If your 3-D Secure code does not arrive abroad, stop before resending it repeatedly. Confirm that you started the purchase, identify whether the issuer expects an SMS code or approval in its app, check the registered channel, and make one controlled retry. If delivery still fails, use an already enrolled alternative or contact the card issuer through a trusted channel.

Key Takeaways:

Confirm the merchant, amount, currency, and transaction before looking for a code.

A missing challenge and a challenge with a missing code are different failures.

SMS, voice, and banking-app approvals depend on different delivery paths.

Repeated requests can invalidate older codes and may trigger rate limits.

Authentication does not guarantee that the issuer will authorize the payment.

Only the issuer can confirm or change the authentication method linked to the card.

The international travel planning guide explains how to prepare payment contacts and recovery methods before departure. This checklist starts after a legitimate online purchase has asked for additional cardholder authentication.

1. Confirm the transaction before requesting another code

Read the challenge screen without entering anything. Match the merchant name, amount, currency, masked card digits, and transaction time with the purchase you just initiated. A merchant descriptor may differ slightly from the storefront name, but an unexplained amount or seller is a reason to cancel and contact the issuer, not to approve the request.

Open the merchant account or booking page separately and check whether an order, reservation, or pending payment already exists. A checkout page can look unsuccessful while another part of the payment flow is still processing. The travel booking payment guide covers that wider order and authorization check.

Do not give a one-time code to a merchant representative, a caller, or a person offering to “complete verification.” Enter it only in the challenge that belongs to the purchase you started. A code proves control of an authentication channel; it is not a support reference and should not be copied into chat or email.

Record the safe details before retrying: local time, merchant, amount, currency, device, browser or app, masked card ending, and exact error text. Avoid screenshots that expose a full card number, code, account balance, address, or unrelated transactions.

2. 3-D Secure code does not arrive? Identify which part of the flow failed

EMVCo describes a 3-D Secure challenge as additional information sent directly to the issuer's access-control system. The challenge may ask for a one-time code on a mobile device or direct the cardholder to a mobile banking application for out-of-band authentication.［1］ Those paths fail differently.

Classify what you actually saw:

Observed state	Likely boundary to investigate	Safe next action
No challenge appeared	Merchant, browser handoff, eligibility, or a frictionless decision	Check the order and issuer record before retrying
Challenge appeared but no SMS arrived	Registered number, mobile service, delivery delay, or issuer sending	Check the number and roaming path
App approval was requested but no push appeared	App data access, notifications, enrollment, or issuer service	Open the official app directly
Code arrived but was rejected	Expired or superseded code, wrong transaction, or input error	Use only the newest code once
Approval succeeded but checkout failed	Merchant return path or later authorization decision	Check both merchant and issuer status

Do not call every state “the code did not arrive.” If no challenge was created, changing SMS settings will not fix the handoff. If the app shows a matching approval request, waiting for an SMS that was never selected wastes time. If authentication completed, the next failure may belong to payment authorization rather than identity verification.

EMVCo's out-of-band model leaves the authentication method under issuer control. The issuer can direct the cardholder to a separate trusted banking channel and then report the result back to the merchant.［2］ The merchant normally cannot switch your issuer's registered authentication method on demand.

3. Check the registered phone and banking-app path

For SMS or voice delivery, confirm that the challenge masks digits matching a number you still control. Check that the correct SIM or eSIM is enabled, the device is registered on a mobile network, international roaming is allowed for that line, and message or call filtering is not hiding the delivery. Receiving an ordinary message does not prove that every automated bank message can reach the same route.

Do not change the issuer's registered number merely to test delivery. NIST treats setting or changing a pre-registered telephone number as binding a new authenticator, which should occur through a controlled account process. It also notes that telephone delivery may be unavailable where coverage is limited and that alternative authenticator types should be available.［3］

For an app approval, connect the phone to a trusted Wi-Fi or mobile-data path and open the issuer's official app yourself. Check the in-app inbox or pending approvals instead of relying only on a push banner. Confirm that the app is still enrolled to the correct account and device; do not reinstall it or erase its data while abroad unless the issuer's recovery instructions explicitly require that step.

If the app requires your previous number, preserve any session that still works and use the old-number recovery checklist. That is an account-recovery problem, not a reason to keep requesting transaction codes.

4. Make one controlled retry without creating code confusion

Wait for the current challenge to show a clear timeout or resend option. Then request one new code. Note the time and use only the most recent delivery for the matching merchant and amount. Older codes may expire or be replaced when a new one is generated.

Keep the checkout stable during this retry. Avoid opening several merchant tabs, switching between multiple cards, changing the amount, or submitting the payment again. Those actions can create several similar challenges, making it harder to know which code belongs to which request.

