Provider sandboxes are built to prove the happy path: a fixed list of test PANs, deterministic responses, a 3DS challenge that auto-completes in a second. Production is the opposite. The challenge page is served by the issuer's ACS, it takes as long as the cardholder takes, and on a phone with a flaky connection that is often longer than whatever timeout your checkout picked.
The gap shows up in three places I keep seeing: a client-side timer that gives up on the challenge before the issuer does, a status poll that treats "pending" as terminal, and a return URL that assumes the session is still alive when the user comes back from the banking app.
None of that is testable with a sandbox that never makes you wait.
What has worked for me: a stub ACS in the test environment that can be told to answer in 5, 30 or 90 seconds, a rare and separately agreed live smoke test with a real card before big releases, and logging the elapsed time of each 3DS leg separately so the timeout you eventually set is a measured number, not a guess.
How do other teams get real-world 3DS timing into their pipeline without a live card on every run?
