mp_api

[cursive escarp]

👋 Welcome to your new thread!

⏲️ We'll be here soon! Typically we respond in a few minutes, but sometimes we might take a bit longer if the server is busy or if you have a particularly tricky question.

⏱️ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can always start a new thread if you have another question.

🔗 This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1329373029574119477

📝 Have more to share? Add more details, code, screenshots, videos, etc. below.

[safe depot]

👋 happy to help

[craggy sluice]

Hi. Thank you for looking into this

[safe depot]

sure!

the invoice you shared did succeed from the first time

would you mind elaborating more what's the flow and what's happening exactly?

[craggy sluice]

I ve created a subscription with a test 3ds card 4000002760003184 that says always authenticate.

I changed the quantity twice, the 3ds popup came up saying you have to authenticate before confirming.

Third time it did not and succeeded the payment

The assumption is if it says always authenticate, why does the authenticate not happen always

[safe depot]

so basically what you're asking is why this invoice in_1QhdsWJqE5f9ucQhBcvz5JYe succeeded without ever needing 3DS, correct?

[craggy sluice]

yes

[safe depot]

because the customer had credit balance that was used

and the card was never charged

[craggy sluice]

Alright. Makes sense

Thank you

Does stripe also apply some rules wherein 3ds can be exempted

[safe depot]

if the card requires 3DS on each payment then no

because at the end of the day the decision of 3DS is solely owned by the issuing bank

[craggy sluice]

I somewhere read this

After a few successful attempts a specific card can be marked as trusted (resulting in exemptions from 3DS prompts)

[safe depot]

but if the issuing bank requires 3DS we can't exempt it

there are 2 layers of security

we have our Stripe Radar that evaluates the charges/cards data and can block a charge/card

but the 3DS requirement/exemption itself happens outside of Radar and is required/exempted by the issuing bank

[craggy sluice]

Got it thank you

One last thing

[safe depot]

sure

[craggy sluice]

Our payments products optimise for different regulatory, bank and card network rules and apply relevant exemptions for low-risk payments, so as to only trigger 3D Secure when required

This statement feels like Stripe has the authority to trigger 3ds

But technically not

[safe depot]

we ask for exemptions but as I said, the issuing bank is the one the ultimately decides