3D Secure for regulation compliance
Learn what you need to do to stay compliant with authentication regulations and to retain maximum conversion for your online card payment transactions.
What you need to know
Card schemes and regulatory agencies around the world are taking action to make payments safer and more secure for cardholders. For example, the European Commission issued the Revised Payment Services Directive (PSD2) governing electronic payments within Europe. PSD2 includes a mandate that requires banks to perform strong customer authentication (SCA) for online payments.
Most regulations apply to issuing banks and not to you as a merchant, however, you will get the risk of getting lower authorization rates if an issuing bank evaluates a transaction as non-compliant, and refuses the transaction as a result.
What you need to do
To make sure that your transactions comply with regulations like PSD2 SCA, you need to implement 3D Secure, an authentication protocol developed by EMVCo and supported by major card schemes.
We recommend that you become familiar with guidance from regulatory agencies, card schemes, and with EMVCo specifications. In addition, we as your payment service provider will provide further guidance to help ensure that while you are complying with regulations, you are also maintaining a good online payments experience for your shoppers. For example, we have a comprehensive PSD2 compliance and integration guide where we describe how PSD2 SCA may affect different business models.
The next sections describe the following topics on regulations and online payments authentication in general:
- Summary of existing regulations around the world: Get to know local directives depending on the country you're operating from.
- Important dates: See the current schedule for regulation implementation and 3D Secure changes.
- 3D Secure protocol for regulation compliance: Check how you can comply with authentication regulations using 3D Secure 1 and 3D Secure 2.
- 3D Secure 2 implementation options: Find out how you can support 3D Secure 2 with your existing integration.
Overview of existing regulations
Here are examples of existing regulations that may apply either to you or to issuing banks if you are conducting business in the following regions:
See PSD2 SCA compliance and implementation guide for more information on actions that you need to take to comply with the EU directive.
Use 3D Secure for compliance
3D Secure is an authentication protocol that provides an additional layer of verification for card-not-present (CNP) transactions. The protocol is compliant with authentication regulations, including the SCA mandate from PSD2.
3D Secure has two available versions:
- 3D Secure 1 : Before a payment is authenticated, shoppers are redirected to the card issuer's site to provide additional authentication data such as a password or an SMS verification code. The redirection introduced in 3D Secure 1 might lead to lower conversion rates due to technical errors during the redirection or due to shoppers dropping out of the authentication process.
- 3D Secure 2 : Unlike the previous version where shoppers are redirected to another site, in 3D Secure 2 the card issuer performs the authentication within your app or payment form. The shopper's identity may be verified using passive, biometric, and two-factor authentication approaches.
Guidance for implementing 3D Secure
We recommend that you implement both 3D Secure 1 and 3D Secure 2. If you are using our Checkout SDKs, HPP, Plugins, or API with 3D Secure 1 integration, you don't have to do anything. You are ready to support 3D Secure 2 through the same redirect page.
However, we also have existing solutions to support 3D Secure 2 authentication natively within your app or payment form. If you decide to implement native 3D Secure 2 authentication in addition to your 3D Secure 1 integration, check out 3D Secure implementation options.
3D Secure chargeback liability shift rules
When you implement 3D Secure 2 authentication, you can avoid the liability for chargebacks in case of fraud (for example, chargeback claim due to lost or stolen card), this is called a
liability shift.
The general rule is if a shopper successfully completes a 3D Secure 2 challenge authentication flow, the liability for fraudulent chargebacks shifts from you to the card issuer. In a challenge flow, the issuer requires additional shopper interaction. In some regions, card schemes may grant liability shift after a successful frictionless flow, where the transaction is approved after a passive authentication.
The following tables show the liability shift rules for Visa and Mastercard. Note that the general rule applies to the transaction types, unless specified.
Visa liability shift rules
| Region/Countries | Period | Transaction type | Liability shift applies? |
|---|
| EU | Before 14 March 2020 | 3D Secure 2 transaction with an issuer that supports 3D Secure 2. | Yes |
| After 14 March 2020 | 3D Secure 2 transaction regardless of whether the issuer supports 3D Secure 2. | Yes | |
| Brazil | From 15 August 2019 | 3D Secure 2 transaction. | Yes |
| Canada, LATAM | Before 15 August 2019 | 3D Secure 2 transaction. | No |
| After 15 August 2019 | 3D Secure 2 transaction successfully completed through either frictionless or challenge flow. | Yes | |
| APAC, MEA | Before 18 April 2020 | 3D Secure 2 transaction with an issuer that supports 3D Secure 2. | Yes |
| After 18 April 2020 | 3D Secure 2 transaction regardless of whether the issuer supports 3D Secure 2. | Yes | |
| US | Before 31 August 2020 | 3D Secure 2 transaction with an issuer that supports 3D Secure 2. | Yes |
| After 31 August 2020 | 3D Secure 2 transaction regardless of whether the issuer supports 3D Secure 2. | Yes | |
| Global | Before 17 October 2021 | 3D Secure 1 transaction | Yes |
| After 17 October 2021 | 3D Secure 1 transaction | No | |
For Visa transactions, the chargeback protection is valid for 90 days.
