PCI Watch

Tracking changes across the Payment Card Industry

FAQ: EMV 3-D Secure – General Questions

FAQs
3-D Secure

EMV® 3-D Secure Frequently Asked Questions (FAQ) 1. What is EMV® 3-D Secure? EMV 3-D Secure (3DS) is a messaging protocol that promotes frictionless consumer authentication and enables consumers to authenticate themselves with their card issuer when making card-not-present (CNP) e-commerce purchases. The additional security layer helps prevent unauthorised CNP transactions and helps protect the merchant from exposure to CNP fraud. The three domains consist of the merchant / acquirer domain, issuer domain, and the interoperability domain (e.g. payment systems). 2. What role does EMV 3DS play within the payments community? The purpose of the EMV 3DS protocol is to facilitate the exchange of data between the merchant using 3DS and a card issuer to authenticate a cardholder, help increase authorisation approval rates as well as reduce the risk of fraud. The objective is to benefit each of these parties by providing the ability to authenticate cardholders during a CNP e-commerce purchase, reducing the likelihood of fraudulent usage of payment cards. 3. 3DS is already used within the payments industry. Why did EMVCo create a specification? 3DS was initially developed by Visa to provide additional security to online purchases through standard web browsers by providing authentication between the cardholder and the issuer. To reflect current and future market requirements, the payments industry recognised the need to create a new specification that would support app-based authentication and integration with digital wallets, as well as traditional browser-based e-commerce transactions. This led to the development of EMV 3DS. The first EMV 3-D Secure – Protocol and Core Functions Specification (v2.0.0) was released in 2016. This was followed by the publication of v2.1.0 in 2017, and the release of v2.2.0 in 2018. EMV 3DS takes into account both payment channels and supports the delivery of industry leading security, performance and user experience. Visa continues to maintain sole ownership of the 3DS version 1.0 specifications. 4. What are the differences between version 2.1.0 and version 2.2.0? The latest version of the specification includes: © 2020 EMVCo, LLC. All rights reserved.

