Tag Archive for: 3d secure

What India’s Cross-Border CNP Authentication Rule Means for Issuers and ACS Providers

Since 1 October 2026, card issuers in India have had to put in place a mechanism to validate non-recurring cross-border card-not-present (CNP) transactions when an overseas merchant or overseas acquirer asks for authentication. They also had…

What Australia’s 1 October Payment Reforms Do and Do Not Change for 3D Secure

On 1 October 2026, two parts of the Reserve Bank of Australia's (RBA) review of merchant card payment costs took effect. Merchants can no longer surcharge card payments on the eftpos, Mastercard, and Visa networks, and the caps on interchange…

How to Scope 3DS Regression Testing When a Component Changes

Changes arrive at a 3DS deployment from more directions than most test plans anticipate. A specification bulletin. A new device information version driven by an operating system release. A vendor patch. A scheme programme update. A counterparty…

What Each of the Five 3DS Message Extensions Does

The Core Specification defines a fixed set of data elements. Real payment businesses have needs that a fixed set cannot cover, and rather than expand the core indefinitely, EMVCo publishes separate documents that add defined data to existing…

How an ACS Picks a 3DS Challenge Method and Renders It

Most issuers configured a 3DS challenge method once and have not revisited it. In a large number of cases that method is a passcode sent by text message, applied to everyone, on every device, in every channel. Selecting a 3DS challenge method…

Why the 3DS Transaction Status Differs Between Messages

The 3DS transaction status element appears in more than one message, and it does not mean the same thing each time. Teams that read whichever copy arrives first, and act on it, end up with reporting that does not reconcile and occasionally…

How to Build 3DS Negative Testing Into Your Test Plan

Certification proves your implementation can complete a transaction correctly. It is not designed to prove your implementation behaves sensibly when something goes wrong, and something goes wrong far more often than anyone plans for. 3DS negative…

How 3DS Error Codes and the Error Message Actually Work

Most 3DS support tickets that reach an escalation queue contain an error and no explanation. Someone has a code, or an HTTP status, or neither, and nobody can say whether the problem is theirs or the counterparty's. 3DS error codes carry more…

How an ACS can check 3DS app provenance

An app-based authentication request tells the issuer a great deal about the device. It also carries 3DS app provenance, meaning information about the app the transaction came from, and this part goes almost entirely unused. Specifically, it…

What happens to 3DS when JavaScript is disabled or unavailable

A small proportion of your browser traffic runs with JavaScript disabled, and 3DS behaves differently there. Privacy configurations, corporate builds, assistive setups, older embedded browsers, and a certain amount of automated traffic you…