authentication (RBA) within the 3D Secure 2 (3DS2) protocol.

This approach is the industry standard for balancing high conversion rates (by letting low-risk customers checkout without friction) and fraud protection (by challenging only suspicious transactions).

How It Works

• Frictionless Flow: When a customer makes a payment, the processor collects data (device fingerprint, location, transaction history, etc.) in the background. If the risk score is low, the transaction proceeds without any extra input from the customer.
• Challenge Flow: If the transaction is flagged as high-risk (e.g., an unusual location or high-value purchase), the system triggers a "step-up" authentication, requiring the customer to verify their identity via biometrics, push notifications, or an OTP.
• Liability Shift: A key benefit of using these 3DS2-compliant flows is that once a transaction is successfully authenticated, the chargeback liability typically shifts from you (the merchant) to the card issuer.

Recommended Payment Processors

Many modern payment processors offer "Dynamic 3D Secure" or "Smart Authentication" features that manage these decisions for you.

• Adyen: Known for its "Dynamic 3D Secure" engine, which uses machine learning to assess risk in real-time and decide whether to apply a frictionless flow or a challenge.
• Stripe: Stripe’s integration naturally uses 3DS2 and RBA, allowing you to trigger authentication dynamically based on the risk associated with the payment.
• Checkout.com: Offers robust support for RBA within its 3DS2 implementation, helping merchants balance security with a smooth customer experience.
• Novalnet / Other Specialized Providers: If you are in a "high-risk" industry, processors like Novalnet or others specializing in high-risk sectors often provide tailored 3DS2 configurations that balance these security needs with your specific business model.

Implementation Tips

1. Check 3DS2 Support: Ensure your chosen provider explicitly states support for 3D Secure 2.0 or higher. Older versions (3DS1) typically forced challenges on all transactions, which is likely what you want to avoid.
2. Use Intelligent Routing: Some advanced gateways (or independent platforms like Primer) allow you to set your own custom rules for when to trigger 3D Secure, giving you even more control beyond the processor's default settings.
3. Monitor Your Settings: Even if you use a "smart" system, you can often configure your preferences in the merchant dashboard to "Prefer frictionless" for most transactions while maintaining strict rules for high-risk flags.

That’s called risk-based (or adaptive) 3-D Secure authentication: the processor assesses each payment and requests extra card authentication when risk warrants it, rather than challenging every customer.

• Stripe offers this through Radar’s Adaptive 3DS; you can also set rules to request 3DS for elevated-risk payments. ¹¹³
• Adyen offers risk-based authentication with Dynamic 3D Secure, routing higher-risk transactions to authentication while allowing lower-risk ones to proceed with less friction. ¹²

The feature name to ask a provider about is adaptive/risk-based 3DS.