EMV 3-D Secure defines messages for authenticating cardholders during e-commerce checkout. The 3DS Server, Directory Server and issuer's Access Control Server exchange information supporting frictionless or challenged authentication, alongside payment authorisation and settlement.
TL;DR:
- EMV 3-D Secure defines cardholder-authentication messages for remote card purchases.
- Merchant-side, directory and issuer components exchange transaction, payment and device data.
- Risk-based frictionless or challenge flows support authentication before normal payment processing.
Summary
Purpose and Scope
EMV 3-D Secure defines messages for authenticating cardholders during e-commerce checkout. The 3DS Server, Directory Server and issuer's Access Control Server exchange information supporting frictionless or challenged authentication, alongside payment authorisation and settlement.
Authentication Exchange
EMVCo describes data exchange between merchants and issuers to help authenticate the consumer and reduce card-not-present fraud. Transaction, payment-method and device information informs the issuer’s decision. The 3DS Server, Directory Server and issuer Access Control Server provide distinct roles in that exchange.
Customer Interaction
Depending on the risk and supported features, authentication can proceed without an additional customer challenge or require interaction. Browser and application channels need the appropriate components.
Specifications and Approval
EMVCo maintains the specification family and supporting approval processes and works with PCI SSC on security evaluation. Implementing a version is distinct from product approval and from a scheme’s deployment policy. The generic technology family should not be treated as one fixed edition.
Keywords
- EMV 3DS
- Cardholder Authentication
- E-Commerce
- 3DS Server
- Directory Server
- Access Control
- Device Data
- Risk Analysis
- Challenge Flow
- CNP Fraud