Home Blog FinTech and Embedded Finance Payment gateway security: tokenization and 3DS2 guide
FinTech and Embedded Finance February 21, 2026 11 min read

Payment gateway security: tokenization and 3DS2 guide

FinTech and Embedded Finance Enterprise Guide 2026 SCALE D2C D2C Technology FinTech and Embedded Finance Enterprise Guide 2026 SCALE D2C D2C Technology

Payment security in 2026 rests on two foundational technologies: tokenisation, which eliminates sensitive card data from your systems entirely, and 3D Secure 2 (3DS2), which provides strong customer authentication with friction calibrated to transaction risk. Together they address the two leading vectors of payment fraud — card data theft and CNP (card-not-present) fraud — while maintaining the checkout conversion that drives payment business outcomes.

The Payment Security Landscape in 2026

Online card fraud costs merchants approximately $48 billion annually globally, with card-not-present fraud representing over 80% of card fraud losses. The payment industry's response has been two complementary security technologies: tokenisation removes the primary attack target (the card number) from merchant systems entirely, and 3DS2 verifies that the person using the card is the card owner — closing the fraud window even when card details are compromised.

For enterprise payment architects, both technologies are now regulatory requirements in key markets (PSD2 SCA mandates 3DS2 for European transactions), contractual requirements from card schemes (PCI DSS requires tokenisation for stored card data), and practical necessity for fraud rate management (issuers reject high-fraud merchants through decline rate pressure). This guide covers implementation requirements for both.

Payment Tokenisation
Replacing a sensitive payment credential (PAN — Primary Account Number) with a non-sensitive substitute (token) that can be used for payment transactions but has no value to attackers who steal it. Tokens are typically specific to a merchant, a payment channel, or a device — limiting the scope of any compromise to the specific context where the token was generated.
88%
Reduction in card-present fraud in markets that transitioned to chip + PIN + tokenisation versus magnetic stripe transactions, per EMVCo data
1.8%
Average authorisation rate improvement when switching from static PAN to network tokens — as network tokens benefit from issuer-side fraud scoring advantages
15–25%
Reduction in fraud-related chargebacks for merchants implementing 3DS2 with intelligent SCA exemption management versus unoptimised 3DS implementations

Payment Tokenisation: Types and Architecture

Network tokens (issued by Visa Token Service, Mastercard Digital Enablement Service, or American Express Token Service) replace the card's PAN with a token issued directly by the card network. Network tokens are portable across payment processors — the same token works regardless of which acquirer processes the transaction. Crucially, network tokens benefit from issuer-side optimisations: issuers treat network-tokenised transactions as lower risk, producing higher authorisation rates (typically 1–3% improvement) compared to equivalent PAN-based transactions. Network token integration requires working with a payment processor that supports the Token Requestor role.

Gateway tokens (PSP tokens) are issued by the payment gateway or processor, replacing the PAN in the merchant's systems with a gateway-specific substitute. Gateway tokens are simpler to implement than network tokens but are processor-specific — switching processors requires migrating all stored tokens through a migration process. For new implementations in 2026, network tokens are strongly preferred over gateway tokens due to portability and authorisation rate benefits.

Merchant tokenisation (replacing the PAN on the merchant's own servers) addresses PCI DSS scope reduction — a tokenised card number stored in the merchant's database has no value if the database is breached. This is the baseline PCI DSS requirement for stored card data and is typically handled by the payment gateway rather than requiring merchant-side cryptographic infrastructure.

Tokenisation architecture for stored card data: at checkout, the browser or mobile app sends card data directly to the payment gateway (never touching the merchant's servers — reducing PCI scope to SAQ A for e-commerce), the gateway returns a token, and the merchant stores only the token for future transactions. For subscription billing, this token enables future charges without re-entering card details — critical for subscription conversion and involuntary churn reduction.

3D Secure 2: How It Works and Why It Matters

3DS2 is the second generation of the 3D Secure authentication protocol, standardised by EMVCo and required for PSD2 Strong Customer Authentication compliance in Europe. It addresses the critical failure of 3DS1 — disruptive authentication friction that caused 30–40% cart abandonment — with a risk-based authentication model that reduces friction to near-zero for low-risk transactions while applying strong authentication only when genuinely warranted.

Frictionless flow handles 90–95% of transactions in optimised implementations without any customer authentication prompt. The issuer evaluates 100+ data points transmitted in the 3DS2 authentication request — device fingerprint, shipping address consistency with previous transactions, transaction velocity, behavioural biometrics — and approves low-risk transactions in the background without any customer interaction. The customer experiences a seamless checkout with no authentication prompt.

