Tag Archive for: ACS

How Issuers Should Approach ACS Capacity Planning for Peak Trading

Black Friday falls on 27 November 2026 and Cyber Monday on 30 November. For card issuers, ACS capacity planning is the part of peak preparation that is easiest to get wrong, because the Access Control Server (ACS) is rarely the first thing…

How Restrictions on Third-Party Cookies Affect the 3DS Method

In browser-based EMV 3D Secure (EMV 3DS), the 3DS Method lets the issuer's Access Control Server (ACS) collect browser information through a hidden frame on the merchant's checkout. Because that frame belongs to the ACS while the page belongs…

How Issuers Can Detect Scams After a Successful 3DS Challenge

A cardholder successfully completes a 3D Secure (3DS) challenge, confirming their identity through a one-time passcode or banking app. Yet the transaction may still be fraudulent. In social-engineering scams, criminals persuade genuine cardholders…

What Happens to 3DS When an Issuer’s ACS Is Unavailable

When an issuer's Access Control Server (ACS) stops responding, online payments for its cardholders do not necessarily stop. The card scheme's Directory Server (DS) may answer the authentication request on the issuer's behalf. That keeps checkouts…

How an ACS Picks a 3DS Challenge Method and Renders It

Most issuers configured a 3DS challenge method once and have not revisited it. In a large number of cases that method is a passcode sent by text message, applied to everyone, on every device, in every channel. Selecting a 3DS challenge method…

How an ACS can check 3DS app provenance

An app-based authentication request tells the issuer a great deal about the device. It also carries 3DS app provenance, meaning information about the app the transaction came from, and this part goes almost entirely unused. Specifically, it…

The decisions EMV 3DS deliberately leaves out of scope

A standard is usually read as an answer sheet. If two products both implement it, the reasoning goes, they behave the same way, and the remaining differences are commercial. EMV 3DS does not work like that, and the places where it does not…

What a soft decline is and how to respond to one with 3DS

A merchant sends a card transaction straight to authorisation without authenticating first. The issuer declines it, but not because anything is wrong with the card. The decline means something closer to: authenticate the cardholder and come…

How the SDK and ACS interact during an app-based 3DS challenge

An app-based 3DS challenge looks simple from the outside. The cardholder taps, a screen appears, they enter a code, the payment completes. Underneath, the screen they see is the product of a negotiation that runs across four separate messages,…

How Bridging Message Extensions Support New Features in Older 3DS Products

No payments estate upgrades in a single step. Some components move to a new protocol version quickly, others are constrained by vendor release cycles, scheme certification windows or simply by the fact that they work and nobody wants to touch…