Why is 3D Secure mandatory on Turkish cards, and how does BDDK affect Magento checkout?

BDDK (Bankacılık Düzenleme ve Denetleme Kurumu, Turkish banking regulator) enforces 3D Secure 2 on every card transaction issued by a Turkish bank. Unlike EU PSD2, there is no “low-risk skip”, no transaction-amount exemption, no merchant-initiated bypass. Every card payment triggers 3DS challenge.

Magento checkout impacts:

• Checkout flow must accommodate a full-screen 3DS challenge redirect / iframe, the bank’s authentication step, not the PSP’s.
• Order placement timing, you cannot create the sales_order until 3DS callback succeeds. Cart should hold via sales_quote with a short reservation TTL.
• iyzico / PayTR / Param all handle the 3DS flow server-side; you just embed their HPP (hosted payment page) or use their JS SDK with the 3DS handshake.
• Mobile checkout, ~70% of TR e-commerce is mobile; ensure the 3DS modal renders inside the Magento mobile theme without breaking the back-stack.
• Abandonment monitoring, 3DS challenge is the #1 checkout drop-off point in TR. Wire analytics to track 3DS-callback success rate and intervene on bank-side timeouts.

We harden the 3DS flow + monitor success rates per acquirer bank as standard on every TR build.