PSD2 / 3DS challenge mid-cycle

If you're in the EU or UK, your bank will occasionally ask you to confirm a recurring top-up with a 3D Secure (3DS) challenge — fingerprint, face, banking-app tap, or one-time code. This is required by PSD2 Strong Customer Authentication (SCA), and the same rule applies to every merchant that takes recurring payments in those markets.

What you'll see

When a charge needs your confirmation, two things happen:

The charge is paused. Status in your wallet shows Action required. The top-up doesn't go through until you confirm.
You get an email. Subject line: "Confirm your auto-reload top-up at \[Store\]". There's one button — Confirm payment — that opens a Stripe-hosted confirmation page.

How to confirm

The fastest path:

Open the email on the same phone you bank with
Tap Confirm payment
Your bank's app or site will pop up asking for fingerprint / face / passcode / SMS code
Approve the charge
The Stripe page shows Payment confirmed

Within seconds, the top-up appears on your gift card. Your wallet auto-refreshes; you'll see the Action required status flip to Active.

How often does this happen?

Most banks ask for SCA on the first auto-reload charge, then exempt subsequent charges as long as nothing about the merchant or amount changes. After that, you might see an SCA challenge once every 6–12 months as part of normal banking compliance, or sooner if your bank's risk model triggers it (e.g. you've travelled, or there's been recent fraud activity on the card).

I missed the email — what now?

You have 24 hours to confirm before Stripe automatically cancels the charge. If you miss the window, the charge fails and counts as one failed attempt. We retry on the normal schedule. You won't be double-charged.

Outside the EU / UK

If you're in the US, Canada, Australia, New Zealand, or other non-PSD2 jurisdictions, you'll generally never see this. Recurring charges go through silently after the initial setup.

Suspended auto-reload — what now?
Auto-reload FAQ