Method step

Before any challenge, EMVCo runs a silent device check. It decides whether the issuer can authenticate without interrupting the buyer.

What happens

The session enters method. A hidden frame posts a base64url threeDSMethodData object to the notification endpoint. The result feeds the device fingerprint the issuer uses to choose between frictionless and challenge. Nothing is shown to the buyer.

Timing

Ten seconds, hard. After that the step is abandoned and the flow continues as if no fingerprint had been produced — it never blocks the session.

Frictionless outcome

When the issuer accepts the fingerprint, the session goes straight to authenticated with transStatus Y and no challenge is rendered. The buyer may never see an authentication screen at all. This is normal and is the reason a merchant cannot assume a challenge will appear.

Implementation notes

• The step is driven entirely by the challenge page — no merchant code participates.
• The notification endpoint must accept POST with application/x-www-form-urlencoded in addition to JSON.
• If you embed the challenge in an iframe, the method frame is a nested iframe of ours; your CSP needs frame-src https://acs.3dsgate.com.
• A missing or blocked method step lowers frictionless rates but does not fail authentication.

Related: challenge lifecycle