## TL;DR

When a saved card triggers 3DS on renewal, the invoice's payment intent moves to requires_action and the renewal stalls until the customer authenticates. Your system must detect the requires_action status (webhook or status poll), notify the customer with the authentication URL from next_action, and complete the payment when they return. Do not retry the payment blindly; retries without authentication fail the same way. Reduce recurrence by checking the card's authentication history and, where regulation allows, requesting exemptions for low-risk renewals. Treat these as collection events in dunning, not as declines.

## The query

```text
Stripe saved card triggers 3DS on renewal: requires_action on the invoice payment intent
```

## Use this when

- Renewal payments stuck in requires_action
- Saved cards triggering 3DS at renewal
- Handling invoice payment intents needing authentication

## Not for

- First-payment 3DS at checkout (different UX context)
- Hard declines on the card (no authentication path)

## Steps

1. Detect requires_action on the invoice's payment intent via webhook or status check.
   Expected output: The stall is identified as authentication, not decline.
2. Send the customer the next_action authentication URL promptly.
   Expected output: The customer can complete the challenge.
3. Pause automated retries while awaiting authentication.
   Expected output: Retries stop failing pointlessly.
4. On return, confirm the payment intent succeeded and the invoice is paid.
   Expected output: The renewal completes.
5. Review exemption eligibility for future renewals of low-risk transactions.
   Expected output: Fewer renewals hit 3DS next cycle.

## Variant phrasings

### Stripe 3DS renewal requires_action

### saved card 3D Secure subscription renewal Stripe

### invoice payment intent requires_action renewal

## Root cause

SCA regulation requires authentication when the issuer demands it, even for saved credentials; requires_action is Stripe surfacing the issuer's challenge. Retries cannot satisfy a challenge, which is why the only path forward runs through the customer.

## Edge cases

- Authentication sessions expire; re-check status if the customer delays
- Some issuers challenge every renewal for certain cards; segment those customers for proactive messaging

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_95mcdrRBzL82ajZIBZGBFw