Page MenuHomePhabricator

3DS failures in CAD June 25-26
Closed, ResolvedPublic

Description

Erich noticed a pattern from Canadian donors reporting issues with receiving verification codes from their banks, and it turns out that about 120 Gravy donations in CAD failed yesterday + today with 3DS incomplete. From DR perspective it feels like a spike - could we check to see whether these point to a possible Gravy config issue with 3DS in Canada?

Even if not a config issue it sounds like some donors are not familiar with the verification process at all.

datetransaction #ZD ticketCIDdonor comment
6/25/2025cb1d06d0-a051-47c5-ae18-ceb7b6f6c37b169408129473576I tried twice to donate on line and followed your instructions closely but did not receive a verification code from my bank
6/25/2025e78da124-edab-4c5d-8352-f2551010bcd3169395848558859Sorry, l didn’t receive the code.
6/25/2025bde1b467-fa62-461b-b494-13fd89c9075e1693656967754CIBC had to send verification code, but it did not work.
6/25/2025e1d7bbf7-e97d-4adc-bb3f-d4e62a391af8169389149421336I tried to make a donation using my Visa card. In addition to the usual information, it requires that I enter a code that would be sent to my cellphone. But I don't have a cellphone.
6/25/202511fcd180-2c0c-49c7-9e31-d907716a3cbaZD16938921498281cant make my donation as i have no mobile, can you send the code through email?

Event Timeline

I took a look at these, and I can see that donors went through the challenge flow but ultimately never came back. Unfortunately, we don't see what that challenge looks like, so it's hard to know what happened past that point. I did check the insights section in the Gravy console here, but that doesn't really help us much either.

We could ask Gravy to check from their end if the 3DSecure service they use had any issues in Canada around this period.

Thanks, @jgleeson for looking at this. I'll ask Gravy in Slack.

Can I confirm if 3DS is standard in Canada? I don't feel like we normally see 3DS rejections from there. Is that part of the Adyen flow?

FYI this seems to also be affecting Australia. Yamini has come across 3 3DS AU declines in the past couple of hours in the queue.

We just did sends to 6C earlier this week - could we take a look at numbers across all 6 countries @jgleeson / @RKumar_WMF ?

This is definitely new (Gravy?) - we do not see these levels of 3DS failures from 6C countries. Thanks! Let me know if you need examples.

As we have moved cards traffic to Adyen direct since yesterday (26th June) I am not sure if this is due to Gr4vy. Also, this has been raised to Gr4vy on slack channel. Here is the response:

"I just checked the status page of our 3DS provider and everything appears to have been fully operational on the 25th, no reported incidents or disruptions.
I haven’t seen any unusual trends on our end either, but I’m happy to take this question back and dig in a bit further, I'll update you as soon as I know more."

We will follow up and update here.

These seem to be from before the switch @RKumar_WMF - all are from 25th June or early on 26th.

We have more examples from Australia too, so I don't think this is isolated to Canada. We have also never encountered 3DS questions from there before. Let us know if you need those examples and we can add them.

Piero stepped up:

"I've reviewed the reported transactions from both Canada and Australia, and here are my findings:

On June 25th, you saw a larger volume of donations from Canada via Adyen, approximately 1,700 transactions, depending on timezone.

Of these, about 10% appear to be failing at the 3DS stage, with statuses such as: canceled_buyer_approval: The user manually closed the 3DS challenge window; failed_buyer_approval: The challenge timed out, likely due to no OTP being entered.

These types of failures typically occur when donors don’t receive or complete the challenge prompt from their bank. I can confirm that the 3DS challenge is being issued correctly from our side. If an OTP is not received or cannot be entered, the issue would fall on the issuing bank's end. With that being said, I checked the issuing banks for the transactions and they seem to come from different places.

As you noted, the overall failure percentage is in line with historical patterns based on previous days' data in the Insights dashboard. Which makes me think this jumped out for the number of donations. rather than a % based increase. Looking at the last 7 day stats, we have 1801 CA via Adyen transactions where 123 got canceled_buyer_approval & 35 failed_buyer_approval (~9.3% of total txs) This might also respond to Canadians not being used to 3DS like we've seen in other markets like Sweden.

Regarding the Australian transaction, the 3DS status also shows as “Cancelled”, which again means the user closed the challenge prematurely. While I understand the donor has completed donations successfully in the past without 3DS, the transaction on the 25th was routed through your "Adyen" connection, which has 3DS enabled for the scheme. In this case, the issuer flagged it for a 3DS check, and the user abandoned the challenge."

AKanji-WMF moved this task from Triage to Chaos Crew Backlog on the Fundraising-Backlog board.
AKanji-WMF subscribed.

Discussed in standup June 30:

  • As per above, notable increase in 3DS authentication failures in Canada and Australia since switch to gravy
  • Adyen typically didn't trigger 3DS unless required by the card issuer, whereas Gravy enforces 3DS if a card is enrolled, which may be confusing for donors unfamiliar with 3ds.

*Forced 3DS flows under Gravy may negatively impact donor conversion, especially in markets not used to 3DS

Proposal : The team discussed creating country-specific rules to skip 3DS where it’s not mandatory, replicating Adyen’s approach.

Next Steps: Gravy will be asked to confirm whether skipping 3DS still allows issuer-enforced authentication when necessary, ensuring compliance in countries where 3DS is legally required. @jgleeson

greg subscribed.

Discussed in Office Hours with Rakhi, we can close and monitor with Gravy in our ongoing calls.

XenoRyet set Final Story Points to 1.