A user enters their card details to fund their wallet. Your risk engine (or the issuer's) decides this transaction looks slightly off, first time on this device, unusual amount, foreign IP. 3D Secure 2 fires: the user gets pushed to their bank's app or an OTP screen to confirm. From your fintech's POV the authorization is now in a HELD state: not approved, not rejected, awaiting issuer verification. Could resolve in 5 seconds or 5 minutes. Could resolve as success or failure. Your books need an account for 'auth pending 3DS' that's separate from a clean auth, because a 3DS pause carries different fraud exposure and your sponsor bank's risk team WILL ask about it.