We're anticipating having to make some changes to our fraud scoring which uses things like location vs. credit card address as signals.
Combine that with a bank that would freak out if you used the account from abroad it was often a multi-day operation to get a transaction to go through (between support calls to bank and merchant)
Though i guess a signal vs hard lock/logic.
It’s a thing in Europe as well.
I have a little app in my phone from my credit card company where I confirm when I am really buying something and it looks more secure than relying on fraud detection.
It shifts fraud loss liability onto the customer who is even less prepared to deal with it than the merchant. Only a few merchants tried it like Newegg.com. It flopped because the hit to conversion was more than the fraud prevention. It usually fails open (allows transaction to proceed). Merchant side fraud detection is inherently inferior to the bank doing fraud filtering, but banks don't care. Not their liability not their problem.
I wonder if there's rules depending on which country. When I worked for a small-time credit card "vendor" we could put pretty much anything we wanted in our iFrame.
SCA is therefore likely to become a requirement in the US once it's reached maturity in Europe, as we saw with EMV.
Further reading: https://www.jonesday.com/en/insights/2020/12/strong-customer...