3-D Secure leaks a pre-authorization signal, opening a card-testing channel at the network layer

The integration scanner for PSPs looks like the open part. No commercial or open-source tool turned up that probes a merchant's checkout and 3DS flow from outside for client-visible signals (distinct error messages, transStatus or reason codes reaching the browser, timing differences between frictionless, challenge and not-enrolled cases) and then produces fixes. Visa's enumeration-ratio enforcement under VAMP, passed on through acquirers, gives PSPs a reason to run such a check during merchant onboarding. The weakness is that the main fix (one generic failure message, codes only in server logs) is simple and already published by GPayments. So this likely sells as a cheap compliance and onboarding check or a feature in a PSP risk suite, not a standalone platform. The 3DS-event detection idea for issuers is harder to enter. ACS vendors (Outseer, GPayments, Cardinal) and the networks (Visa VAAI, Mastercard) already sit on the 3DS and authorization data, and issuers buy from them. A newcomer would need either a cross-ACS, cross-issuer consortium view that single vendors lack, or a channel play selling detection models through ACS vendors and issuer processors such as FIS. These findings come from a limited set of searches, so smaller vendors may have been missed.

• GPayments (blog: Where 3D Secure Helps Against Card Testing)

  A 3DS server and ACS vendor. Its October 2026 article describes this exact leak: checkouts that return a different message for each 3DS outcome let attackers find valid cards without authorizing. It recommends one generic error with reason codes kept in logs, and says issuer ACS risk engines are meant to spot near-identical 3DS request streams. The core insight is already public, free advice.

• Visa Account Attack Intelligence (VAAI) Score

  Network-level, gen-AI enumeration scoring for issuers, launched 2024 in the US. Visa says it scores in about 20 ms and was trained on more than 15B VisaNet transactions. It is presented as authorization-focused, not 3DS-event-focused.

• Mastercard Safety Net / card testing insights

  Mastercard runs network-level protections such as Safety Net and published a 2026 piece on card testing as a fraud signal. Older coverage of Safety Net: https://mobileidworld.com/mastercard-invests-20-million-in-cyber-security-2132

• Outseer 3-D Secure ACS

  Commercial issuer ACS with consortium data and real-time risk scoring. It already sees all 3DS traffic for its issuers and is the natural home for 3DS-layer card-testing detection, though nothing found mentions that feature.

• Cardinal Commerce (Visa) BIN Detection / 3DS

  Visa-owned 3DS platform. Its BIN Detection step collects device data before authentication and is not fraud detection, but Cardinal sits on the 3DS data path any detection product would need.

• FIS card enumeration white paper

  Issuer processor that notes enumeration is spread across merchants, IPs and devices and is abusing authentication flows. It is a likely in-house builder or buyer for the issuer-side detection idea.

• cside card testing prevention

  Merchant-side vendor that detects card testing from checkout session behavior before authorization. The nearest product to pre-auth checkout protection, but not specific to 3DS and not an integration audit.

• Investigation of 3-D Secure's Model for Fraud Detection (arXiv)

  2020 academic analysis of 3DS fraud-detection weaknesses. Prior research exists, but no product was built from it.

Checked 2026-10-26