Use case summary
In Triggers, the Manage Auth strategy sets 3D Secure, CVV, or a one-time password to required, optional, or disabled for the transactions a rule matches. Conditions are built on attributes you already have, such as amount, country, BIN, or card fingerprint. Result: risky payments get a challenge and routine ones do not.
- Payment Manager
- Payment Ops
Why authentication is usually all or nothing
Authentication tends to be set once and applied to everything. Either every card payment gets a 3D Secure challenge, an extra step where the cardholder confirms the payment with their bank, or none does, because the setting sits with the provider and nobody wants to touch it.
Both ends of that choice cost money. Challenge everyone, and you add a step where customers drop out, especially on mobile and for small amounts. Challenge no one, and you carry the fraud on transactions where the cardholder was never asked to prove anything.
The risk is not spread evenly either. A €15 repeat purchase from a returning customer and a first-time €900 order to a new address are different transactions, and a single setting treats them the same.
How to apply authentication by rule
On Corefy, authentication is decided per rule: each rule says whether a matching payment is challenged, and with which method.
- 1
Set the outcome for each rule
In Triggers, the Manage Auth strategy sets 3-D Secure, CVV, or a one-time password to required, optional, or disabled for the transactions that rule matches.
- 2
Write conditions on attributes you already have
Rules are built on the transaction's own data, including amount, currency, customer country, BIN, issuer name, card fingerprint, IP address, and email, using the same readable condition logic as your routing rules.
- 3
Let your lists decide the obvious cases
Allow and block lists cover the customers, cards, and countries you have already made a decision about, so a known-good repeat customer is not challenged by a rule written for strangers.
- 4
Keep the challenge where exposure concentrates
Conditions on country and issuer let you require a challenge on the traffic you consider highest risk, such as cross-border payments, while domestic repeat purchases pass without one.
- 5
See what each payment actually did
The transaction timeline records the authentication step alongside every other status change, with a readable failure reason when a payment fails, so a drop in conversion can be traced to the rule that caused it.
- 6
Adjust from what the numbers show
Analytics breaks down statuses and decline reasons, which is what tells you whether a rule is stopping fraud or stopping customers.
What you get
Each payment gets the amount of friction its own attributes justify.
Conversion kept on low-risk payments
Small, repeat, and domestic payments complete without a challenge, which removes the step where mobile customers most often abandon a purchase they had already decided to make.
Challenges where exposure is real
First-time customers, unusual amounts, and cross-border traffic can be challenged under rules you write, so the friction lands on the transactions that carry the risk.
Changes without a provider ticket
Authentication rules are configured in the dashboard, so a change in fraud patterns is addressed the same day rather than through a provider's settings and a release cycle.
Rules you can defend with data
Every payment's authentication step and failure reason is visible, so a decision to challenge or skip a segment can be reviewed against what actually happened to it.
Fraud concentrates in a segment you can identify before authorization
The European Banking Authority and the European Central Bank reported that fraud rates for card payments were about seventeen times higher when the counterpart was outside the EEA, compared with domestic transactions. Around 30% of card fraud value in 2024 came from those cross-border transactions. The gap follows an attribute that is known before a payment is authorized, which is the same kind of attribute a rule can be written on. Whether the rest of your traffic deserves the same treatment is a question your own data answers.