Tag Archive for: 3d secure

What Each of the Five 3DS Message Extensions Does

The Core Specification defines a fixed set of data elements. Real payment businesses have needs that a fixed set cannot cover, and rather than expand the core indefinitely, EMVCo publishes separate documents that add defined data to existing…

How an ACS Picks a 3DS Challenge Method and Renders It

Most issuers configured a 3DS challenge method once and have not revisited it. In a large number of cases that method is a passcode sent by text message, applied to everyone, on every device, in every channel. Selecting a 3DS challenge method…

Why the 3DS Transaction Status Differs Between Messages

The 3DS transaction status element appears in more than one message, and it does not mean the same thing each time. Teams that read whichever copy arrives first, and act on it, end up with reporting that does not reconcile and occasionally…

How to Build 3DS Negative Testing Into Your Test Plan

Certification proves your implementation can complete a transaction correctly. It is not designed to prove your implementation behaves sensibly when something goes wrong, and something goes wrong far more often than anyone plans for. 3DS negative…

How 3DS Error Codes and the Error Message Actually Work

Most 3DS support tickets that reach an escalation queue contain an error and no explanation. Someone has a code, or an HTTP status, or neither, and nobody can say whether the problem is theirs or the counterparty's. 3DS error codes carry more…

How an ACS can check 3DS app provenance

An app-based authentication request tells the issuer a great deal about the device. It also carries 3DS app provenance, meaning information about the app the transaction came from, and this part goes almost entirely unused. Specifically, it…

What happens to 3DS when JavaScript is disabled or unavailable

A small proportion of your browser traffic runs with JavaScript disabled, and 3DS behaves differently there. Privacy configurations, corporate builds, assistive setups, older embedded browsers, and a certain amount of automated traffic you…

The decisions EMV 3DS deliberately leaves out of scope

A standard is usually read as an answer sheet. If two products both implement it, the reasoning goes, they behave the same way, and the remaining differences are commercial. EMV 3DS does not work like that, and the places where it does not…

EMV 3DS Version Management: From Protocol Versions to Device Information

Teams new to EMV 3DS usually assume there is a specification, that it has a version number, and that being on that version means being current. All three assumptions are wrong in ways that cause real planning failures. There is a family of…

The field-level rules behind 3DS requestor data quality

Issuers can only assess the risk data they actually receive. That sentence is uncontroversial and almost never acted on, because the data quality problem in 3DS is not a strategic one. It is a hundred small encoding and population decisions…