Understanding the Directory Server’s Role and Limits in EMV 3DS

Diagrams of EMV 3D Secure usually show three boxes and two arrows. The merchant's 3DS Server on one side, the issuer's Access Control Server on the other, and something in the middle labelled Directory Server that everyone nods at and nobody…

How Bridging Message Extensions Support New Features in Older 3DS Products

No payments estate upgrades in a single step. Some components move to a new protocol version quickly, others are constrained by vendor release cycles, scheme certification windows or simply by the fact that they work and nobody wants to touch…

What the 3DS Requestor Must Disclose Before an App Collects Device Data

Teams building app-based 3D Secure usually discover the disclosure obligations at the worst possible moment, which is during app store submission, with a release date already committed. The requirements are not onerous. They are just easy to…

How the ACS Information Indicator Tells the Acquiring Side What an Issuer Supports

Most acquiring-side 3DS implementations send the same shaped authentication request to every issuer and find out what happened afterwards. That works, in the sense that transactions authenticate. It also means a good deal of information the…

How the 3DS SDK Gathers, Encrypts, and Transmits Device Data to the ACS

App-based 3D Secure has a reputation for producing better frictionless rates than browser flows, and the reason is usually given as richer device data. That is true, but it is an incomplete answer. The more interesting part is how the data…

When an Issuer Lets the Merchant Authenticate the Cardholder

A cardholder unlocks a retailer's app with their face, browses, and checks out. They are then asked to authenticate again, this time by their bank, using a code sent by text message. The second authentication is weaker than the first and considerably…

How Binding a Device to a Cardholder Account Changes ACS Risk Assessment

Risk-based authentication works better the more it knows about the device in front of it. That is uncontroversial. What is less obvious is that the protocol provides a way for the cardholder themselves to confirm the link between a device and…

How Trust Lists Reduce Challenges for Merchants Cardholders Trust

Every issuer has a cardholder who buys from the same three merchants every week and gets challenged every time. The risk model is not wrong exactly. It just has no way of knowing what the cardholder knows, which is that this particular…

How Exemptions Are Requested, Granted and Reported Across the 3DS Message Flow

Most discussion of Strong Customer Authentication exemptions happens at policy level. Which exemptions exist, what the thresholds are, when a regulator expects them to apply. That conversation is well covered. What gets much less attention…

Why Browser-Based Out-of-Band Authentication Fails on Mobile

Out-of-band authentication is meant to be the good option. The cardholder approves a payment in their banking app, where they are already enrolled, already recognised, and already familiar with the interface. No codes to read off an SMS, nothing…