If a delayed message arrives, compare its timing and any safe transaction context with the current challenge. Never try a queue of old codes. Stop after the controlled retry if nothing arrives or if the issuer reports a rate limit, temporary block, or unavailable service.

NIST requires short-lived out-of-band secrets to be accepted only once and requires rate limiting for repeated failed attempts. It also advises reasonable limits on repeated push notifications because excessive requests can contribute to authentication-fatigue attacks.［3］ A bounded retry protects both the account and the clarity of your evidence.

5. Use only an already enrolled alternative method

Look for an issuer-provided option such as approval inside the banking app, a passkey, a hardware authenticator, a recovery code, or another phone channel that was enrolled before the transaction. The available choices depend on the issuer, card, account, region, and risk decision.

Select an alternative only from the authentic 3-D Secure screen or the issuer's official app. Do not follow instructions from a seller, search advertisement, unsolicited message, or caller to install remote-control software, add a new phone number, move the conversation to chat, or read a code aloud.

An alternative may prove your identity but does not promise payment approval. Authentication confirms that the person responding controls an accepted factor; authorization is the issuer's later decision about whether the transaction can proceed. Available credit, card status, merchant category, transaction controls, and fraud checks may still affect that decision.

If no enrolled alternative is offered, do not improvise one through another person's phone or account. Stop the purchase and contact the issuer. For urgent travel arrangements, use a separate payment method that you already control only after confirming that the first attempt did not create a booking or charge.

6. Contact the issuer and verify the final state

Use the phone number printed on the card, a number saved before travel, or secure messaging inside the official app. Do not call a number shown in the challenge error, an unsolicited message, or a search advertisement until you independently verify it.

Give support the safe diagnostic record: transaction time, amount, currency, merchant, masked card ending, challenge type, masked destination digits, and the result of one controlled retry. Ask whether a challenge was generated, which method it used, whether the delivery failed, whether the account is rate-limited, and which official recovery option is available.

Ask the issuer to state the final status separately for authentication and authorization. Then check the merchant account for an order or reservation and the issuer account for a decline, pending authorization, or completed charge. Do not retry payment until those two records are reconciled.

A VPN cannot deliver a 3-D Secure code, change the issuer's registered authenticator, approve a challenge, or override an authorization decision. Changing apparent network location may add risk signals rather than solve an issuer-controlled failure.

Summary

Match the challenge to a purchase you initiated before entering a code.
Separate a missing challenge from failed SMS, voice, or app delivery.
Check the registered channel without changing or deleting account recovery state.
Request at most one controlled resend and use only the newest matching code.
Use only alternatives already enrolled through the issuer.
Reconcile authentication, authorization, merchant order, and issuer records before retrying.

Frequently Asked Questions

Why does 3-D Secure work at home but not abroad?

The issuer may choose a different challenge because of transaction, device, or location risk, while the registered phone may have different roaming or coverage conditions. Identify the actual challenge and ask the issuer what it generated rather than assuming location alone caused the failure.

Can I approve 3-D Secure inside my banking app instead of receiving SMS?

Only if the issuer offers that method and the app is already enrolled for your account. Open the official app directly and match the merchant and amount before approving.

Should I keep pressing resend until a code arrives?

No. Wait for the stated timeout, request one new code, and use only the latest matching code. Repeated requests can create delays, replace older codes, or trigger limits.

Does a successful 3-D Secure challenge mean the purchase is approved?

No. Authentication and payment authorization are separate. Confirm the issuer's transaction status and the merchant's order or reservation before assuming the purchase completed.

Can the merchant change the phone number used for 3-D Secure?

Normally the authentication method belongs to the issuer's cardholder records. Update it only through the issuer's verified account-recovery or profile process.

What if the challenge shows a merchant or amount I do not recognize?

Cancel it and contact the issuer through a trusted channel. Do not approve it or share the code, even if someone claims the difference is a temporary verification.

Will a VPN make the code arrive?

No. A VPN does not control the issuer's SMS, voice, app-notification, enrollment, or authorization systems. Use the issuer's official recovery path.

Disclaimer: This article provides general consumer-security information, not individualized financial advice. Authentication methods and support procedures vary by issuer, card program, region, and transaction.

References

EMVCo, “3-D Secure Challenge Flow: Business Overview” — https://www.emvco.com/dynamic/emv-3-d-secure-whitepaper-v2/challenge-flow/business-overview/
EMVCo, “3-D Secure Out-of-Band Authentication: Business Overview” — https://www.emvco.com/dynamic/emv-3-d-secure-whitepaper-v2/out-of-band-oob-authentication/business-overview/
NIST, “SP 800-63B: Authenticator and Verifier Requirements” — https://pages.nist.gov/800-63-4/sp800-63b/authenticators/

Sources checked September 12, 2026.

Related reading:

3-D Secure Code Does Not Arrive While You Are Abroad