Delegated authentication: A security essential plus strategic data asset

By Dewald Nolte, Co-Founder and Chief Strategy Officer, Entersekt

The payments landscape has undergone a significant transformation, from in-person card transactions to today’s mobile-first commerce, and shows no sign of slowing. The global mobile payment market is expected to grow to $218 billion in 2035, driven by rising smartphone penetration, government initiatives to promote cashless economies, and enhanced payment security.

These advances continue to create more authentication complexity that legacy payment processes struggle to address, leading to security, fraud, and compliance challenges. The impact is broad, with ramifications for consumers, businesses, and banks. Strong Customer Authentication (SCA) is designed to mitigate security breaches; however, when done incorrectly, it can negatively impact the customer experience.

But there doesn’t need to be a tradeoff between convenience and security. Today’s modernized payment systems can securely reduce friction while gaining valuable customer data and insights.

New solutions for modern payment needs

Delegated authentication was introduced to address a common challenge with 3-D Secure (3DS). In its initial version, 3DS redirected cardholders from the merchant page to their issuing bank for authentication using a static one-time password (OTP). The process was cumbersome for consumers, leading to high cart abandonment rates.

As a result, merchants sent only high-risk transactions to the issuer for approval. Issuers, in turn, saw 3DS traffic dominated by risky profiles and low-quality attributes, prompting them to adopt conservative decisioning and higher challenge rates. Consequently, issuers viewed 3DS as purely a risk signal with no intrinsic value.

Delegated authentication allows merchants to authenticate the customer and send proof onto the issuer for consideration, thereby essentially performing authentication on the issuer’s behalf. It was designed to create a more seamless process for consumers, but it stalled at the time due to a lack of standardization.

Today, an updated version of 3DS (EMV 3DS) is used to meet SCA requirements under PSD2 (and soon, PSD3) in Europe and similar regulations in other regions, such as the UK, Japan and India. While EMV 3DS is not mandated in the U.S., it’s increasingly implemented to prevent fraud and reduce chargebacks.

Authentication beyond biometrics

Most cardholders already use biometric authentication to access apps on their mobile devices and in browsers, and increasingly expect the same for online payments. Delegated authentication enables returning customers to use stored card details, which are verified with biometrics, delivering a secure, seamless cardholder experience. Even with biometrics, some instances still require additional authentication—for example, by means of a possession factor, like a passkey, to meet multi-factor authentication (MFA) conditions under PSD2.

3-D Secure Requester-Initiated (3RI) removes this barrier by allowing the merchant to securely initiate authentication and send the necessary data to the issuer for verification. This approach eliminates the need for customer authentication each time, since they have already approved a structured “mandate” ahead of time. In this model, when a subsequent 3RI transaction is triggered, it explicitly references that prior authorization mandate to prove the request matches the parameters the cardholder previously approved. The issuer can securely bypass a new active authentication challenge, resulting in faster evaluation, seamless approvals, and a higher conversion rate.

While 3RI relies on a pre-approved customer mandate for frictionless clearance, this broader EMV 3DS v2 framework utilizes comprehensive data sharing as a strategic asset. By using these deep contextual data elements to power RBA, issuers can safely reduce false declines, lower fraud losses, improve authorization rates, and deliver a seamless cardholder experience.

Securing agentic commerce

As agentic commerce becomes more widespread, demands on EMV 3DS and delegated authentication will continue to increase. Agent-initiated transactions will occur at a pace, volume and complexity that exceed human capacity, and without human biometrics, these transactions will require new authentication strategies.

Fortunately, agents are governed by well-defined frameworks that authorize them to act on behalf of consumers for various transactions. One example is an intent mandate where the cardholder sets up high-level, explicit parameters that allow the agent to act as a digital proxy for future purchases. For example, a concert-goer could instruct the agent to purchase tickets, providing the agent with details such as performer, date, price and location. Another is a cart mandate where the agent works alongside the customer to make selections and assemble a cart of goods or services for purchase.

Traditional Know Your Customer (KYC) frameworks are now extending into Know Your Agent (KYA). Establishing rigorous KYA protocols ensures that every digital intermediary is vetted for its technical origin, operational constraints and its relationship to the primary account holder. Treating AI agents as distinct, verifiable entities creates a secure framework that prevents unauthorized “shadow agents” from entering the payment ecosystem. For issuers, this helps build a strong agentic commerce foundation that mitigates fraud and supports regulatory compliance. Agentic commerce frameworks typically require agentic tokens to be issued to the agent, the scope of which is set up by the cardholder’s authentication mandate.

Combining EMV 3DS with tokenization

While payment tokenization and EMV 3DS have similar objectives—elevating security to mitigate fraud while reducing purchasing friction—they aren’t in competition with one another. Instead, the two technologies serve different but complementary purposes.

Tokenization replaces the cardholder’s Primary Account Number (PAN) with a secure token. By safeguarding payment credentials, tokenization reduces the risk of credential compromise and ensures compliance with industry standards. On the other hand, 3DS is designed to authenticate the payer and provide the issuer with the required data to ensure a secure transaction (regardless of whether it uses a token or a PAN).

In order for the synergy between EMV 3DS and tokenization to be truly effective, agentic commerce relies on cardholder mandates. These mandates prevent agents from executing unauthorized transactions without the user’s awareness. EMV 3DS offers a scalable solution for establishing and verifying these mandates, ensuring that agents operate strictly within their designated boundaries.

Overcoming legacy 3DS assumptions

Given its history, it’s not surprising that issuers view 3DS as a barrier. But EMV 3DS v2.x is a fundamentally different technology, allowing issuers to receive and process rich sets of data that feed their authentication engines with context they would not otherwise have. These enhanced capabilities, coupled with broader standardization that enables delegated authentication, allow EMV 3DS to deliver a secure, frictionless payment experience and supports modern and emerging commerce patterns such as agentic commerce.

By using EMV 3DS to drive context-aware, data-backed authentication choices, issuers can dramatically reduce false declines and eliminate lost revenue on the authorization leg of the transaction. Higher authorization rates mean a fundamentally better experience for everyone involved—merchant, cardholder, and issuer alike. Treating authentication data as a strategic asset rather than an isolated compliance check, issuers can perfectly align their security interests with the merchant’s growth goals.

The good news is the infrastructure already exists; it just requires the right collaborative strategy to succeed.

About the author

Dewald Nolte is the Co-Founder and Chief Strategy Officer at Entersekt, a fintech company specializing in secure digital banking and payment authentication solutions. He helped establish Entersekt in 2008 to provide transaction authentication using digital certificate technology deployed to mobile phones. He’s a computer engineer by training, but swapped writing code for driving innovation and identifying new ways in which organizations can unlock their potential through digital transformation.

Article Topics

agentic commerce  |  authentication  |  biometrics  |  digital payments  |  Entersekt  |  tokenization