Seamless Payments with PSD2, SCA, 3D-Secure 2: All You Have to Know About the New Regulations

The SCA introduced with PSD2 will provide even greater fraud prevention for online payments. For this to apply, both the card owner’s bank and the vendor’s payment service processor need to be based in EU. During the online purchase, SCA is used to determine the identity of the customer and authentication is carried out using two factors. The 3D-Secure 2 (3DS2) standard was introduced for card payments, which – depending on the card provider – requires security checks such as “Visa Secure" (previously known as "Verified by Visa"), “Mastercard Identity Check” and “American Express SafeKey”. Transactions that do not adhere to the new authentication directive can be rejected by the issuing bank of the customer. Transferring the information provided in predefined fields allows real-time transaction monitoring and risk analysis at the acquirer.

Marco Dania, IXOPAY Lead Software Engineer says, “The 3DS2 protocol is a new system environment, where the actual authentication happens on the issuer side. We need to provide the issuer with essential information provided via predefined fields (e.g. browser language, card holder information, how long the customer has been registered, when the last password update took place, whether the shipping address has been used before etc.), which help them decide whether SCA is required or not. For 3D-Secure 2, this means either “frictionless flow”, because no further authentication is required, or “challenge flow”, meaning the card owner needs to further identify themselves via SCA. Our API provides all necessary data elements required by the acquirer/PSP to complete the 3D-Secure authentication. IXOPAY itself implemented a 3D-Secure 2 server from Netcetera, one of the leading global providers of 3D-Secure software, which is used to initiate and complete the payment process.”

At the heart of the new EU directive are “seamless and safe payments” for card-based transactions (e.g. via VISA, Mastercard etc.). Exceptions include, among others, transactions with a value of less than 30 euros, recurring transactions (e.g. membership fees), MoTo transactions (payments made via mail or telephone order), as well as payments where the acquirer of the card or the issuer are not based in EU.

“3D-Secure 2 means merchants are facing large challenges regarding the transfer of data required for a seamless checkout. We are excited and proud that after months of work on the integration and intensive coordination with card schemes like VISA and Mastercard, the transition will be kept as simple as possible for our vendors. This solution allows our customers to secure transactions via 3DS independent of the acquirer”, says Marco Dania, IXOPAY Lead Software Engineer.

The shopping experience when using 3DS1 was very inflexible. Each customer needed to go through an authentication process that involved being forwarded to a security form in a new browser window or iFrame. Furthermore, these forms were also not adapted to meet the requirements of modern web applications and web shops. On the one hand, 3DS2 opens up the opportunity for “frictionless flows” (meaning no forwarding is required); on the other hand it makes it easier for vendors to control the security forms. For example, the desired size of the iFrame can be defined, or a dedicated 3D-Secure SDK can be integrated in mobile apps. This provides seamless integration with vendor’s native apps, resulting in higher conversion rates and better protection against fraud.

The new EU regulations should help issuers and merchants distinguish good transactions from bad ones, and provide customers with a quick and pleasant online shopping experience. The SCA requirements under PSD2 will come into effect in the EU on 14 September 2019. As things stand currently, many issuers and acquirers are not yet prepared for the new standard. The card schemes have therefore announced that they will continue to permit 3D-Secure 1 authentication in many regions until 2020, or at least not to refuse transactions based on that authentication method. User identification should make eCommerce a comfortable experience while increasing security – factors that are essential to end customers and keep conversion rates high for merchants. As of now, IXOPAY offers all customers and partners Strong Customer Authentication in the form of 3D-Secure 2.

Find IXOPAY on the 3D-Secure 2 vendor lists provided by Visa and Mastercard!