Getting error: 'CARD_DECLINED_VERIFICATION_REQUIRED'

Questions
1

Hi Folks,

We are running into the above issue for SCA cards in the UK. Everything works fine on staging. On staging it shows the verification modal window everytime when we test with the following SCA test cards:

4310 0000 0020 1019

5248 4800 0021 0026

But in the production environment the customer does not see any verification modal window to verify the transaction. Does the merchant need to set up any rules under the Risk Manager profile for SCA cards? It is not a location id issue.

Customer has tried different card types but we still get the same error.

Any help would be appreciated.

Thanks!

3

No, the merchant does not need to set up Risk Manager rules. The UK is an SCA-mandated market, so Square triggers 3DS automatically based on the regulatory mandate; Risk Manager rules are only for opting in to 3DS in non-mandated markets.

What the error means

Per Square’s SCA overview: “In SCA mandated markets, payments that don’t provide authentication get a CARD_DECLINED_VERIFICATION_REQUIRED error… This error means that the seller didn’t verify the buyer on buyer-initiated payments.”

In other words: the issuer demanded 3DS, but your payment reached CreatePayment without an authentication result attached. That’s also why no modal appears in production. The verification step never actually runs (or its result never makes it to the payment call).

Things to check, in order of likelihood

  1. Are you passing verificationDetails into card.tokenize()? The current flow is card.tokenize(verificationDetails) Verification happens during tokenization. Make sure your production code path actually passes the details (it’s easy for staging and production builds/configs to diverge here):

  2. If you’re on the older payments.verifyBuyer() flow: confirm the returned verification_token is being included in the CreatePayment request body in production. If it’s dropped, omitted, or the server ignores it, you get exactly this error. (Note Square is deprecating verifyBuyer() so migrate the verificationDetails into tokenize() per the migration guide.)

  3. Amount/currency mismatch. The amount and currencyCode in verificationDetails must match what you charge in CreatePayment. If your production flow charges a different amount than what was verified, the authentication doesn’t cover the payment.

  4. Content Security Policy / iframe blocking. The 3DS challenge renders in an iframe. If your production site has a stricter CSP (or frame-blocking headers) than staging, the challenge silently fails to display. Check the browser console for CSP/frame errors and see Add a Content Security Policy.

  5. Don’t expect the modal every time in production. Sandbox SCA test cards force the challenge every time. In production, most authentications complete frictionlessly (no modal) via 3DS 2.x, no modal is normal when the payment succeeds. The error, not the missing modal, is the real symptom.

  6. Credentials/location sanity check: production application ID + production access token + a UK location taking GBP. You said it’s not the location ID, but a US-based location or currency mismatch would produce similar failures.