Eric Kuvykin

Reviewed October 17, 2026. This operational guide replaces an earlier general overview. The original publication date and URL are retained.

A checkout risk decision concerns the information available at that time. If delivery details, items or the amount change afterward, preserve the original decision and define when a new review is needed.

Record the order version that was reviewed

Keep the original order reference, relevant risk-result reference, review time and approved fulfillment details. EMVCo describes 3-D Secure as an authentication technology for card-not-present payments. Authentication is one part of the workflow; it should not be described as a guarantee that every later order modification is safe or that all merchant liability is removed.

Identify changes that need a decision

Create a business-specific review matrix with the provider: address redirection, a different pickup person, added high-value items or a material amount change may require different actions. Do not publish a universal dollar threshold or claim every change requires another authorization. Ask the processor which changes need a supported payment adjustment and which are operational risk questions.

Test a changed delivery request

In an illustrative case, an order passes review for delivery to address A, then an email asks staff to ship to address B. The employee should preserve the request, follow the approved customer-verification route and pause the affected fulfillment decision until the designated reviewer resolves it. The message itself should not overwrite the original address. Use fictitious details when rehearsing the process.

Keep the change and outcome in the same record

Record who reviewed the change, the provider guidance relied on and the final fulfillment or cancellation action. If a new payment action is required, use the supported workflow and retain its references rather than improvising a second charge. Later compare changed-order outcomes separately from unchanged orders to identify process weaknesses. The useful output is a versioned order history with a named decision owner, not an assumption that an earlier green risk indicator remains valid forever.

Sources and next steps

Primary reference: EMVCo’s 3-D Secure overview. Examples are illustrative analysis, not client results or provider quotes.

Continue with the fraud decision-drift review and the AMS New York merchant reading path.

Use the merchant technology decision worksheet to document the expected output, responsible person and acceptance evidence.