Card-not-present payments are more vulnerable to fraud. So French authorities are cracking down.

The new rules focus on two things:

• Getting clear consent when a card is saved for future use

• Making strong customer authentication (SCA) the default, not the exception

Say goodbye to “Direct to Authorization” (DTA)

Until now, some payments could skip authentication altogether. That’s DTA – a shortcut that sent card details straight to the bank for authorisation, no 3DS step required.

Yes, it boosted conversion. But it also came with a fraud rate 3–4 times higher.

Now? That shortcut’s closed. French regulators have shut down DTA for almost all transactions. If you’re not using 3DS, you’re not getting paid.

At Mollie, we haven’t relied on DTA for years. Our payment flows are already built with security – and compliance – baked in.

What else is changing?

1. 3DS is now the standard

Every transaction, including low-value ones and MOTO (Mail Order/Telephone Order), now goes through 3DS. That doesn’t always mean strong authentication, but it does mean higher security and better traceability.

2. MITs need a proper first step

Merchant-Initiated Transactions (like subscriptions) must link back to an initial 3DS-authenticated payment. That’s how you prove the customer agreed – and how you protect yourself from chargebacks.

3. MOTO transactions are under pressure

MOTO payments are capped at €500 and closely monitored. They’re high-risk, and the regulator knows it.

4. Even small payments must play by the rules

Low-value payments (under €30) go through the 3DSv2 protocol. Some can be exempt from strong authentication – but not from traceability.