Blocked 3D Secure Payment: Why Your Card Is Declined

When an online purchase is declined while the account holds enough money, the balance is generally not the cause: the decision is made in the 3D Secure confirmation, in the card settings, in its limit or in a security block by the bank. All these points can be checked from the issuer's app.

No Belgian bank publishes the list of its refusal reasons. The one below is rebuilt from what exists: a European regulation, general terms, help pages re-read on 6 October 2026.

The account is funded, so why does the bank say no?

Because a credit card does not draw on the account at the moment of purchase. It draws on a usage limit that Wikifin defines as the maximum amount that can be spent per month, with common values of 1,250 to 2,500 euros. The current account is debited only later, on the statement's collection date.

At each authorisation request, the bank answers yes or no. Four things can push it towards no: the confirmation did not go through, the card is not allowed to pay on the internet, the limit is reached, or the bank judges the operation risky. The ING card terms, version of 21 May 2026, give it that last right: a block is possible « pour des raisons objectives liées à la sécurité » (for objective reasons linked to security, article 11.1). The list of those reasons is not there.

The rest of the protection system is gathered in our pillar on credit card security.

A 3D Secure confirmation is valid for one amount and one payee

Delegated Regulation (EU) 2018/389 has applied since 14 September 2019, as the National Bank of Belgium recalls. It requires two elements out of three: what you know, what you hold, what you are. KBC translates this as the PIN, the card reader or the smartphone, the fingerprint. On 16 September 2019, Test-Achats wrote that the three digits on the back of the card would no longer be enough.

Article 5 of the regulation adds a detail that catches people out: the confirmation must be dynamically linked to an amount and a payee. The approval given in the app therefore holds for that sum, at that merchant. If the basket changes between two screens, because delivery fees are added, I read the text as requiring a new confirmation. That is my reading, no Belgian issuer page describes it.

On the cardholder side, failures come from a notification that does not arrive, a smartphone replaced without re-registering the app, a number left at the old one. These are the causes the system makes possible; no issuer publishes the list, nor the validity period of a confirmation. The general working of 3D Secure is explained in our guide to online purchases with a credit card, which this page does not redo.

Why do 25 euros go through without confirmation and not the next purchase?

Because confirmation is not always required, and it is the payment provider that decides. The same regulation provides exemptions, summarised below from the text re-read on EUR-Lex.

Both articles say the bank is « authorised » to skip the confirmation. The verb imposes nothing on it.

A literal reading of article 16 gives this. Three purchases of 30 euros, then one of 25 euros, go through without confirmation: before the fourth, the previous operations add up to 90 euros. Before the fifth, they add up to 115, and confirmation becomes due again if the bank counts in euros. If it counts in operations, the text allows six consecutive purchases before demanding it on the seventh. Each issuer sets its counter. I found none that publishes its own.

I consider this mechanism unreadable for the cardholder. At 28 euros on Monday, the card goes through. At 28 euros on Tuesday, it asks for a confirmation, and to my knowledge no screen says which counter tripped.

Where is the « internet payments » setting?

In KBC Mobile, the card settings page gives the path: Payer, then Moyens de paiement, then the card, where the « Payer sur internet » option is switched on or off (page re-read on 6 October 2026). At ING, article 4.4 of the terms of 21 May 2026 provides the same option: « Vous pouvez activer ou désactiver l'option d'effectuer des paiements sur l'internet » (you can switch the option to pay on the internet on or off). The temporary block of the card is also done in the app (article 4.7).

A card whose option is off refuses at the moment of payment, whatever confirmation is given. On the card I keep in my pocket for shops, the option stays off, and I switch it on only for a specific purchase. A number stolen from a website then serves no purpose.

For other issuers, my findings are thinner. Belfius: the page « Pourquoi ma carte de crédit ne fonctionne pas ? » stayed empty beyond its header, on both attempts of 6 October 2026. Its payment methods page cites itsme for higher payments, with no visible date. BNP Paribas Fortis: a page dated 16 February 2022 writes that a card reader is needed for a Visa or Mastercard purchase within the European Economic Area. I cannot say whether it still describes current practice.

The limit blocks without warning, especially after a reservation

A purchase that exceeds the available limit is declined, even if the confirmation is perfect. And the available limit is not the displayed limit: according to Wikifin, on its page updated on 14 July 2026, a hotel or car reservation is temporarily deducted from the limit. At Hello bank!, our page on credit card timeframes establishes that the limit is restored only when the payment is recorded.

To raise it, KBC allows a temporary increase of a credit card limit twice a year, for 30 days at most, and a permanent change from KBC Mobile. ING allows limits to be adjusted twice a year at most (articles 5.1 and 5.2 of the terms). An excess that goes through anyway is covered in our page on the credit card limit.

In which order should you check when the payment fails?

1. Open the bank's app before retrying: a confirmation request may be waiting there, and approving it avoids a second attempt.
2. Compare the merchant and the amount shown in the app with the basket. If they differ, confirm nothing.
3. Look at the « internet payments » option of the card used.
4. Look at the available limit, reservations in progress included.
5. Retry once, just once, from the basket.
6. Call the bank. Card Stop (078 170 170) is only for a confirmed fraud.

The table reads the symptoms through the texts quoted; no issuer publishes an equivalent.

An SMS asks you to confirm a payment: does it come from the bank?

Before approving anything, these points are enough:

• the merchant shown in the app is the one where you are paying;
• the amount is the basket's, to the cent;
• you started the purchase less than a minute ago;
• you reached the app yourself, without going through a received link.

A request that appears without a purchase from you is refused, and the card is blocked in the app. A confirmation given by your own hand makes the operation an authorised one, which changes the protection, as our guide to credit card fraud explains. Suspicious messages are forwarded to suspect@safeonweb.be, the address given by the Centre for Cybersecurity Belgium.

No Belgian bank publishes the list of its refusal reasons

The itsme blog page consulted on 6 October 2026 still names bpost bank among the banks where a card payment is confirmed, although that institution was merged into BNP Paribas Fortis on 22 January 2024, and it announces Argenta as the next arrival. I therefore do not use it to say which bank confirms with itsme.

My findings fit on three lines: one contract, an empty page at Belfius, a 2022 page at BNP Paribas Fortis. As of 6 October 2026, the only wording I found in a Belgian contract is ING's, which allows a block « pour des raisons objectives liées à la sécurité » without listing them.