Challenge flow applies when the issuer's risk engine scores a transaction as higher risk. The customer is prompted for additional verification — biometric authentication, one-time passcode, or in-app approval through their banking app. 3DS2's challenge experience is significantly less disruptive than 3DS1's redirect to external authentication pages.

SCA exemptions enable merchants and payment processors to request that specific transactions bypass SCA entirely under PSD2's exemption framework: low-value transactions (under €30), trusted beneficiary (customer has whitelisted the merchant), low-risk transactions (transaction risk analysis — TRA exemption), and merchant-initiated transactions (subscriptions, recurring charges). Intelligent exemption management that maximises exemption application to low-risk transactions is where 3DS2 optimisation generates the most conversion value.

Feature3DS13DS2
Authentication experienceRedirect to issuer page, static passwordIn-checkout, risk-based, biometric-capable
Data points for risk scoring~15100+
Frictionless rate (optimised)0%90–95%
Mobile app supportPoorNative (in-app challenge)
SCA exemptionsNot supportedFull exemption framework
Liability shiftOn authenticationOn authentication

Implementing Tokenisation and 3DS2

For most merchants, tokenisation and 3DS2 are implemented primarily through the payment processor rather than custom development. Select a payment processor with native network token support (Adyen, Stripe, Braintree), integrated 3DS2 implementation, and intelligent SCA exemption logic. The configuration work involves: enabling network token provisioning in processor settings, configuring 3DS2 with appropriate exemption triggers, and implementing the frictionless/challenge flow in your checkout UI.

The critical custom integration work is in SCA exemption decision logic — determining which transactions to request exemptions for, which to submit for 3DS2 authentication, and which to route through merchant-initiated transaction (MIT) pathways for subscription charges. This logic should be regularly reviewed against fraud rate data and conversion metrics to optimise the balance between fraud protection and checkout friction.

Network Token vs Gateway Token Comparison

🔗
Network Tokens: Advantages
Processor portability (switch processors without token migration), higher authorisation rates (1–3% improvement from issuer-side optimisation), automatic card lifecycle management (expiry updates pushed to token without customer re-entry), and card-on-file fraud liability shift benefits. Preferred for new implementations and subscription businesses.
🏦
Gateway Tokens: Use Cases
Simpler implementation via single processor API, sufficient for merchants with no plan to switch processors, and adequate for PCI DSS scope reduction where processor portability is not required. Most existing card-on-file implementations use gateway tokens. Migration to network tokens is advisable at contract renewal for merchants on high-volume subscription businesses where the authorisation rate improvement provides material revenue impact.

Payment Security Implementation Roadmap

1
Audit
Audit current PAN data flows and storage

Map all locations where card data currently exists in your systems: checkout flow, order records, logs, analytics events, third-party integrations. Every PAN exposure point is a PCI DSS scope element and a breach risk. Most organisations discover unexpected PAN data in logs and analytics systems during this audit — these must be remediated before tokenisation is complete.

2
Tokenisation
Implement network tokenisation via payment processor

Enable network token provisioning through your payment processor. Migrate existing stored card-on-file data to network tokens if the processor supports bulk migration; otherwise migrate organically as customers re-transact. Verify that no PAN data persists in application databases, logs, or analytics after tokenisation implementation.

3
3DS2
Configure 3DS2 with optimised exemption logic

Enable 3DS2 through your payment processor with initial conservative exemption settings. Monitor frictionless rate, challenge rate, fraud rate, and conversion rate for 4–6 weeks. Iteratively optimise exemption thresholds based on observed fraud rates by exemption type, transaction value band, and customer risk profile.

Frequently Asked Questions

PCI DSS does not explicitly require tokenisation but provides significant scope reduction incentives for it. Merchants who tokenise card data at the point of entry (cardholder data never enters merchant servers — only the token does) can potentially qualify for SAQ A (simplest self-assessment questionnaire), dramatically reducing compliance burden. Merchants who store PANs internally must comply with the full PCI DSS standard, including network segmentation, encryption, access controls, and annual penetration testing. The compliance cost differential between SAQ A and full PCI DSS assessment typically justifies tokenisation purely on compliance grounds, even before fraud reduction benefits are considered.