  • Further promotion of frictionless authentication:
  • Improved communication between merchants and issuers, enabling Europe’s Second Payment Services Directive (PSD2) exemptions for Strong Consumer Authentication to be applied. While the previous version of the EMV 3DS Specification enables PSD2 compliance, the latest updates provide additional features for merchants and issuers to maximise the benefit of the available exemptions.
  • Expansion of existing data elements to promote communication of precheckout authentication events and associated data as part of the EMV 3DS transaction from systems such as those supporting the FIDO Alliance standards.
  • Two new features that provide offline authentication capability for various transaction scenarios, including mail order and telephone order transactions:
  • The addition of 3DS Requestor Initiated (3RI) payments, which provide the ability for a merchant to initiate a transaction even if the cardholder is not present. This channel previously only supported non-payment transactions for v2.1.0.
  • The inclusion of a new authentication method, referred to as ‘decoupled authentication’. This allows cardholder authentication to occur if the cardholder is offline. However, this authentication method can also be used if the cardholder is online via browser and app channels.
  • Improvements to the user experiences and checkout flows.
  • Improvements to the EMV 3DS caching process via additional data elements in the PReq/PRes cycles. These enhancements are available if all 3DS components involved in the transaction have updated their software to support v.2.2.0. 5. What does EMV 3DS offer the marketplace? The specification:
  • Supports specific app-based purchases on mobile and other consumer devices.
  • Promotes an improved consumer experience by enabling intelligent risk-based decisioning that encourages frictionless consumer authentication.
  • Delivers enhanced security features.
  • Specifies use of multiple options for step-up authentication, including onetime passcodes, as well as biometrics via out-of-band authentication flows.
  • Enhances functionality that enables merchants to integrate the authentication process into their checkout experiences, for both app and browser-based implementations.
  • Offers performance improvements for end-to-end message processing.
  • Adds a non-payment message category to provide cardholder verification details to support various non-payment activities, such as adding a payment card to a digital wallet.
  • Enables merchant-initiated account verification. © 2020 EMVCo, LLC. All rights reserved. 6. What are the benefits of EMV 3DS to each of the ecosystem stakeholders? Solutions developed on the EMV 3DS Specification bring many benefits to the marketplace as they will reflect the payment community’s objective to enhance the security of consumer e-commerce transactions while optimising the user experience.
  • Merchants will be able to implement a consistent approach across multiple platforms and digital channels for cardholder authentication or account verification. EMV 3DS-based solutions can achieve this during the purchasing process, minimising the risk of potential checkout abandonment.
  • Issuers will be able to increase the proportion of frictionless authentications due to richer data exchanges. By supporting new devices / channels, solutions compatible to the EMV 3DS Specification will encourage cardholders to make purchases using their preferred medium without compromising on security.
  • Consumers seek increased convenience and security during e-commerce payments. Solutions based on the EMV 3DS Specification will offer these benefits, adding efficiency with minimal to no impact on the applications and payment flows that consumers are using and experiencing today. 7. Does Non-Payment Authentication mean that the EMV 3DS protocol can use other consumer credentials (e.g. Driver’s License, Bank Account Number, Social Security Number) as the basis for performing a consumer authentication? The EMV 3DS protocol currently supports cardholder authentication using a Primary Account Number (or Payment Token) as the core data element and does not support the use of other consumer credentials to initiate an authentication. Authentication can happen during an e-commerce transaction (Payment Authentication) or for provisioning and verification activities (Non-Payment Authentication) such as adding a card to a digital wallet or confirming an account is in good standing. Non-payment authentications may add further confidence to related payments at a future time. 8. Is EMV 3DS consistent with consumer privacy principles? An EMV 3DS transaction utilises consumer data for the purposes of evaluating risk in order to prevent fraud. Merchants and issuers using this data for this purpose are responsible for complying with applicable privacy laws. 9. Is the specification available to all parties without charge? Yes. Like other EMV Specifications, the EMV 3DS Protocol and Core Specification is available on a royalty-free basis for anyone to download from the EMVCo website. EMVCo has an established system for delivering payment-related specifications through open and transparent processes in consultation with industry stakeholders. © 2020 EMVCo, LLC. All rights reserved. 