3D Secure
Where any text is underlined, by clicking on the text you will be directed to the detailed information.
EMV Three Domain Secure (3DS) is a messaging protocol developed by EMVCo to enable customer authentication during card-not-present (CNP) e-commerce purchases.
It is a fraud prevention tool that adds an additional security layer when the customer makes card-not-present (CNP) e-commerce purchase. It enables additional customer authentication via alternate channels and additional information. This information typically includes a one-time password (OTP), a biometric scan, or other authentication methods.
PSD2 Strong Customer Authentication (SCA), effective from 14 September 2019, is a European regulation for online payments. It requires customers to verify purchases using two-factor authentication, such as 3DS.
3DS is optional in other regions but can still be used to reduce fraud.
3DS has evolved from the initial version, known as 3DS 1 ( or 3DS version 1, 3DS protocol 1) to the latest 3DS 2 (or 3DS version 2, 3DS protocol 2).
It helps reduce the risk of fraud and provides both merchants and consumers with increased confidence in the validity of online initiated transactions.
It should be noted that in the case of potentially fraudulent transactions resulting in chargebacks, if the cardholder was successfully authenticated using 3DS, the liability for the chargeback shifts from the merchant to the card issuer.
Here's an overview of how it works:
- The Cardholder starts a card payment with a participating Merchant
- The Merchant initiates a 3DS authentication request
- The Card Scheme Directory Server routes the request to the ACS Partner (Apata)
- The ACS Partner evaluates the available transaction information and applies the configured authentication and risk rules
- The authentication produces one of the following outcomes:
- Frictionless: The authentication is completed without additional Cardholder interaction
- Challenge: The Cardholder must complete an additional authentication step
- Fail or reject: The authentication cannot be completed or accepted
- If a challenge is required, the ACS Partner uses the authentication methods registered for the card. Depending on the selected method, CLOWD9 and the Program Manager may be involved in delivering or completing the challenge
- The ACS Partner returns the authentication outcome through the Card Scheme to the Merchant
- The Merchant decides whether to continue with the separate payment authorisation request
3DS messages
The EMV 3DS protocol uses several request and response message pairs:
- Authentication Request and Response (AReq and ARes): Used to initiate authentication and communicate the initial outcome
- Challenge Request and Response (CReq and CRes): Used to exchange information between the 3DS Client and the ACS during a challenge
- Results Request and Response (RReq and RRes): Used to communicate the final result of a challenge flow
Authentication values
A completed 3DS authentication may produce a scheme-specific authentication value, such as:
- AAV: Mastercard Accountholder Authentication Value
- CAVV: Visa Cardholder Authentication Verification Value
The authentication value is included in the subsequent payment authorisation flow so that the relevant parties can validate the associated 3DS authentication result.
The authentication value provides evidence of the 3DS authentication. It is not itself an approval of the payment transaction.
Implementation
During the Implementation project, your Progam(s) and Product(s) will be configured in line with your 3D Secure requirements.
CLOWD9 will provide support testing the solution in our Non-Production environment prior to Production testing and launch.
Before a card is used for performing 3DS authentication, the BIN or the sub-BIN needs to be configured at scheme and the ACS provider.
Configuration at the ACS provider involves configuring the work flow of 3DS authentication and the URL that will be published by ACS provider for this sub-BIN. This is the URL that will be rendered by the merchants at the point of 3DS authentication.
Configuration at the scheme involves publishing the above URL from ACS provider in its directory server. Merchant queries this directory server to fetch this URL for cards that fall within the sub-BIN.
Some ACS implementations require each card to be enrolled individually others support BIN or BIN Range level enrolment only.
Cardholder Authentication Methods
CLOWD9, via our integrated Access Control Server (ACS) provider support the following authentication methods:
A One Time Passcode (OTP) is a temporary numeric or alphanumeric code generated for a specific authentication attempt.
The Cardholder receives the OTP through the configured delivery channel and enters it on the 3D Secure challenge screen. Because the code is valid only for a limited period and authentication attempt, it provides stronger protection than a reusable password.
In most regions, where the authentication method used is OTP, a secondary authentication method is required. The Password Authentication is the secondary method.
A static password is set to the card_id and entered by the Cardholder upon request. If the password is entered incorrectly or not provided, the authorization process cannot continue.
Out-of-Band authentication is a 3D Secure challenge method in which the Cardholder verifies a transaction through the Program Manager’s application, separately from the Merchant’s checkout or challenge screen.
During an OOB challenge, CLOWD9 acts as the integration layer between Apata, the Access Control Server (ACS), and the Program Manager. CLOWD9 sends the authentication request to the Program Manager and returns the authentication result to Apata.
OOB can be configured as the as the primary method, with another method such as OTP configured as a fallback or secondary method.
CLOWD9 will receive the request for OOB authentication which is sent to you. You will then be required to provide the outcome (succesful / not verified) to CLOWD9 via the OOB Authentication Result API.
Following the final result of a 3D Secure transaction, whether the authentication is frictionless, SMS, SMS & Knowledge Based Authentication (KBA) or Out of Band (OOB), CLOWD9 will communicate the outcome to you.
Updated 5 days ago