3D Secure 2 / SCA Enforcer for Magento 2

Key Features

EMV 3DS 2.x challenge/frictionless routing engine that scores each transaction and decides whether to request a frictionless flow or force an issuer challenge

Per-payment-method SCA enforcement — mandate authentication on selected methods while leaving others (e.g. PO, offline) untouched, via di.xml plugins on the payment model

Liability-shift tracking: ECI/authentication status, CAVV/transaction status and shift outcome persisted against each sales_order for dispute defense and audit

Exemption handling for low-value (sub-€30) and TRA (Transaction Risk Analysis) cases, with configurable thresholds and per-acquirer caps

Gateway-agnostic adapter layer mapping a single SCA policy onto Adyen, Stripe, Checkout.com, Braintree, CyberSource or your acquirer's 3DS2 server

ACL-gated admin configuration under Stores > Configuration for routing rules, exemption thresholds and gateway selection per store view

Hard-fail / soft-fail policy controls — block order placement when authentication is not satisfied, or quarantine for manual review

Service contracts plus REST and GraphQL resolvers exposing authentication and liability-shift state to PWA Studio / headless storefronts

Observers on sales_order_place_before and payment authorize events to validate the SCA result before the order is committed

Step-up challenge UI integration in the Magento checkout (Knockout/UI component) with graceful fallback when the issuer downgrades

Cron-driven reconciliation job that resolves pending/async authentication results and back-fills liability-shift status

Structured logging and an audit trail of every routing and exemption decision for PSD2 compliance evidence

Built to order, done for you

No DIY setup — a working app, built, installed and supported by ECOSIRE.

You order

Start with a one-time build price. We scope it with you at kickoff.

We build & install

ECOSIRE builds, configures and installs it on your Magento 2.

Go live + support

You go live in about 2–4 weeks, with a post-launch support window.

About this Product

EU merchants on Magento 2 / Adobe Commerce carry the chargeback liability whenever a card payment slips through without Strong Customer Authentication. Most payment modules support 3DS2 only as an optional path — issuers can still soft-decline or downgrade, and core Magento gives you no central place to mandate authentication or reason about exemptions. The 3D Secure 2 / SCA Enforcer for Magento 2 closes that gap.

This is a build-to-order extension: ECOSIRE designs, builds, installs and supports it for your specific gateway and checkout. It ships as a proper module under app/code/Ecosire/Sca, wiring into the payment flow through di.xml plugins on your payment method models and sales_order_place_before/payment_authorize observers — no core hacks. A frictionless/challenge routing engine evaluates each transaction (amount, currency, basket risk, returning-customer signals) and decides whether to request a frictionless flow or force a challenge, honoring the EMV 3DS 2.x protocol your PSP exposes.

You get an admin configuration UI (ACL-gated under Stores > Configuration) for per-method SCA rules, exemption thresholds and gateway mapping. Exemption handling covers low-value (under €30) and TRA (Transaction Risk Analysis) cases, with every decision and the resulting liability-shift status persisted against the order for audit. Service contracts and REST/GraphQL endpoints expose authentication state to headless and PWA Studio storefronts.

Gateway-agnostic by design, it adapts to Adyen, Stripe, Checkout.com, Braintree, CyberSource or your acquirer's 3DS2 server. Delivery is honest: a scoped build with a quoted lead time, UAT on your staging, then production install. Works on Adobe Commerce and Magento Open Source 2.4.x.

What you get

Custom Magento 2 module (Ecosire_Sca) delivered as installable source under app/code plus a Composer package for your repository

Gateway adapter configured and tested against your specific PSP / acquirer 3DS2 integration

Admin configuration screens with ACL roles for routing, per-method enforcement and exemption thresholds

REST + GraphQL endpoints and service contracts for headless / PWA Studio storefronts (where applicable)

Installation on your staging environment with a UAT pass covering frictionless, challenge, exemption and decline scenarios

Production deployment assistance plus a setup:upgrade / di:compile / deploy runbook

Technical documentation: configuration guide, exemption-policy reference and liability-shift data dictionary

A defined post-launch support and bug-fix window with Magento version-compatibility coverage

Who this is for

EU eCommerce Merchant on Adobe Commerce

A PSD2-regulated online retailer that needs every card payment to satisfy Strong Customer Authentication to avoid liability and issuer soft-declines, but whose current payment module treats 3DS2 as optional.

Magento Technical Lead / Solution Architect

Owns the checkout and payment integration and wants a clean, upgrade-safe module (plugins, observers, service contracts — no core edits) that centralizes SCA policy across multiple payment methods and store views.

Payments & Compliance Manager

Responsible for PSD2/SCA compliance and chargeback exposure; needs auditable liability-shift records and documented exemption handling to defend disputes and satisfy the acquirer.

How 3D Secure 2 / SCA Enforcer for Magento 2 Compares

Criterion	ECOSIRE	Custom Build	Competitor
Enforces 3DS2 / SCA on every card transaction (not optional)	Included	Partial support	Partial support
Smart frictionless vs challenge routing engine	Included	Partial support	Partial support
Per-payment-method SCA enforcement across store views	Included	Partial support	Not included
Exemption handling (low-value / TRA) with audit trail	Included	Partial support	Not included
Liability-shift status persisted per order for dispute defense	Included	Partial support	Partial support
Gateway-agnostic adapter (Adyen, Stripe, Checkout.com, etc.)	Included	Partial support	Not included
GraphQL / REST exposure for headless / PWA Studio	Included	Partial support	Not included
Built, installed and supported for your specific stack	Included	Partial support	Not included

Frequently Asked Questions about 3D Secure 2 / SCA Enforcer for Magento 2

Is this an instant download from the Adobe Commerce Marketplace?

No. This is a build-to-order extension. ECOSIRE builds it for your specific gateway, checkout and Magento version, then installs it. You are not buying a generic Marketplace listing — you are commissioning a tailored module that we deliver, install and support.

How long does delivery take?

After a short scoping call we confirm your gateway and requirements and give you a firm lead time — typically around one to two weeks for a standard single-gateway build. We then deliver the module, run UAT on your staging covering frictionless, challenge, exemption and decline paths, and deploy to production once you sign off.

What ongoing support and updates do I get?

Every build includes a defined post-launch support and bug-fix window plus compatibility coverage for your Magento 2.4.x line. We address regressions from Magento patch releases and gateway API changes within scope, and offer an optional ongoing maintenance arrangement for long-term updates and new payment methods.

Will it work with my payment gateway?

Yes — the module is gateway-agnostic through an adapter layer. We map your single SCA policy onto your PSP's 3DS2 server, whether that's Adyen, Stripe, Checkout.com, Braintree, CyberSource or your acquirer's own EMV 3DS service. Confirm your gateway during scoping so we configure and test the correct adapter.

Does it modify Magento core or break upgrades?

No core files are edited. The extension uses standard Magento 2 extension points — di.xml plugins on the payment models, observers on sales_order_place_before and payment authorize events, service contracts and admin ACL — so it survives setup:upgrade and Magento minor-version upgrades cleanly.

How does it handle SCA exemptions?

It supports low-value exemptions (transactions under €30) and Transaction Risk Analysis (TRA) exemptions, with configurable thresholds and per-acquirer caps in the admin. Each exemption decision and the resulting liability-shift status is logged against the order, so you keep an auditable record for PSD2 compliance and dispute defense.