What Is a 3DS Challenge Loop
3D Secure (3DS) is an additional authentication protocol used in online payments. In version 3DS2, there are two possible flows:
- Frictionless flow — the bank approves the transaction silently without user interaction.
- Challenge flow — the bank requires additional verification: an OTP code, biometrics, or in-app confirmation.
A challenge loop occurs when the confirmation window opens, you enter the code or press "confirm," but the page reloads and asks for the same action again. The process repeats indefinitely and the payment never completes.
Why It Happens
Several factors can cause this:
- Bank-side issue. The bank's ACS server (Access Control Server) fails to send a valid response back to the merchant's site.
- Browser restrictions. Same-Site cookie policies or third-party cookie blockers prevent the authentication token from passing between iframes.
- Session timeout. The 3DS session expired before you completed authentication.
- Mobile banking app deep-link issue. The link from the browser into the banking app does not return you back to the payment page.
- Protocol version mismatch. The merchant requests 3DS2 but the bank returns a 3DS1 response, causing a desynchronization.
Fix Steps
Try a different browser. Open the checkout page in Chrome or Firefox instead of Safari. Disable ad blockers and extensions.
Allow third-party cookies. Temporarily enable third-party cookies in browser settings — they are required for passing the 3DS authentication token.
Use a desktop instead of mobile. If paying on a phone causes the banking app to open, try completing the payment on a computer instead.
Clear cache and cookies. Stale session data can cause session conflicts.
Switch networks. Toggle from Wi-Fi to mobile data or vice versa.
Contact your bank. If the issue repeats across multiple sites, the problem is likely with your bank's ACS server. Report it to their support team.
Use a Marix card. Marix cards are issued by banks with modern, properly configured 3DS2 servers, eliminating these kinds of loops.
FAQ
Will I be charged if 3DS gets stuck in a loop? No. Until authentication completes successfully, no authorization is sent and no funds are charged.
How do I tell if the problem is my browser or my bank? If the loop only happens on one site, the issue is likely with the merchant or browser. If it happens everywhere, your bank's ACS server is the likely culprit.
Can a VPN cause a 3DS loop? Yes. A VPN can interfere with the redirect between the merchant site and the bank's ACS server. Try disabling it.
Tired of 3DS authentication issues? Try Marix. Virtual cards work with modern 3DS2 servers for smooth, loop-free authentication.