PCI Watch

Tracking changes across the Payment Card Industry

EMV® 3-D Secure Attribute Verification Message Extension

v1.0 Specifications
3-D Secure

EMV® 3-D Secure Attribute Verification Message Extension Version 1.0 June 2024

EMV 3-D Secure Attribute Verification Message Extension Legal Notice

of 22

Legal Notice

The EMV® Specifications are provided “AS IS” without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV® Specifications.

Extension Contents

Extension Introduction

of 22

Introduction

This document describes the Attribute Verification Message Extension and explains how existing EMV® 3-D Secure (3DS) v2.2.0 and v2.3.1 components can provide additional data related to Cardholder attributes such as age, name, citizenship or address for verification. This first version of the Attribute Verification Message Extension defines the Verification Request Data and Verification Response Data, which can be used by Merchants offering services such as restricted goods purchases, online gambling, or adult content, who are required by regulations to block access to those services by minors. The Verification Request Data is sent within the AReq message, and the Verification Response Data is sent in either the ARes or RReq message, depending on whether a challenge is required for the request. For additional information about extensions, please refer to the EMV 3-D Secure Protocol and Core Functions Specification.

Extension Attribute Verification Message Extension Data Elements

of 22 Attribute Verification Message Extension Data Elements Table 1: Attribute Verification Message Extension Data Elements Data Element/ Field Name

Description

Source Length/Format/Values Device Channel Message Category Message Inclusion Assigned Extension Group Identifier Field Name: id A unique identifier for the extension. Criticality Indicator Field Name: criticalityIndicator A Boolean value indicating whether the recipient must understand the contents of the extension to interpret the entire message. 3DS Server DS ACS 3DS Server DS ACS Length: 18 characters JSON Data Type: String Value accepted:

