# agent's browser timed out inside the 3DS challenge iframe

## TL;DR
The agent tried to drive the 3DS challenge in a browser and the bank's iframe defeated it: timeouts, bot detection, or a challenge that needs the human's phone. Do not automate the challenge. Hand the 3DS step to the customer on their own device and have the agent resume after authentication completes.

```text
agent's browser timed out inside the 3DS challenge iframe
```

## Steps

1. Stop the automation at the challenge boundary: detect the 3DS iframe and halt instead of interacting with it. Success check: the agent never types or clicks inside the challenge.
2. Hand off cleanly: send the customer the authentication link or prompt on their own device. Success check: the customer can complete the challenge without the agent's browser.
3. Poll the payment status (not the iframe) until the gateway reports authorized or failed. Success check: the agent learns the outcome from the API, not the page.
4. Set a timeout on the handoff: if the customer does not complete the challenge, expire the attempt and offer a retry. Success check: abandoned challenges close out instead of hanging.
5. Log every handoff: challenge started, handed off, completed or expired. Success check: you can reconstruct any payment's authentication path.

## When this applies

- Browser automation times out inside a 3DS challenge iframe.
- An agent tries to click through a bank authentication step.
- You are designing where the agent stops and the human takes over.

## When it doesn't

- 3DS setup or configuration errors; those fail before any challenge.
- Issuer timeouts after the shopper completes the challenge.
- Testing 3DS in sandbox with test cards; automation is fine there.

## Tool + version compatibility

3D Secure flows via any payment gateway; browser automation tools generally.

### "3ds challenge iframe automation timeout"
The iframe is a human boundary; hand it off.

### "agent cannot complete 3d secure challenge"
Correct: the customer completes it on their device.

### "3ds iframe bot detection"
Banks actively defeat automation here; stop trying.

## Why it happens

The 3DS challenge is a bank-owned iframe designed to authenticate a human: device checks, bot detection, and often a push to the customer's phone. Automation inside it times out, gets flagged, or sits waiting for a phone approval the agent can never see. Worse, driving someone else's authentication step is exactly what fraud tooling looks for. The challenge is a deliberate human boundary; the agent's job is everything around it.

## Edge cases / pitfalls

- Never ask the customer for their banking credentials so the agent can drive the challenge; that is a phishing pattern.
- Some gateways offer frictionless or delegated authentication; check before building the handoff.
- The handoff message must say what the customer is approving and for how much; vague prompts get ignored.
- In regulated markets the human step is a legal requirement, not just a technical one; automating around it is a compliance violation.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Kdu3cJEIP3frp2WKb-A-vg