Overview

3D Secure provides an additional authentication layer for online card payments. It helps confirm that the person making the payment is the legitimate Cardholder before the Merchant submits the transaction for payment authorisation.

CLOWD9 integrates with Apata, the Access Control Server (ACS), to support Cardholder authentication. The authentication method used depends on the product configuration, the card’s enrolment and the outcome of the authentication and risk rules applied by Apata.

This section provides an overview of the supported authentication methods. Use the related pages for configuration and integration details for each method.

How 3D Secure authentication works

At a high level:

The Cardholder starts a card payment with a Merchant
The Merchant initiates a 3D Secure authentication request
The Network routes the request to Apata
Apata applies the configured authentication and risk rules
Apata returns a frictionless result, rejects the authentication or requests an additional Cardholder challenge
If a challenge is required, the applicable authentication method is determined from the product configuration and the card’s enrolment
Once authentication is complete, the final outcome is returned to the Merchant and communicated to the Program Manager

Authentication outcomes

Outcome	Description
Frictionless success	The Cardholder is authenticated without an additional challenge. The Merchant may continue to payment authorization
Challenge	The Cardholder must complete an additional authentication step using one of the supported methods
Fail or reject	Authentication is unsuccessful or rejected. The Merchant decides whether to stop the transaction or handle it according to its own rules

Supported challenge methods

Method	Cardholder Experience	Configuration and Integration
One-Time Passcode (OTP)	The Cardholder receives a temporary code and enters it on the 3D Secure challenge screen	The Cardholder’s mobile number and the Program Manager’s delivery endpoint must be configured. Apata generates the OTP and sends it to CLOWD9, which forwards it to the Program Manager via webhook. The Program Manager is responsible for delivering the OTP to the Cardholder
Password authentication	The Cardholder enters a password associated with the card	The credential must be configured for the card. This method may be used as a secondary authentication method where required
Out-of-Band (OOB) authentication	The Cardholder leaves the Merchant challenge screen and approves or declines the request in the Program Manager’s application	The authentication request is sent to you via the configured endpoint. The authentication outcome is then provided to CLOWD9 via the OOB Authentication Result API

Finalized Event Transaction Details

Following the final result of a 3D Secure transaction, whether the authentication is frictionless, SMS, SMS & Knowledge Based Authentication (KBA) or Out of Band (OOB), CLOWD9 will communicate the outcome to you.