10. How will EMV 3DS be adopted by payment stakeholders? EMVCo manages and evolves a range of specifications and related testing processes that facilitate the worldwide interoperability and acceptance of secure payment transactions. Adoption of EMV Specifications and associated approval and certification processes promotes a unified international payments framework that supports an advancing range of payment methods, technologies, and acceptance environments. The specifications are designed to be flexible and can be adapted regionally to meet national payment requirements and accommodate local regulations. EMVCo does not mandate the use of its specifications and industry stakeholders are free to choose from any or all of the related EMV Specifications to address their customer and marketplace needs. Accordingly, EMVCo expects the EMV 3DS Specification will be used primarily by parties to develop and implement EMV 3DS-compliant products and services. To learn more about the role EMVCo plays within the payments ecosystem, read its Operating Principles. 11. What is the purpose of the EMV 3DS Software Development Kit (SDK) Specification? The EMV 3DS SDK Specification details the SDK information and requirements for EMV 3DS app-based solutions. This technical document is intended to be utilised by parties interested in gaining a deeper understanding around the EMV 3DS Protocol and Core Specification and its functions. In addition to the EMV 3DS SDK Specification, EMVCo has developed a specification that focuses on device information and an SDK technical guide (EMV 3-D Secure SDK—Device Information and EMV 3-D Secure SDK Technical Guide). Collectively, these documents provide practical insight on how to create an EMV 3DS SDK and how this can be integrated into an EMV-compliant 3DS Requestor App. 12. How does the EMV 3DS SDK Specification differ from the EMV 3DS Core Specification? The EMV 3DS - Protocol and Core Specification provides the requirements for all EMV 3DS components, such as 3DS Requestor, 3DS SDK, 3DS Server, Directory Server and Access Control Server, and details all of the flows and data elements. In contrast, the EMV 3DS SDK Specification focuses exclusively on the SDK and the specific role it plays in the 3DS flows and requirements. 13. Does the release of the EMV 3DS Specification have an impact on other areas of EMVCo activity / work? The EMVCo 3DS Working Group works in close alignment with the technical body’s payment tokenisation, secure remote commerce, mobile and security related initiatives. The collective goal is to advance the global interoperability of digital and e-commerce payments, while supporting cardholder authentication and enhancing transaction security. © 2020 EMVCo, LLC. All rights reserved. 14. As EMVCo has now published its EMV Secure Remote Commerce (SRC) Specification, do stakeholders need to wait for EMV SRC solutions rather than utilise the EMV 3DS Specification? EMV 3DS can be implemented independently of EMV SRC and EMV SRC is not a replacement for EMV 3DS. The EMV SRC Specification will provide integration options for the EMV 3DS Specification. EMVCo therefore encourages stakeholders to continue developing solutions based on EMV 3DS. 15. Who has provided input into the EMV 3DS Specifications and how will they be managed long-term? EMVCo engages with several industry bodies, alliances and community stakeholders to receive feedback on its specifications and to ensure that they evolve in line with industry requirements. As part of EMVCo’s work to create the EMV 3DS Specification, the body commissioned user-testing in multiple countries to understand which mechanisms users preferred. External reviews of the draft specification were also completed, including usability studies, academic analyses, and detailed review of the security design. This is in addition to extensive input and guidance from EMVCo Business & Technical Associates. 16. Do the EMV 3DS Specifications support co-badge processing? Yes, the specification does support co-badge processing. Although the actual co-badge processing logic resides outside of the specification, the specification will support the routing of that transaction to the appropriate Directory Server as indicated by the 3DS Server. 17. How can interested parties get involved? EMVCo has an established Associates Programme that is open to all industry stakeholders. EMVCo engages with its Associates to collect industry input to develop and refine its specifications. This serves to solidify EMVCo’s understanding of industry requirements to support global interoperability, security and cardholder authentication. EMVCo will be seeking input from its Associates, at both a technical and business level, on an ongoing basis to ensure current and future global requirements are addressed. EMVCo welcomes new participants who are interested in contributing to the EMV 3DS Protocol and Core Specification effort to join its Associates Programme or to become a Subscriber to access advance EMV 3DS information. 18. What documentation has EMVCo published in support of the EMV 3DS Specifications? © 2020 EMVCo, LLC. All rights reserved. EMVCo has published the following final specifications and related education materials to the industry in support of EMV 3DS:
  • EMV® 3-D Secure—Protocol and Core Functions Specification
  • EMV® 3-D Secure—SDK Device Information
  • EMV® 3-D Secure—SDK Specification
  • EMV® 3-D Secure—SDK Technical Guide
  • EMV 3-D Secure Approval Administrative Process
  • EMV® 3-D Secure JSON Message Samples
  • EMV® 3-D Secure App-based Cryptographic Worked Samples Additionally, EMVCo has published the following 3-D Secure related Bulletins:
  • 3DSTA 01 3-D Secure Approval Fees
  • SB 204 EMV® 3-D Secure Updates, Clarifications & Errata for v2.1.0
  • SB 205 EMV® 3-D Secure SDK and Device Information Updates, Clarifications & Errata for v2.1.0
  • SB 207 EMV® 3-D Secure Key Features for v2.2.0
  • SB 211 EMV® 3-D Secure SDK and Device Information Key Features for v2.2.0 All 3-D Secure documentation can be accessed, viewed, and downloaded from https://www.emvco.com/emv-technologies/3d-secure. EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC. © 2020 EMVCo, LLC. All rights reserved.