How to Scope 3DS Regression Testing When a Component Changes

Changes arrive at a 3DS deployment from more directions than most test plans anticipate. A specification bulletin. A new device information version driven by an operating system release. A vendor patch. A scheme programme update. A counterparty…

What Each of the Five 3DS Message Extensions Does

The Core Specification defines a fixed set of data elements. Real payment businesses have needs that a fixed set cannot cover, and rather than expand the core indefinitely, EMVCo publishes separate documents that add defined data to existing…

How an ACS Picks a 3DS Challenge Method and Renders It

Most issuers configured a 3DS challenge method once and have not revisited it. In a large number of cases that method is a passcode sent by text message, applied to everyone, on every device, in every channel. Selecting a 3DS challenge method…

What the 3DS Split-SDK Is and Which Implementations Need It

Most app-based 3DS integrations use a single SDK embedded in the merchant app. That model assumes a capable device running one of the two dominant mobile operating systems, with enough processing power to perform cryptographic operations locally. Plenty…

Why the 3DS Transaction Status Differs Between Messages

The 3DS transaction status element appears in more than one message, and it does not mean the same thing each time. Teams that read whichever copy arrives first, and act on it, end up with reporting that does not reconcile and occasionally…

How to Build 3DS Negative Testing Into Your Test Plan

Certification proves your implementation can complete a transaction correctly. It is not designed to prove your implementation behaves sensibly when something goes wrong, and something goes wrong far more often than anyone plans for. 3DS negative…

How 3DS Error Codes and the Error Message Actually Work

Most 3DS support tickets that reach an escalation queue contain an error and no explanation. Someone has a code, or an HTTP status, or neither, and nobody can say whether the problem is theirs or the counterparty's. 3DS error codes carry more…

How an ACS can check 3DS app provenance

An app-based authentication request tells the issuer a great deal about the device. It also carries 3DS app provenance, meaning information about the app the transaction came from, and this part goes almost entirely unused. Specifically, it…

The 3DS challenge iframe settings that are now requirements rather than recommendations

Most merchants set up their challenge iframe once, during the original 3DS integration, and have not looked at it since. That was defensible when the guidance was advisory. It is not any more. EMVCo released the EMV 3D Secure Browser Flow…

What happens to 3DS when JavaScript is disabled or unavailable

A small proportion of your browser traffic runs with JavaScript disabled, and 3DS behaves differently there. Privacy configurations, corporate builds, assistive setups, older embedded browsers, and a certain amount of automated traffic you…