3D Secure in Europe

​

3D Secure

​

3D Secure configurations

• Automated Decisioning (recommended for customers in Europe)
  • Marqeta makes the decision whether to challenge based on static rules.
  • No-code option fully handled by Marqeta.
• Advanced Authentication (recommended for customers in Europe)
  • Cardholder authentication is delegated via API request to customer to authenticate and return verification result.
  • Low-code option decisioning.
• Default OTP
  • Marqeta handles verification using data configured via API.
  • No-code option fully handled by Marqeta.
• Delegated Decisioning
  • Customer uses own risk logic to determine whether or not the transaction requires an SCA challenge.
  • High-code option with full flexibility and control over 3DS attempts.

​

Automated decisioning

​

Automated decisioning rules

​

Advanced authentication

• Marqeta configures URL, username, and password (eight-character minimum), which act as the gateway to receive the authentication request and response within three seconds.
  • HTTP 200 response to confirm authentication.
  • Time allowed for authentication is shown within max_response_time (in minutes).
• Upon 200 response cardholder authentication, the screen prompts the cardholder awaiting the authentication result to be returned to Marqeta.
  • Your company logo can replace the Marqeta logo.
• Verification results should be returned to Marqeta on an asynchronous URL within the timeframe sent in the initial request.
  • https://authentication-acs.marqeta.com/v3/three-ds/authentication-result
• For browsers and devices that support JavaScript, auto-submit functionality immediately submits the request upon return of the API response.
  • Auto-submit is hidden for JavaScript-enabled applications.

​

Unsecured e-commerce

• The amount of the remote electronic payment transaction does not exceed €30;
  AND
• The cumulative amount of previous remote electronic payment transactions initiated by the payer since the last application of SCA does not exceed €100;
  OR
• The number of previous remote electronic payment transactions initiated by the payer since the last application of SCA does not exceed five consecutive electronic payment transactions.

• A mobile wallet payment (for example, Apple Pay and Google Wallet) is considered to be SCA secured.
• The transaction has been through 3DS, and the cardholder has provided verification.
• The acquirer_exemption field is present, stating that SCA is not required or cannot be completed.

• authentication_successful – Indicates 3DS was completed successfully.
• authentication_attempted – Indicates 3DS was attempted but was not successful.
• no_authentication – Indicates the transaction contains no authentication.

{
  "cardholder_authentication_data": {
    "electronic_commerce_indicator": "no_authentication",
    "issuer_exemption": "LOW_VALUE_PAYMENT"
  },
  "transaction_metadata": {
    "payment_channel": "ECOMMERCE"
  }
}

{
  "config": {
    "transaction_controls": {
      "strong_customer_authentication_limits": {
        "sca_lvp_transaction_limit": "30",
        "sca_lvp_cumulative_amount_limit": "100",
        "sca_lvp_transactions_count_limit": "5",
        "sca_lvp_transactions_currency": "EUR"
      }
    }
  }
}

​

Cardholder authentication data

• A 3DS message version indicating the version (2.1 or 2.2).
• The status of the authentication (successful or failed).
• The method of which the transaction was secured (for example, biometrics or one-time password).
• Matching verification_result and verification_value_created_by fields.

​

Alternative 3D Secure solutions

​

Default one-time passcode

• Challenge-all with default OTP.
  • Challenges every attempt using default OTP and fully handled by Marqeta.
  • Not fully compliant in all regions with the requirement to conduct further SCA.
• Delegate decisioning with default OTP.
• Marqeta automated decisioning with default OTP.

• SMS OTP (primary), Email OTP (secondary).
• Knowledge-based questions (KBA) Only.
• SMS OTP (primary), Email OTP (secondary) plus KBA.
  • Meets SCA standards in most regions.

​

3DS correspondence

• Subject: $programName <noreply@marqeta.com&gt;
• Body: One-time PIN for the transaction of $purchaseAmount $purchaseCurrency at $merchantName using $programName card $lastFour is: $otp Expires in 10 minutes. Sincerely, $programName

​

3DS personalization

• A name or logo can be chosen to appear on the one-time passcode (OTP) screen to present to cardholders
  • Supported format is .png
  • Maximum file dimensions are 47 pixels (height) x 140 pixels (width)
  • Maximum file size is 5 MB
• The program name can be displayed in customer notifications, such as email and SMS OTP
• The custom alphanumeric sender ID for SMS OTP must contain at least one letter; special characters and punctuation are not allowed. Sender IDs can contain up to 11 characters from the following categories:
  • Uppercase letters (A - Z)
  • Lowercase letters (a - z)
  • Numbers (0 - 9)
  • Spaces

​

Knowledge-based questions

• Cardholder metadata is used to configure questions and answers.
• Three free-form questions and answers can be set per cardholder.
• Marqeta displays one question at random and validates cardholder input with a stored answer.
• Cardholder validates OTP first, followed by a random knowledge-based question.

{
  "metadata": {
    "authentication_question1": "What was your first job?",
    "authentication_question2": "What make was your first car?",
    "authentication_question3": "What is your favorite color?",
    "authentication_answer1": "Cashier",
    "authentication_answer2": "Trabant",
    "authentication_answer3": "Blue"
  }
}

​

Delegated decisioning

{
  "acs_transaction_id" : "xxx",
  "type" : "authentication.decision",
  "state" : "PENDING",
  "network" : "MASTERCARD",
  "message_version" : "2.1.0",
  "authentication_request_type" : "PAYMENT",
  "transaction" : {
    "transaction_type" : "PAYMENT",
    "sub_type" : "PURCHASE",
    "amount" : 7667,
    "currency_code" : "985",
    "exponent" : 2,
    "date" : "20210302140611",
    "shipping_address_is_billing_address" : false,
    "maximum_permitted_installments" : null,
    "detokenisation_source" : null,
    "recurring" : null
  },
  "card_acceptor" : {
    "acquirer_bin" : "543151",
    "merchant_id" : "**MASKED**",
    "merchant_category_code" : "4900",
    "country" : "616",
    "name" : "PayPo Sp. z o.o.",
    "risk_indicators" : null
  }
}

{
  "acs_transaction_id" : "xxx",
  "type" : "authentication.decision",
  "recommended_action" : "EXEMPT",
  "model" : "xxx",
  "challenge_score" : 1,
  "reasons" : [ ],
  "primary_reason" : null,
  "use_otp_challenge" : false,
  "api" : {
    "version_used" : "0.1.0"
  }
}

​

3D Secure webhook notifications

​

3D Secure (3DS) responsibilities