This document is intended for merchants and their technical teams wishing to implement 3-D Secure on their e-commerce website, for the CB, VISA, MASTERCARD, Bancontact and AMEX payment methods.

To get an overview of the Mercanet solution, we advise you to consult the following documents:

• Functional presentation ;
• Functionality set-up guide.

3-D Secure is an authentication protocol designed to reduce the risk of fraud associated with online payments. Its purpose is to ensure that the card is used by its true holder.

When making a 3-D Secure payment, there is an additional step of authenticating the cardholder.

In addition to enhanced security, 3-D Secure allows you to benefit from the liability shift to the card issuing bank. In the event of fraudulent payment, you are guaranteed to receive the funds, it is the cardholder's bank that bears this responsibility. In rare cases, the cardholder's bank may accept a request for authorisation but refuse this liability shift, in this case the payment is no longer guaranteed, and the holderAuthentRelegationCode field is set to Y.

These liability shift rules are issued by the CB, VISA, MASTERCARD and Bancontact schemes. If the payment is guaranteed, the guaranteeIndicator field is set to Y.

For more details on cases of eligibility for liability shift, please refer to paragraph Liability shift's calculation

3-D Secure applies in the following cases:

• Single payment (described in this documentation)
• Payment in instalments
• Multiple payment uppon shipping
• Subscription payment
  • via wallet
  • via duplication

Despite obvious security benefits, 3-D Secure 1.0 (stopped since October 2022), deployed in France since 2007, does not provide an optimal user experience, and therefore has an impact on the conversion rate of online purchases.

To improve the user experience, the CB, VISA, MASTERCARD and AMEX networks now offer 3-D Secure 2.0 which provides a more optimal authentication system based on risk assessment and more suitable for smartphones.

Depending on the level of risk, issuing banks will decide whether or not to perform strong authentication of the client, this is an operating mode called "frictionless". The lower the risk, the higher the probability of obtaining a frictionless transaction.

The Revised Payment Services Directive (PSD2), making it mandatory to carry out strong authentication for payments initiated by the customer on the Internet or via a mobile application. 3-D Secure allows you to be in compliance for card payments with this new regulation. Without activating 3-D Secure, you are exposed to authorization denials due to un-authenticated transactions.

Therefore, unless you advise otherwise, any new webshop is registered on Mercanet with the 3-D Secure option activated by default.

If the 3-D Secure option is not activated on your webshop, please contact the Mercanet technical support to activate this option.

The activation of the 3-D Secure option is done in 2 steps:

• step 1 = enrolment of your shop on the concerned directory servers (CB, VISA, MASTERCARD, AMEX, Bancontact)
  • For the CB, Visa and Bancontact schemes, the enrolment is almost immediate.
  • For MASTERCARD, the enrolment is completed in 7 days
  • For AMEX, the enrolment is completed in 3 weeks
• step 2 = activation of 3-D Secure when enrollment on DS is completed:

This chapter describes how to implement 3-D Secure for one-time payments.

The 3DSv2 protocol allows passive customer authentication, when the risk of fraud is low enough. This authentication type is also known as ‘frictionless’ authentication. When making a ‘frictionless’ payment, the transaction is authenticated indeed, but the customer is not solicited. In a frictionless case, an authentication cryptogram is provided by the issuer and transmitted in the authorisation request. The DSP2 differentiates between several exemption cases:

• Exemptions for small amounts (<€30)
• Exemptions following an acquirer transaction risk analysis (acquirer TRA)
• Exemptions following an issuer transaction risk analysis (issuer TRA)
• Exemptions in the context of a payment to a trusted recipient
• Exemptions on the use of unnamed cards (cards granted to legal entities)

Frictionless payment operates in 2 ways:

• Merchant frictionless authentication, which you explicitely ask for in the payment request, using the fraudData.challengeMode3DS field. Even if you ask for frictionless authentication, the final decision on whether or not to grant this frictionless authentication remains with the card issuer. It is worth noting that in the case of the issuer granting frictionless authentication, you loose the payment guarantee and assume the risk of chargeback (the card issuer does not assume this risk any longer). If the issuer doesn't grant frictionless authentication, they assume the risk of chargeback.
• Issuer frictionless authentication decided by the card issuer depending on the transaction context data you populated in the request. Even if the issuer grants frictionless authentication, you keep the payment guarantee, which means the card issuer is the one assuming the risk of chargeback.

So as to foster frictionless authentication and consequently optimise your conversion rate, you must populate some request fields that are recommended by the CB, VISA and MASTERCARD schemes. These optional fields are submitted to the scheme's Directory Server and to the card issuer who decides whether or not to grant frictionless authentication.

This section lists the Mercanet connector fields which, in case they are populated, are submitted to the card scheme and to the issuer within the authentication request. This data, as defined by the EMVco standard, is used to fight fraud and to obtain frictionless authentication.

In the next table, the DS listed are only the ones that have explicitly given information about fields having an impact regarding frictionless authentication granting.

Among these fields we can identify:

• R - Fields recommended by the scheme indicated: these fields have been identified by the scheme as major for the transaction scoring. The scheme recommends they be populated by the merchant if the information is available.
• Rx - Fields recommended by the CB network and having major relevance for the DS CB scoring: these optional fields have been identified by the CB network as being very important for the scoring of the transaction. Thus the CB network recommends their supply by the merchant when the information is available. The order of importance is shown by the number behind the letter R. The most important fields are classified in R1 and so on.
• O - Optional fields: these fields are strictly optional, the scheme did not make any recommendation on how they should be populated.
• N - Fields not included: these fields are not submitted to the scheme.

In the following 3 cases:

• Technical problem
• Ineligible card BIN (BIN missing from DS Pres message)
• Card not enrolled 3DSv2 (in DS's Ares message)

Mercanet continues with a CB2A 160 2019 Authorisation Request with unavailability flag with the following fields :

• Field 59 type 0407 = 09 (VAD)
• Field 56 type 0033 = Byte1 bit '5' set «technical unavailability to implement authentication»

The fields concerned are valued as follows:

Depending on the additional options you have subscribed to, Mercanet applies the following rules:

Depending on your use case, please follow the integration recommendations described in one of the previous chapters.

Once you have completed the Mercanet connectors implementation, you can perform tests to validate your Mercanet integration.

If your webshop has not yet been registered with the 3-D Secure service, you must make a request to your usual contact, indicating the means of payment the 3-D Secure service should be activated for (CB/VISA/MASTERCARD and/or AMEX).

The 3-D Secure service activation is now up and running in production.

To make sure there is no regression, check the evolution of your conversion rate. The conversion rate is expected to decrease slightly, but if you notice a significant reduction in your conversion rate, quickly notify your usual contact so that they can diagnose the issue with you.