When making an online purchase with a bank card, you may notice a page asking you to enter a One-Time Password (OTP) sent to your phone.
This step is called the 3DS Challenge, and it’s a core part of the global payment security system.
The purpose of the 3DS Challenge
- Reduce card fraud.
- Shift the liability from the merchant (Acquirer) to the issuing bank (Issuer), which is known as Liability Shift.
What does Liability Shift mean?
Simply put: if a customer files a chargeback claiming the transaction was fraudulent, the bank is responsible for it as long as the payment went through the 3DS Challenge, not the merchant.
What does 3D Secure mean?
The term 3DS stands for 3 Domain Secure, meaning three main parties are involved in the process:
- Acquirer Domain: the merchant’s bank.
- Card Network Domain: such as Visa or Mastercard.
- Issuer Domain: the customer’s card-issuing bank.
These parties work together to ensure that authentication is safe and verified before completing the payment.
How does 3DS authentication work?
The 3DS process happens separately before the actual payment, and goes through several key steps:
- The payment gateway connects with the Directory Server (DS) of the card network (Visa/Mastercard).
- The system checks whether the card supports 3DS.
- If supported, it identifies the Access Control Server (ACS) of the issuing bank, which manages the OTP verification page.
- If the card supports 3DS, the payment gateway sends an Authentication Request (AReq) to the bank via the ACS.
- This request includes important details such as card number, IP address, browser information, and transaction amount.
- Frictionless Flow: the bank deems the transaction safe and approves it instantly without extra steps.
- Challenge Flow: the bank requires the customer to prove identity by entering an OTP on the verification page.
The issuing bank replies with an Authentication Response (ARes), which includes:
- CAVV: a cryptographic value created after successful authentication.
- Transaction ID: the transaction reference on the bank’s server.
- Transaction Status: outcome of the authentication (Y = Success, N = Failure, U = Unavailable).
- ECI (Electronic Commerce Indicator): shows the type of transaction and whether authentication was completed.
- Values 02 or 05 mean authentication was successful.
Why is this data important?
The authentication data from the issuing bank provides greater flexibility in payment processing:
- It can be used across multiple payment gateways to complete the transaction.
- If the payment fails with one gateway, the same authentication data can be retried on another gateway to improve success rates.
Conclusion
3D Secure is the first line of defense in online card payments.
It not only protects merchants from fraud risks but also provides customers with a safer and more trustworthy shopping experience.
