krunner

[umbral mason]

HI 👋 the user can't authenticate an off_session payment, so the payment will fail and you will need to bring your customer on site to try the payment again.

[glossy tree]

So it really depends on the card? Some 3D Secure cards require authentication after being set up (3184 example), and some don't require authentication once initially setup (3155 example)?

• Is there any way to detect this when the initial payment is made so we can tell the user they will need to make a payment each time manually, and recurring payments won't work?

• Alternatively, is there a way to prompt the user every month to authenticate via email or something?

[umbral mason]

Those are test cards, they are purpose built to behave specific ways so you can test various scenarios.

The reason is because with 3DS/SCA, when a card is "set up" with us we collect enough information to ask for exemptions from SCA on future transactions. However, it is up to the issuing bank to determine whether they will grant us that exemption, and it is something we don't have control over.

As far as I know it's not common to have a card that will require authentication for each and every purchase (I've never heard of this happening personally).