The verdict in three sentences
3D Secure 2 (3DS2) is unavoidable for card payments, but a systematic challenge scares off one customer in four (27 % challenge abandonment). The right decision is adaptive friction: impose the challenge only on risky transactions and let trusted payments through frictionless, worth about 8 points of conversion. On mobile, favour app-based authentication (89 % success) over SMS OTP (71 %).
Why a systematic challenge is costly
In anglophone Africa, a growing share of card payments runs through PSPs like Flutterwave or Paystack that support 3DS2. The trap is enabling the challenge on 100 % of transactions "to be safe". The result: massive abandonment at the most sensitive moment, just before validation.
| 3DS step | 2026 abandonment (est.) | Main cause |
|---|---|---|
| Redirect to challenge | 27 % | Friction, distrust |
| SMS OTP entry | 29 % of the rest | OTP not received / slow |
| OTP timeout (5 min) | Variable | Wait too long |
| Bank app auth | 11 % | Smooth, biometrics |
The contrast is clear: SMS OTP succeeds at about 71 %, while authentication via the banking app reaches 89 %. When the channel exists, the app should be preferred.
Adaptive friction: the right trade-off
Adaptive friction (or "frictionless" 3DS when risk is low) lets the PSP and issuer decide whether a challenge is needed, based on risk signals. Low-amount, low-risk transactions pass without a challenge; only suspicious ones are challenged.
| Approach | Conversion | Fraud | Recommendation |
|---|---|---|---|
| Systematic challenge | Base -8 pts | Very low | Avoid |
| Adaptive friction | +8 pts | Low | Recommended |
| Low-value exemption (< 30 EUR) | +slight | Controlled | For small baskets |
| No 3DS | Maximum | High + non-compliant | Forbidden |
The low-value exemption is a useful lever: below about 30 EUR (~20,000 FCFA), a transaction can often pass without a challenge, subject to issuer rules. Combined with adaptive friction, it gives the best conversion/security balance. Also mind the 5-minute OTP timeout: beyond it users abandon, so a fast OTP and easy resend are critical.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Fatou sells online courses from Accra, with 1,000 card payments a month and an average basket of 25,000 FCFA. With a systematic 3DS challenge, she lost 27 % at the challenge, crushing card conversion.
By switching to adaptive friction (+8 pts) and pushing app-based authentication when available, Fatou recovers about 80 extra transactions a month. At 25,000 FCFA, that is 2M FCFA of extra monthly revenue, while staying 3DS2 compliant.
FAQ
Is 3DS2 really mandatory? Yes for card payments, strong authentication is the norm. The choice is not whether to enable it, but how: systematic (costly) or adaptive (recommended).
Why does SMS OTP convert worse? About 71 % success versus 89 % for the app: SMS can be slow, unreceived, or expired. When the banking app is available, it is smoother thanks to biometrics.
What is the low-value exemption? Below about 30 EUR, a transaction can often pass without a challenge, improving conversion on small baskets, within issuer rules.
How long does an OTP last? Usually 5 minutes. Beyond that users abandon. A fast OTP and a "resend code" button limit losses.
Do Flutterwave and Paystack handle 3DS2? Yes, both support 3DS2 and adaptive friction, giving compliance and good conversion without building authentication yourself.
Let's talk about your project. We configure 3DS2 with adaptive friction to maximise conversion and compliance. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