  • A000000802-005-001 01-APP 02-BRW 03-3RI JSON Data Type: Boolean 01-APP Value accepted: 02-BRW
  • false 03-3RI 01-PA 02-NPA 01-PA 02-NPA AReq = R ARes = R RReq = R AReq = R ARes = R RReq = R Data Field Name: data The data carried in the extension. 3DS Server DS ACS Length: Variable, maximum 5000 characters JSON Data Type: Object Values accepted: 01-APP 02-BRW 03-3RI
  • Refer to Table 2 for data elements 01-PA 02-NPA AReq = R ARes = R RReq = R Extension Attribute Verification Message Extension Data Elements of 22 Data Element/ Field Name Extension Name Field Name: name Description The name of the extension data set as defined by the extension owner. Source Length/Format/Values Device Channel Message Category Message Inclusion 3DS Server DS ACS Length: 22 characters JSON Data Type: String Value accepted:
  • Attribute Verification 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = R ARes = R RReq = R Extension Attribute Verification Message Extension Data Elements of 22 Data Table 2: Data Data Element/ Field Name Description Verification Request Data The data specific to the Field Name: verification request. verificationReqData Verification Response Data The data specific to the verification response. Field Name: verificationResData Source Length/Format/Values Device Channel 3DS Server DS Length: Variable, 1–99 elements JSON Data Type: Array of objects Values accepted:
  • Refer to Table 3 for data elements 01-APP 02-BRW 03-3RI ACS DS Length: Variable, 1–99 elements JSON Data Type: Array of objects 01-APP 02-BRW 03-3RI Values accepted:
  • Refer to Table 4 for data elements Message Category 01-PA 02-NPA 01-PA 02-NPA Message Inclusion AReq = R ARes = C Required if Verification Response Indicator = N, otherwise absent RReq = C Required if Verification Response Indicator = Y in the ARes message, otherwise absent Extension Attribute Verification Message Extension Data Elements of 22 Data Element/ Field Name Verification Response Indicator Field Name: verificationResInd Extension Version Number Field Name: version Description Source Length/Format/Values Device Channel Indicates whether the verification response will be provided after challenge processing. Note: For Merchantinitiated SPC, and if Verification Response Indicator = Y in the initial ARes message, the 3DS Server repeats the verification request in the second AReq message. ACS DS Length: 1 character 01-APP JSON Data Type: String 02-BRW Values accepted: 03-3RI
  • Y = All verification responses are only provided after challenge processing
  • N = All verification responses are only provided before challenge processing Version number of the message extension. 3DS Server ACS DS Length: 3 characters JSON Data Type: String Value accepted:
  • 1.0 01-APP 02-BRW 03-3RI Message Category 01-PA 02-NPA 01-PA 02-NPA Message Inclusion ARes = R If the source is the DS, then the value will always be N AReq = R ARes = R RReq = R Extension Attribute Verification Message Extension Data Elements of 22 Verification Request Data Table 3: Verification Request Data Data Element/ Field Name Description Source Length/Format/Values Device Channel Message Category Message Inclusion Attribute Name Field Name: attrName Indicates the type of attribute verification requested. 3DS Server DS Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Age
  • 02 = Date of birth
  • 03 = Citizenship
  • 04 = ID number
  • 05 = Core attribute
  • 06–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = R Match Type Field Name: matchType Indicates the verification method needed. Note: Values 01, 02, 03, 04, 05, 06 are applicable when Attribute Name = 01, 02. 3DS Server DS Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Less than
  • 02 = Greater than 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = R Extension Attribute Verification Message Extension Data Elements Data Element/ Field Name Description Source Length/Format/Values
  • 03 = Less than or equal
  • 04 = Greater than or equal
  • 05 = Equal
  • 06 = Not equal
  • 07 = Compare
  • 08–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use Device Channel Message Category of 22 Message Inclusion Extension Attribute Verification Message Extension Data Elements of 22 Data Element/ Field Name Match Value Field Name: matchValue Core Attribute Field Field Name: coreAttrField Description Indicates the value against which the verification will be performed Indicates the field name present in the core message against which the verification will be performed. Note: Value should be provided in the core message for the field name mentioned in this attribute. Source Length/Format/Values Device Channel Message Category Message Inclusion 3DS Server DS Length: 1–45 characters JSON Data Type: String Example: 18 (for verifying if the Cardholder is 18 years or older). If Attribute Name = 02 (Date of birth), then the 3DS Requestor should map the date of birth in YYYYMMDD format. If Attribute Name = 03 (Citizenship), then the 3DS Requestor should map the country code (in accordance with ISO 3166-1). 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = C Required if Attribute Name = 01, 02, 03, 04 in Verification Request Data 3DS Server DS Length: 1–45 characters JSON Data Type: String Values accepted:
  • billAddrCity
  • billAddrCountry
  • billAddrLine1
  • billAddrLine2
  • billAddrLine3
  • billAddrPostCode
  • billAddrState 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = C Required if Attribute Name = 05 Extension Attribute Verification Message Extension Data Elements Data Element/ Field Name Description Source Length/Format/Values
  • cardholderName
  • email
  • homePhone
  • shipAddrCity
  • shipAddrCountry
  • shipAddrLine1
  • shipAddrLine2
  • shipAddrLine3
  • shipAddrPostCode
  • shipAddrState
  • taxId (only for v2.3.1 or higher)
  • workPhone Device Channel Message Category of 22 Message Inclusion Extension Attribute Verification Message Extension Data Elements of 22 Verification Response Data Table 4: Verification Response Data Data Element/ Field Name Attribute Name Field Name: attrName Core Attribute Field Field Name: coreAttrField Description Indicates the type of attribute verification requested. Indicates the field name present in the core message against which the verification was performed. Source Length/Format/Values Device Channel ACS DS Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Age
  • 02 = Date of birth
  • 03 = Citizenship
  • 04 = ID number
  • 05 = Core attribute
  • 06–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use 01-APP 02-BRW 03-3RI 3DS Server DS Length: 1–45 characters JSON Data Type: String Values accepted:
  • billAddrCity
  • billAddrCountry
  • billAddrLine1 01-APP 02-BRW 03-3RI Message Category 01-PA 02-NPA 01-PA 02-NPA Message Inclusion ARes = R RReq = R ARes = C RReq = C Required if Attribute Name = 05 Extension Attribute Verification Message Extension Data Elements Data Element/ Field Name Description Source Note: Value should be provided in the core message for the field name mentioned in this attribute. Verification Response Source Field Name: verificationResSour ce This data element will be populated by the system setting the verification response. ACS DS of 22 Length/Format/Values
  • billAddrLine2
  • billAddrLine3
  • billAddrPostCode
  • billAddrState
  • cardholderName
  • email
  • homePhone
  • shipAddrCity
  • shipAddrCountry
  • shipAddrLine1
  • shipAddrLine2
  • shipAddrLine3
  • shipAddrPostCode
  • shipAddrState
  • taxId (only for v2.3.1 or higher)
  • workPhone Device Channel Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = ACS
  • 02 = DS 01-APP 02-BRW 03-3RI Message Category 01-PA 02-NPA Message Inclusion ARes = R RReq = R Extension Attribute Verification Message Extension Data Elements Data Element/ Field Name Description Source Result Code Field Name: resultCode Status of the verification request. ACS DS of 22 Length/Format/Values
  • 03–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use Device Channel Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Matched successfully (or true)
  • 02 = Not matched (or false)
  • 03 = Matched partially
  • 04 = Attribute requested is supported for verification but could not complete the request
  • 05 = Attribute requested is not supported for verification
  • 06–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use 01-APP 02-BRW 03-3RI Message Category 01-PA 02-NPA Message Inclusion ARes = R RReq = R Extension Attribute Verification Message Extension Data Elements Data Element/ Field Name Reason Code Field Name: reasonCode Description Source Provides information on ACS why the Result Code field DS has the specified value. Verification Method Field Name: verificationMethod Provides information on what method was used by the source for the attribute verification. ACS DS of 22 Length/Format/Values Device Channel Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Data available and verified successfully
  • 02 = Data limited but verified successfully
  • 03 = Data unavailable
  • 04 = Invalid data submitted
  • 05–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use 01-APP 02-BRW 03-3RI Length: 1–500 characters JSON Data Type: String Examples:
  • Government source
  • DMV
  • IRS 01-APP 02-BRW 03-3RI Message Category 01-PA 02-NPA 01-PA 02-NPA Message Inclusion ARes = C RReq = C Optional if Result Code = 01 in Verification Response Data ARes = O RReq = O Extension Message Format of 22 Message Format Table 5: Message Extension Data Elements Data Element Assigned Extension Group Identifier Criticality Indicator Extension Name Data Verification Request Data Attribute Name Match Type Match Value Core Attribute Field Verification Response Data Attribute Name Core Attribute Field Verification Response Source Result Code Reason Code Verification Method Verification Response Indicator Extension Version Number Field Name id criticalityIndicator name data verificationReqData attrName matchType matchValue coreAttrField verificationResData attrName coreAttrField verificationResSource resultCode reasonCode verificationMethod verificationResInd version Extension Attribute Verification Message Extension Samples of 22 Attribute Verification Message Extension Samples The following are samples of the Attribute Verification Message Extension that may be included in the AReq, ARes or RReq messages by the 3DS Server, DS or ACS. Sample AReq Attribute Verification Message Extension Use Case 1 – Age Verification Request "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationReqData": [ { "attrName": "01", "matchType": "02", "matchValue": "18" } ], "version": "1.0" } } ] Use Case 2 – Name Verification Request "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationReqData": [ { "attrName": "05", "matchType": "07", "coreAttrField": "cardholderName" } ], "version": "1.0" } } ] Extension Attribute Verification Message Extension Samples Use Case 3 – Date of Birth Verification Request "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationReqData": [ { "attrName": "02", "matchType": "04", "matchValue": "20021016" } ], "version": "1.0" } } ] Use Case 4 – Age and Name Verification Request "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationReqData": [ { "attrName": "01", "matchType": "02", "matchValue": "18" }, { "attrName": "05", "matchType": "07", "coreAttrField": "cardholderName" } ], "version": "1.0" } } ] of 22 Extension Attribute Verification Message Extension Samples of 22 Sample ARes/RReq Attribute Verification Message Extension Use Case 1 – Age Verification Response in ARes "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationResInd": "N", "verificationResData": [ { "attrName": "01", "resultCode": "01", "verificationResSource": "01", "verificationMethod": "DMV" } ], "version": "1.0" } } ] Use Case 2 – Name Verification Response in RReq "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationResData": [ { "attrName": "05", "coreAttrField": "cardholderName", "resultCode": "01", "reasonCode": "01", "verificationResSource": "01", "verificationMethod": "IRS" } ], "version": "1.0" } } ] Extension Attribute Verification Message Extension Samples Use Case 3 – Date of Birth Verification Response in RReq "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationResData": [ { "attrName": "02", "resultCode": "01", "verificationResSource": "01" } ], "version": "1.0" } } ] Use Case 4 – Age and Name Verification Response in RReq "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationResData": [ { "attrName": "01", "resultCode": "01", "verificationResSource": "01", "verificationMethod": "DMV" }, { "attrName": "05", "coreAttrField": "cardholderName", "resultCode": "02", "reasonCode": "03", "verificationResSource": "01" } ], "version": "1.0" } } ] of 22 Extension Attribute Verification Message Extension Samples of 22 Use Case 5 – Response When a Challenge Is Necessary for Attribute Verification "messageExtension": [ { "name": "Attribute Verification", "id": "A000000802-005-001", "criticalityIndicator": false, "data": { "verificationResInd": "Y", "version": "1.0" } } ] © 2024 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.