Mastercard liability shift rules
| Region/Countries | Period | Transaction type | Liability shift applies? |
|---|
| Brazil | From October 2018 onwards | 3D Secure 2 transaction. | Yes |
EU
| Between April to September 2019
| 3D Secure 2 transaction with an issuer that supports 3D Secure 2. | Yes |
| 3D Secure 2 transaction with an issuer that does not support 3D Secure 2. | Yes, but only if the issuer is unable to respond to a 3D Secure 2 call due to technical reasons. | | |
| From April 2019 onwards | PSD2 SCA out-of-scope transactions. | No | |
| 3D Secure 2 transactions where merchant or acquirer requests for a PSD2 exemption and the issuer grants an exemption. | No | | |
| From September 2019 onwards | 3D Secure 2 transaction. | Yes | |
| 3D Secure 2 transactions where issuing bank applies a PSD2 exemption without the merchant or acquirer requesting for it. For example, issuer TRA. | Yes | | |
Countries with existing regulations that require 3D Secure implementation:
- Nigeria
- South Africa
- India
- Singapore
- Bangladesh
- Malaysia
| Before October 2019 | 3D Secure 2 transaction. | No |
| After October 2019 | 3D Secure 2 transaction successfully completed through either frictionless or challenge flow. | Yes | |
Non-EU regions and countries not listed in the previous row:
- APAC
- LATAM
- MEA
- North America
| Before October 2019 | 3D Secure 2 transaction. | No |
| After October 2019 | 3D Secure 2 transaction successfully completed through either frictionless or challenge flow. | Yes | |
Mastercard has not yet announced an end date for the liability shift on 3D Secure 1 transactions, meaning that liability shift still applies there until further notice.
For Mastercard transactions, the chargeback protection is valid for 30 days. Starting from 2020, Mastercard will extend liability shift validity to 90 days.
Implementing 3D Secure 2 with your existing Adyen integration
If you are using our Checkout SDKs, HPP, Plugins, or API with 3D Secure 1 integration, you don't have change anything. You can already support 3D Secure 2 authentication through the same redirect page.
If you have an existing integration with us with a 3D Secure 1 implementation, you can already support 3D Secure 2. Similar to a 3D Secure 1 flow, you will need to redirect the shopper to the URL returned in the API response. If a transaction requires 3D Secure 2 authentication, we will provide a redirect URL which will take your shopper to our hosted page to complete the 3D Secure 2 authentication flow.
In the table below we discuss in detail how we will handle 3D Secure 2 across different integrations, and what you can do to improve the shopper experience should you choose to implement native 3D Secure 2 authentication.
| Your existing integration | What you need to do to support 3D Secure 2 |
|---|
| Online payments API, with existing 3D Secure 1 integration. | Do nothing. 3D Secure 2 will be supported through a redirect.
However, if you want a better shopper experience, add 3D Secure 2 Components or use Drop-in on your client-side implementation. |
| Quick integration Checkout SDKs | Do nothing. 3D Secure 2 will be supported in Web, iOS, and Android SDKs through a redirect.
However, if you want a better shopper experience with native 3D Secure 2 authentication, switch to our Web, iOS, and Android Drop-in solution available from versions 3.0.0 and later.
If you want to continue using the mobile SDKs, you can upgrade to the following versions which support 3D Secure 2:
- Checkout Android SDK version 2.4.0 to 2.4.5.
- Checkout iOS SDK version 2.6.0 to 2.8.4
|
| |
| Plugins for Magento 1 and 2, PrestaShop, SFCC, or SAP Commerce (Hybris) | Upgrade to the following plugin versions to support native 3D Secure 2 authentication:
- Magento 2 version 4.2.0 and later.
- Salesforce Commerce Cloud version 19.1.0 and later.
- SAP Commerce (Hybris) version 5.0.0 and later.
- PrestaShop version 1.0.0 and later.
If you choose to continue using an older version of our plugins, we will support 3D Secure 2 through a redirect. |
| Hosted Payment Pages (HPP) | Do nothing. 3D Secure 2 will be supported through a redirect.
However, we strongly recommend to move your implementation to our online payments API with the 3D Secure 2 Component for a better user experience. |
| Classic integration or CSE, with existing 3D Secure 1 integration. | Do nothing. 3D Secure 2 will be supported through a redirect.
However, if you want a better shopper experience with native 3D Secure 2 authentication, use our helper functions for web and the Classic integration 3D Secure 2 SDKs for mobile. |
| Online payments API, without a 3D Secure 1 integration. | Integrate 3D Secure redirect authentication to support both versions of 3D Secure or a combination of 3D Secure 2 native authentication and a 3D Secure 1 fallback. |
| |
| Classic integration or CSE, without a 3D Secure 1 integration. | Integrate 3D Secure classic API redirect authentication to support both versions of 3D Secure or a combination of 3D Secure 2 native authentication and a 3D Secure 1 fallback. |
For guidelines on using 3D Secure with your current business model, see PSD2 SCA compliance and implementation guide.
(c)
https://docs.adyen.com/online-payments/3d-secure-for-regulation-compliance
