Tag Archive for: ACS

How an ACS Picks a 3DS Challenge Method and Renders It

Most issuers configured a 3DS challenge method once and have not revisited it. In a large number of cases that method is a passcode sent by text message, applied to everyone, on every device, in every channel. Selecting a 3DS challenge method…

How an ACS can check 3DS app provenance

An app-based authentication request tells the issuer a great deal about the device. It also carries 3DS app provenance, meaning information about the app the transaction came from, and this part goes almost entirely unused. Specifically, it…

The decisions EMV 3DS deliberately leaves out of scope

A standard is usually read as an answer sheet. If two products both implement it, the reasoning goes, they behave the same way, and the remaining differences are commercial. EMV 3DS does not work like that, and the places where it does not…

What a soft decline is and how to respond to one with 3DS

A merchant sends a card transaction straight to authorisation without authenticating first. The issuer declines it, but not because anything is wrong with the card. The decline means something closer to: authenticate the cardholder and come…

How the SDK and ACS interact during an app-based 3DS challenge

An app-based 3DS challenge looks simple from the outside. The cardholder taps, a screen appears, they enter a code, the payment completes. Underneath, the screen they see is the product of a negotiation that runs across four separate messages,…

How Bridging Message Extensions Support New Features in Older 3DS Products

No payments estate upgrades in a single step. Some components move to a new protocol version quickly, others are constrained by vendor release cycles, scheme certification windows or simply by the fact that they work and nobody wants to touch…

How the ACS Information Indicator Tells the Acquiring Side What an Issuer Supports

Most acquiring-side 3DS implementations send the same shaped authentication request to every issuer and find out what happened afterwards. That works, in the sense that transactions authenticate. It also means a good deal of information the…

How the 3DS SDK Gathers, Encrypts, and Transmits Device Data to the ACS

App-based 3D Secure has a reputation for producing better frictionless rates than browser flows, and the reason is usually given as richer device data. That is true, but it is an incomplete answer. The more interesting part is how the data…

When an Issuer Lets the Merchant Authenticate the Cardholder

A cardholder unlocks a retailer's app with their face, browses, and checks out. They are then asked to authenticate again, this time by their bank, using a code sent by text message. The second authentication is weaker than the first and considerably…

Why Skipping the 3DS Method URL Raises Your Challenge Rate

If your frictionless rate is lower than your peers and your data quality looks fine, there is a good chance the problem sits earlier in the checkout than you have been looking. Before an authentication request is ever sent, the browser flow…