Set a 10-second timeout on the 3DS challenge step because that's what the gateway docs suggested. Started seeing declines tagged as "customer abandoned challenge" at a rate that didn't match support tickets — users weren't complaining about failed payments nearly as often as the logs implied.
Pulled ACS response times across issuers for one week. Median challenge render was 2.3s. 94th percentile was 11.8s. A handful of issuing banks, mostly outside the US, were consistently rendering the challenge frame past the 10-second mark, then completing authentication successfully a few seconds after our client had already given up and shown the user a decline.
So the customer sees "payment failed," retries, gets charged twice for a split second until the first auth finally lands, and now you're refunding a transaction that technically succeeded on the issuer's side after you'd already told everyone it failed.
Bumped the timeout to 20s for known-slow issuer ranges and the abandonment numbers dropped by more than half. The actual customer abandonment rate — people closing the tab, not opening their banking app — turned out to be much smaller than what the arbitrary timeout was manufacturing.
Anyone tracking ACS response time by issuer BIN as its own metric, separate from overall auth success rate? Feels like it should be standard and I've never seen it in a dashboard by default.
Top comments (0)