PCI Watch

Tracking changes across the Payment Card Industry

EMV® 3-D Secure Payment Token Message Extension

v1.0 Specifications
3-D Secure

EMV<sup>®</sup> 3-D Secure Payment Token Message Extension Version 1.0 June 2021 EMV 3-D Secure Payment Token Message Extension Legal Notice

of 8

Legal Notice

The EMV<sup>®</sup> Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV<sup>®</sup> Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV<sup>®</sup> Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV<sup>®</sup> Specifications.

countries. EMV 3-D Secure Payment Token Message Extension Contents

countries. EMV 3-D Secure Payment Token Message Extension

Introduction

Introduction

of 8 This document describes the EMV Payment Token Message Extension and identifies how 3-D Secure (3DS) components can use this extension to provide or receive token-related information after a Payment Token has been de-tokenised. This message extension is applicable only for Message Version Numbers 2.1.0 and 2.2.0. For Message Version Number 2.3.0 and above, the information is conveyed using the EMV Payment Token Information data element. Supporting Documentation Implementers of this extension should reference:

  • EMV<sup>®</sup> 3-D Secure Use Case—3-D Secure with Payment Token
  • EMV<sup>®</sup> 3-D Secure—Protocol and Core Functions Specification
  • EMV<sup>®</sup> Payment Tokenisation Specification—Technical Framework countries. EMV 3-D Secure Payment Token Message Extension Payment Token Message Extension Data Elements Payment Token Message Extension Data Elements Table 1: Payment Token Message Extension Data Elements Data Element/Attribute Name Assigned Extension Group Identifier Attribute Name: id

Description

A unique identifier for the extension. Source 3DS Server DS Criticality Indicator Attribute Name: criticalityIndicator Extension Name Attribute Name: name A Boolean value indicating whether the recipient must understand the contents of the extension to interpret the entire message. 3DS Server DS The name of the extension data set as 3DS Server defined by the extension owner. DS Payment Token Data Attribute Name: data The Payment Token data carried in the extension. 3DS Server DS Length/Format/Values Length: 14 characters JSON Data Type: String Values accepted:

  • A000000802-003 JSON Data Type: Boolean Value accepted:
  • false Length: 17 characters JSON Data Type: String Value accepted:
  • EMV Payment Token Length: Variable, Maximum 8059 characters JSON Data Type: Object See Table 2 of 8 Inclusion AReq = R AReq = R AReq = R AReq = R countries. EMV 3-D Secure Payment Token Message Extension Payment Token Message Extension Data Elements Table 2: Payment Token Data of 8 Data Element/Attribute Name Extension Version Number Attribute Name: version Description Source Version number of the token message 3DS Server extension. DS Payment Token Attribute Name: token Payment token used to initiate the EMV 3DS transaction. 3DS Server DS Token Additional Data Attribute Name: tokenAdditionalData Token Assurance Method Attribute Name: tokenAssuranceMethod Additional information about the Payment Token from the Token Service Provider. 3DS Server DS An updatable value that allows the DS Token Service Provider to communicate the ID&V performed. It is determined or updated as a result of the ID&V Method(s) and ID&V Actor. Token Requestor ID An 11-digit numeric value that DS Attribute Name: tokenRequestorId identifies each unique combination of Token Requestor and Token Domain(s) for a given Token Service Provider. Length/Format/Values Inclusion Length: 3 characters JSON Data Type: String Value accepted:
  • 1.0 Length: Variable, 13-19 characters JSON Data Type: String Value accepted:
  • Format represented ISO 7812 Length: Variable, maximum 500 characters JSON Data Type: Object AReq = R AReq = O AReq = O Length: 2 characters Note: If the TAM value is spaces, representing No Value Set, then the data element will not be present. JSON Data Type: String Values accepted: Refer to EMV Tokenisation Technical Framework. AReq = O Length: 11 characters JSON Data Type: String Refer to EMV Tokenisation Technical Framework. AReq = O countries. EMV 3-D Secure Payment Token Message Extension Payment Token Message Extension Data Elements Data Element/Attribute Name Description Source Token Cryptogram Attribute Name: tokenCryptogram A cryptogram, containing a transaction-unique value, typically generated using the Payment Token, Payment Token related data and transaction data. Cryptogram derivation methods may vary by scenario and may be Payment System-specific. 3DS Server Token Cryptogram Validity Indicator Identifies if the Token Cryptogram has DS Attribute Name: been verified and the outcome of that tokenCryptogramValidityIndica verification. tor Token Status Indicator Attribute Name: tokenStatusIndicator Identifies the current status of the Payment Token. 3DS Server DS Length/Format/Values Length: Variable, maximum 4000 characters JSON Data Type: String Refer to EMV Tokenisation Technical Framework. of 8 Inclusion AReq = O Length: 2 characters AReq = O JSON Data Type: String Values accepted:
  • 01 = Verified
  • 02 = Failed
  • 03 = Not Performed
  • 04–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use Note: If the element is not provided, the expected action is for the ACS to interpret as 03. Length: 40 characters JSON Data Type: String AReq = O countries. EMV 3-D Secure Payment Token Message Extension EMV Payment Token Message Extensions Sample of 8 EMV Payment Token Message Extensions Sample Authentication with EMV Payment Token—Authentication Request This is a sample extension that may be included in the AReq message by the 3DS Server or DS after obtaining the underlying PAN and token properties. The ACS may consume this additional token information as part of its risk evaluation process. "messageExtension":[ {"name": "EMV Payment Token", "id": "A000000802-003", "criticalityIndicator": false, "data": { "token":"1234567890123456" "tokenRequestorId":"00012345678", "tokenAssuranceMethod":"00", "tokenCryptogram":" MTIzNDU2Nzg5MDA5ODc2NTQzMjE=", "tokenCryptogramValidityIndicator":"01", "tokenStatusIndicator":"active", "version": "1.0", } } ] countries.