Skip to main content

​
What is 3DS Payment Standard?

The European Union (EU) has imposed a requirement on payment service providers within the European Economic Area (EEA) to implement Payment Services Directive 2 (PSD2) to support Strong Customer Authentication (SCA). The main specification being followed is the EMV 3D Secure (3DS) specification from EMVco. EEA merchants must be in compliance by Dec 31, 2020 and UK merchants must be in compliance by Sept 14, 2021 (US-only merchants are not yet mandated to be in compliance with 3DS/SCA). What is 3DS- you ask. 3DS (3D Secure) is a payment standard for strong customer authentication (two-factor authentication) for the European Union. The 3DS standard provides a software protocol for an issuing bank to authenticate that the customer making a purchase is in fact who they say they are.

​
Card Network Solutions

Each card network has its own branded 3DS solution, as follows:
  • Visa Secure (formerly known as Verified by Visa)
  • Mastercard SecureCode/Identity Check
  • American Express SafeKey
  • Discover ProtectBuy
  • Diners Club ProtectBuy
  • JCB J/Secure

​
Why 3DS?

3DS SCA authentication was brought about to improve user and card verification and diminish fraud attemps. The following is the 3DS affect:
  • 3DS may shift chargeback liability from the merchant to the issuing bank.
  • Card networks may begin to decline non-conforming transactions.
  • Including additional 3DS-supporting data may increase the frictionless rate.
For Visa and Mastercard, 3DS can result in five scenarios:
  • Authentication successful
  • Authentication attempted
  • Authentication failed
  • Authentication unavailable
  • Error
The liability shift happens only when the authentication is initially successful, and is then followed by a chargeback. If the authentication fails, an error occurs, or if the authentication is unavailable, the chargeback liability remains with the merchant. Note:
  • 3DS only applies to real-time transactions, be it a one-time transaction, the initial transaction of a subscription, or a payment method validation transaction.
  • 3DS does not apply to recurring transactions and does not apply to Vindicia Retain.

​
Does 3DS Impact Me?

A merchant doing business in the European Economic Area (EEA) or UK is required to support 3DS if:
  • The merchant is in the EEA or UK and their acquirer is in the EEA or UK
  • The merchant is NOT in the EEA or UK, but the acquirer IS in the EEA or UK
  • The merchant’s acquirer has an EEA or UK license, while neither the merchant nor the acquirer are in the EEA or UK

​
Are You Exempt from 3DS?

The 3DS specification allows for exemptions that may allow a transaction to bypass the challenge, allowing for a frictionless purchase. Some possible exemptions include:
  • Low value transactions (under 30 EUR)
  • Recurring transactions
  • Trusted Merchant
Note: Exempted Transactions Do Not Shift Liability
  • 3DS 2.0 includes risk mitigation by adding new data for the issuer, which makes requesting exemptions less compelling for the merchant.
  • Merchant initiated transaction markers can replace a recurring transaction exemption.
  • As with other issuer decisions, granting an exemption, when asked for, is determined by the issuing bank based on their own internal guidelines.

​
3DS Flow

The following shows the high-level 3DS flow Vindicia follows: 3DS Flow: Initiate, Authenticate, Finalize, Capture
  1. Initiate: When collecting customer payment and order details, use PMT (REST) for fingerprinting and collecting Device data. Send the Subscription/Transaction request to Subscribe.
  2. Authenticate: To support 3DS, a new step of customer challenge and authentication must be added in the eCommerce flow. This step may not always be required. It is determined by the 3DS protocol and the issuing bank. In the challenge, the customer may be asked to identify themselves using two-factor authentication, such as an SMS code or a fingerprint. For more details see the 3DS Authentication Steps and Customer Authentication Methods below
  3. **Finalize:**Once the customer successfully passes the authentication challenge, the merchant is notified. The merchant then needs to finalize the Transaction request. For more details, see Steps you need to implement.
  4. Capture: Vindicia then process the Transaction and bring the flow to fruition by successfully capturing it.
As evident in the flow, some parts of the process are handled by Vindicia and other parts need to be implemented in your merchant front-end website. The purchase flow starts by invoking a Vindicia API, as usual, but can be stopped to gather additional information from the customer, which if completed successfully, triggers the continuation and completion of the process.