Well-implemented 3DS2 has negligible or positive conversion impact versus no authentication. The frictionless flow (90–95% of transactions) adds no customer-visible step. The challenge flow (5–10%) adds an authentication step that converts at 85–90% for biometric challenges and 70–80% for OTP challenges — versus the baseline fraud-related declines that would occur without authentication. The net effect for most merchants is conversion-neutral or slightly positive (fewer fraud-related declines) while providing fraud protection and chargeback liability shift. Poorly configured 3DS2 — with low exemption rates causing excessive challenge flows — can reduce conversion by 5–15% for affected transactions.

Yes — successful 3DS2 authentication provides chargeback liability shift for fraud-related chargebacks (dispute reason codes related to unauthorised use), shifting liability from the merchant to the issuing bank. This is one of the primary commercial motivations for 3DS2 beyond SCA regulatory compliance. Liability shift applies only when the authentication completes successfully (frictionless approval or completed challenge) — transactions where 3DS2 was attempted but the issuer was not 3DS2-capable, or where authentication failed, do not receive liability shift. Track liability shift rate as an operational metric to ensure your 3DS2 implementation is achieving the intended protection.

3DS2 authentication requests transmit up to 150 data elements to the issuer for risk scoring, including: device fingerprint (browser/device characteristics, IP address, user agent), transaction data (amount, currency, merchant category code), cardholder data (billing address, email, phone), previous transaction history with this merchant (velocity, past authentication results), shipping information, and behavioural signals (typing patterns, interaction timing on the checkout page). The richness of this data is what enables issuers to make accurate frictionless/challenge decisions — merchants who provide complete, accurate data consistently achieve higher frictionless rates than those with sparse data. Merchants should not omit optional fields to save development effort; each additional data element improves frictionless rate accuracy.

Subscription and recurring transactions after the initial authenticated transaction are classified as Merchant-Initiated Transactions (MIT) under PSD2, which are exempt from SCA requirements. The initial subscription setup (first charge or free trial start) must complete SCA authentication (3DS2 challenge or frictionless approval). Subsequent recurring charges reference the original MIT agreement identifier established during the initial authenticated transaction and do not trigger 3DS2 authentication. This is critical for subscription businesses to configure correctly — applying SCA to every recurring charge would create authentication friction that damages subscriber retention. Work with your payment processor to correctly implement MIT exemption workflows for your subscription billing engine.

Exemptions are PSD2 regulatory provisions that permit SCA to be omitted for specific transaction types (low-value, TRA, trusted beneficiary, MIT) — the issuer can override a requested exemption and request authentication anyway, but the transaction is SCA-exempt if the issuer accepts. Exclusions are transaction types that are completely outside PSD2's SCA scope: one-leg transactions (merchant or customer outside EEA), corporate payment cards, anonymous prepaid cards, and mail/telephone order transactions. For excluded transactions, 3DS2 is optional. Misclassifying exclusions as exemptions or vice versa leads to either unnecessary SCA friction or potential regulatory violations for transactions that should have been authenticated. Consult payment legal counsel for your specific transaction mix if boundary cases arise.

No — both technologies significantly reduce fraud but do not eliminate it. Tokenisation eliminates the value of stolen card data for card-not-present transactions (a stolen network token is useless without the associated device binding or merchant context). 3DS2 prevents unauthorised use by verifying cardholder identity for CNP transactions. The residual fraud vectors that both technologies do not prevent: social engineering (phishing the cardholder into completing 3DS2 authentication for a fraudulent transaction), account takeover (fraudster controls the authenticated customer account), first-party fraud (genuine cardholder disputes a legitimate transaction), and merchant fraud. A complete fraud management strategy includes tokenisation, 3DS2, velocity checks, machine learning fraud scoring, and chargeback dispute management — not just authentication and tokenisation infrastructure.

This is one of the most operationally valuable aspects of network tokens for subscription and card-on-file businesses. Network tokens remain valid across card expiry and card replacement events — when a cardholder receives a new physical card (new expiry, new PAN), the card network automatically updates the binding between the existing network token and the new card credentials. The merchant's stored token continues to work for future charges without any customer re-entry action. This eliminates a major source of involuntary churn for subscription businesses — failed charges at card expiry due to outdated stored card data. The industry average involuntary churn reduction from network token automatic card updates is 1.5–3% of subscription bases annually.

PAYMENT GA

Ready to Implement Payment gateway security: tokenization and 3DS2 gu...?

Our specialist team delivers measurable ROI from FinTech and Embedded Finance programmes for enterprise and D2C brands.

Free Audit