Enrollment and authentication

Enrollment

In order for a card to be enrolled in 3DS, the product needs to allow for this. This is done as part of the initial product setup by Paymentology, or can be configured by Paymentology on the product at a later stage.

🗒️
Not 3DS registered yet? Get in touch with our Sales team or contact your Paymentology Client Executive.

Card enrolment deals with how to inform the ACS system how to interact with a cardholder, so when a transaction reaches the ACS system, it can perform the 3DS authentication and proceed with authorization.

We summarize card enrolment into three different methods:

Auto enrollment
In this method the card is automatically enrolled in 3DS during card creation. Auto enrollment is enabled at the product level by Paymentology at the request of the client.

Manual enrollment

In this method the client enrolls the card by using the Enroll card to 3DS endpoint.

{
  "api_call_unique_identifier": "438574845790123455",
  "client_id": 12345,
  "user_id": "string",
  "remarks": "string",
  "token": 312312381,
  "language": "en",
  "manager": "self",
  "pam": "string",
  "authentication_type": "s",
  "3ds_challenge_methods": [
    {
      "ids": "497f6eca-6276-4993-bfeb-53cgggga6f08"
    }
  ],
  "3ds_challenge_profile": "950c886e-8eba-4465-1234-d22f90d269f8"
}

{
  "header": {
    "error_id": 0,
    "error_desc": "success"
  },
  "body": {
    "cardToken": "895b81a9d7d16a81eea58dfe311b8f190123456de7c53417ce120ccbc3258980"
  }
}

Bulk card enrollment

In this method the client can enroll multiple cards by calling the Enroll card batch to 3DS endpoint.

{
  "api_call_unique_identifier": "438512345690657485",
  "client_id": 12345,
  "user_id": "string",
  "remarks": "string",
  "tokens": [
    0
  ],
  "prod_id": 12,
  "language": "en",
  "3ds_challenge_profile": "950c886e-8eba-1234-5678-d22f90d269f8"
}

{
  "header": {
    "error_id": 0,
    "error_desc": "success"
  },
  "body": [
    {
      "cardToken": "string",
      "token": 0
    }
  ]
}

Card enrolment failure

If card enrollment fails during auto enrollment at card creation this needs to be manually performed by using the Enroll card to 3DS API.

Authentication

Authentication is the process where the ACS system verifies the cardholder before it provides confirmation to the transaction originating network (e.g. Visa, Mastercard), the acquiring entity and the merchant about the authenticity of the cardholder for a specific Card Not Present (CNP) transaction.

Authentication flows

We summarize the authentication process into two flows:

Frictionless flow

The cardholder initiates the transaction, the transaction is authenticated by way of risk-based decisioning and no additional interaction is required from the cardholder such as an OTP.

The 3DS requester (merchant) sends an authentication message with the required information to formulate an AReq message to the 3DS server to initiate the authentication process.
The 3DS server creates the AReq message and sends it to the Directory Server (DS).
The DS adds risk score(s) and data needed to evaluate the risk of the transaction and sends it to the Access Control Server (ACS/Issuer).
The ACS/Issuer responds to DS with an ARes message indicating that no further interaction or information is required from the cardholder.
The DS sends the message to 3DS server which forwards it to the original requester (merchant) to initiate the business-as-usual authorization flow with the Issuer.

Challenge/Step-up authentication flow

The cardholder must perform additional steps such as entering an OTP to successfully authenticate the transaction. The challenge flow is the same as the frictionless flow except:

Once the ACS/Issuer responds with the ARes message, it indicates that further interaction is required with the cardholder.
This initiates the CReq and CRes messages between the 3DS requester (merchant) and the ACS/Issuer to complete the challenge.
The ACS sends a RReq message to the 3DS server through the DS, which responds with a RRes message to the 3DS requester (merchant) to complete the authentication.
The 3DS requester (merchant) then initiates the business-as-usual authorization flow with the Issuer to complete the authorization.

Updated 7 months ago