OOB Authentication Adds a New 3D Secure Option for Card Purchases

Out-of-Band (OOB) authentication is now part of Pomelo’s 3D Secure module, giving issuers and merchants another way to confirm that the cardholder is really the one making the purchase. For high-risk flows, the practical point is simple: fewer SMS codes, fewer shared credentials, and one less reason for a transaction to die in the authentication step.

1. OOB means the approval happens outside the transaction channel. In Pomelo’s setup, that channel is the card issuer’s own app, or a device-bound cryptographic key such as a passkey that the browser activates with local biometrics. Instead of asking the user to copy a code into the merchant site, the issuer sends a push notification to its app, the user checks the transaction details, and approves it with biometrics or a PIN. The result goes from the issuer to the network directly, without passing through the browser.
2. The user flow starts with a push notification, but it splits depending on the device setup. In a single-device flow, the purchase happens on the same phone where the issuer app is installed: the user receives the push, opens the app or is routed into it automatically, authenticates with biometrics, and the transaction is processed. In a multiple-device flow, the purchase starts on a computer and the approval is completed on the phone, after which the user returns to the merchant site to finish the payment.
3. The reason issuers and PSPs are moving away from SMS OTP is not theoretical. SMS codes can be shared, and that is exactly what supports a large part of today’s fraud stack, from SIM swap to real-time phishing kits that capture the code and use it within seconds. The source cites FTC data showing that in 2024 U.S. consumers lost $470 million to scams initiated with a text message, five times more than in 2020.
4. The pressure is not just from fraud losses, but from policy changes. In the UK, Cifas recorded a 1.055% increase in unauthorized SIM swaps in 2024, with almost 3,000 cases, and said the goal of those attacks is to intercept authentication codes and take over accounts. The NIST (National Institute of Standards and Technology) classifies SMS OTPs as a restricted authenticator in its digital identity standard, banks in Singapore removed them from login in 2024, and the United Arab Emirates removed them from the entire banking system.
5. For card programs, Mastercard has set a hard date: on 13 October 2026, OTP is no longer enough as an authentication method for its programs. That makes OOB less of a nice-to-have and more of the obvious replacement path when issuers need a method that is harder to intercept and easier to complete inside a 3D Secure flow.