E2 Card-not-present: 3-D Secure and tokenization

Needs: Supporter

3-D Secure, ECI and CAVV, network tokens and their cryptograms, card-on-file, EMV QR.

This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.

Sign in

Create a free account

See plans

What this module covers

Track E · Chip and beyond

You will be able to

Explain the 3-D Secure flow, ECI and CAVV / AAV
Explain network tokens, token cryptograms and card-on-file
Know EMV QR

The lesson

Why it matters
The concept
In the real world
Common mistakes
What to test

In the module

The lesson, with diagrams, common mistakes and what to test
A worked example you can change: An e-commerce payment with 3-D Secure
Practice: 3 kinds of generated exercise, each with a step-by-step solution
A quiz of 8 questions

Key terms

3-D Secure (3DS): The protocol in which the issuer authenticates the cardholder during an online payment, through a frictionless check or a challenge.
Access control server (ACS): The issuer's 3-D Secure server that decides on frictionless approval or a challenge and authenticates the cardholder.
Card-not-present (CNP): A payment where the card is not read by a terminal: e-commerce, mail and telephone orders, in-app payments.
Card-on-file: A card stored by a merchant for later or recurring payments, with indicators showing who started each transaction.
CAVV (AAV, authentication value): The cryptographic proof from 3-D Secure that the issuer authenticated the cardholder, sent in the authorisation.
Directory server: The network's 3-D Secure server that routes authentication messages between merchants' 3DS servers and issuers' ACSs.
ECI (Electronic commerce indicator): Two digits saying how a CNP transaction was authenticated, from fully authenticated to not authenticated. Values differ by network.
EMV QR: QR code payment specifications: merchant-presented (the payer scans) and consumer-presented (the merchant scans).
Frictionless flow: A 3-D Secure authentication completed by the issuer's risk check alone, without asking the cardholder anything. A challenge flow asks for a one-time code or app approval.
Liability shift: The rule that moves fraud losses from the merchant to the issuer when the transaction was authenticated (3-D Secure) or done with chip.
Network token: A replacement PAN issued by the network for one merchant or device, so that the real PAN is not stored. It is mapped back by the network.
Token cryptogram: A one-time value sent with a network token that proves the token is used by its rightful requestor.

Tools for this module: EMV QR Code

Read the opening of the lesson →

The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.