A-3 Secure Authentication Data

The 3-D Secure system uses various data fields to report the authentication status of the Cardholder. Each 3-D Secure version may use slightly different terminology for the fields and have slightly different values but for ease of use the Gateway uses the terminology and values as described in this appendix.

The field’s values would normally be populated by the Gateway’s 3DS v1 Merchant Plugin Interface (MPI) or 3DS v2 3DS Server component1, however you may choose to use your own MPI/3DS Server component and provide the values, as described in section 5.4.6.

A-3.1 3-D Secure Enrolment Status

The threeDSEnrolled field indicates if the card is enrolled in the 3-D Secure program. 

For 3DS v1 the value is requested from the Directory Server for every transaction using a Verify Enrolment Request/Response (VEReq/VERes) message. 

For 3DS v2 the value is determined if the card number is within one of the enrolled ranges downloaded daily from the Directory Server using a Preparation Request/Response (PReq/PRes) message. 

The field can contain one of the following values: 

Y – Enrolled. The card is enrolled in the 3-D Secure program and the payer is eligible for authentication processing.

 N – Not Enrolled. The checked card is eligible for the 3-D Secure (it is within the card association’s range of accepted cards) but the card issuing bank does not participate in the 3-D Secure program. If the Cardholder later disputes the purchase, the issuer may not submit a chargeback to you. 

U – Unable To Verify Enrolment. The card associations were unable to verify whether the Cardholder is registered. As the card is ineligible for 3-D Secure, you can choose to accept the card nonetheless and precede the purchase as non-authenticated and submits authorisation with ECI 07. You and the Acquirer retain liability if the Cardholder later disputes making the purchase (3DS v1 only). 

E – Error Verifying Enrolment. The Gateway encountered an error. This card is flagged as 3-D Secure ineligible. The card can be accepted for payment, yet you may not claim a liability shift on this transaction in case of a dispute with the Cardholder (3DS v1 only). 

1 The 3DS Server is the Gateway/Merchant component that provides the interface with the 3DS Directory Server.

A-3.2 3DS Authentication Status

The threeDSAuthenticated field indicates if the cardholder has been authenticated by the 3-D Secure program.

 For 3DS v1 the value is provided by the Authentication Control Server after a Cardholder challenge in the Payer Authentication Response (PARes) message. 

For 3DS v2 the value is provided by the Directory Server either on requesting authentication in the Authentication Response (ARes) message, in the case of a frictionless flow, or after a Cardholder challenge in the Result Request (RReq) message, in the case of a challenge flow. 

The field can contain one of the following values:

 Y – Authentication Successful. The Issuer has authenticated the Cardholder by verifying the identity information or password. A CAVV and an ECI of 5 is returned. The card is accepted for payment. 

A – Attempted Authentication. A proof of authentication attempt was generated. The Cardholder is not participating, but the attempt to authenticate was recorded. The card should be accepted for payment and authentication information passed to authorisation processing.

 N – Not Authenticated. The Cardholder did not complete authentication and the card should not be accepted for payment. 

R – Rejected By Issuer. The Issuer rejected the transaction and must not be accepted for payment (3DS v2 only). 

D – Decoupled Challenge Required. Decoupled authentication confirmed (3DS v2 only). 

I – Information Only. 3DS Requestor challenge preference acknowledged (3DS v2 only). 

U – Unable To Authenticate. The authentication was not completed due to technical or another problem. A transmission error prevented authentication from completing. The card should be accepted for payment, but no authentication data will be passed on to authorisation processing and no liability shift will occur. 

E – Error Checking Authentication. The Gateway encountered an error. The card should be accepted for payment, but no authentication information will be passed to authorisation processing and no liability shift will occur. 

A-3.3 3-D Secure Transaction Identifier

The threeDSXID field provides a unique value to identify the transaction through the 3-D Secure system. 

For 3DS v1 the value is referred to as the Transaction Identifier or XID and is a 28-character Base-64 encode identifier. 

For 3DS v2 the value is referred to as the 3DS Server Transaction ID and is a 36-character universally unique identifier (UUID) as defined in IETF RFC 4122. 

A-3.4 3DS Electronic Commerce Indicator

The threeDSECI field indicates the security status of the transaction after the Cardholder has been authenticated or attempted authentication. 

For 3DS v1 the value is provided by the Authentication Control Server after a Cardholder challenge in the Payer Authentication Response (PARes) message. 

For 3DS v2 the value is provided by the Directory Server either on requesting authentication in the Authentication Response (ARes) message, in the case of a frictionless flow, or after a Cardholder challenge in the Result Request (RReq) message, in the case of a challenge flow.

 The value is always present if the threeDSAuthenticated field has a value of Y (successful authentication), or A (attempted authentication) but can be present at other times. 

The field can contain one of the following 2-digit values1: 

05/02 – Both cardholder and card issuing bank are 3DS enabled. 3DS card authentication is successful. 

06/01 – Either cardholder or card issuing bank is not 3DS enrolled. 3DS card authentication is unsuccessful, in sample situations as: 

1. 3DS cardholder not enrolled. 
2. Card issuing bank is not 3DS ready.

 07/00 – Authentication is unsuccessful or not attempted. The card is either a non-3DS card or card issuing bank does not handle it as a 3DS transaction. 

1 The values are show as pairs, the first value is for Visa and other card schemes and the second for Mastercard only.  

A-3.5 3DS Cardholder Authentication Verification Value

The threeDSCAVV field provides proof that the Cardholder has been authenticated or attempted authentication. 

For 3DS v1 the value is provided by the Authentication Control Server after a Cardholder challenge in the Payer Authentication Response (PARes) message. 

For 3DS v2 the value is provided by the Directory Server either on requesting authentication in the Authentication Response (ARes) message, in the case of a frictionless flow, or after a Cardholder challenge in the Result Request (RReq) message, in the case of a challenge flow. 

The value is present if the threeDSAuthenticated field has a value of Y (successful authentication), or A (attempted authentication). 

The field will contain a 28-character Base-64 encoded value (32-characters for Mastercard).