Ai Editorial: 3-D Secure 2.0 – what to expect in 2019?

First Published on 14th January, 2019

Ai Editorial: The new version of 3D Secure is being counted upon for supporting additional payment channels - in-app, mobile, and digital wallet payment methods, stronger authentication possibilities for a better checkout experience, and enhanced security, writes Ai’s Ritesh Gupta  


A lot can happen in a fraction of a second when a shopper agrees to wrap up a digital transaction. In this context, the role of 3-D Secure 2.0 or EMV 3-D Secure in improving payments security and increasing authorizations is expectedly under the scrutiny. The purpose of the new protocol is to facilitate the data exchange between the merchant, cardholder and issuer.

The problem with 3D Secure (3DS) is that it has been compromised more than once in the past, and can be easily bypassed by fraudsters who develop fake, yet similar-looking pop-up windows used for 3DS authentication. But, as specialists point out, the new version is going to feature token-oriented and biometric validation, in place of static passwords. It introduces the risk-based authentication, which enables issuers to get additional data from both transaction context and merchant’s and cardholder’s risk profiles. Refined datasets for better verification features email, billing and shipping address, cardholder behaviour information, etc. By supplementing added data during transactions, it is being highlighted that risk-based verdicts will be possible on whether to authorize or not. The shopper experience would be improved upon with the eradication of the early sign-up procedure and taking out the need for cardholders to use static passwords.

Also, there is going to be support of non-browser-based “card not present” payments (so in both application and browser-based solutions, on mobile and other consumer connected devices).

From the industry’s perspective, 3-D Secure 2.0 will pave way for a real-time, protected, details-sharing channel that merchants can avail to send an unmatched number of transaction attributes that the issuer can use without looking for a static password. Overall, enhanced messaging with additional information for better decisions on authentication. Plus, other benefits include better datasets for risk-based authorization, and curbing illegitimate/ dubious transactions, even if a cardholder’s card number is stolen or cloned. Issuers gain from being back in control of their costs with this version. A bigger data set enables the issuer to step up the accuracy of their risk-based probe.

Impact on merchants

With this development, merchants need to garner and disclose high-quality, significant data (email id or device details) in order to process transactions where previously a card number, expiry date and CVC code were enough. The issuer will use such information, plus its own information about the cardholder and the merchant, to assess the transaction’s risk.

As explained recently by Ingenico ePayments in one of its blog posts, “…it’s important to see this as the foundation of using behavioural analysis to fight payment fraud. It’s part of a general sea change: for instance, the European Banking Authority (EBA) shared its opinion in June (last year) that CVV numbers cannot be a second authentication factor in the “knowledge” category (visible on the card), eventually passing to the “possession” category. Guidance from the EBA and EU central banks is needed on what SCA methods are RTS-compliant. Eventually we may see the payment page changing drastically.” It added, “For merchants, the response has varied country by country, but the more data they share, the better their authorization rate will be (up to 10% according to the card network). What’s more, if merchants do share data, and issuer authorization rates are still low, then card schemes will have the power to impose fines, which puts pressure on issuers to step up. They have an obligation to get results.”

For its part, Mastercard has set up a framework called Mastercard Identity Check. The program offers merchants and their banks a way to upgrade and enhance current security solutions to assess possible risks and authenticate legitimate transactions in a seamless way. The company shared that by relying on Identity Check’s AI and machine learning, EMV 3D-Secure can now take into account over 150 different variables of a transaction to help the issuer make a more accurate, insight-based decision whether to approve a transaction or decline it. These variables include such factors as screen brightness, device owner gestures and, shopping purchase history. They are used alongside insights from the merchant and issuer to authenticate a payment.

Future implementations

Major developments are in store, starting in April this year.

As shared by  CardinalCommerce, for Visa, April is going to mark as the initiation period for EMV 3-D Secure in Europe. In the same month, American Express is expected to recommend issuers to shun using static authentication ways while concurrently pushing issuers who are leveraging the EMV 3-D Secure to use risk-based authentication. Also, Mastercard is working on putting in place specific measures related to PSD2 and EMV 3-D Secure.

There have been issues, too, that have been raised. It is being asserted that the new version is privacy invasive  for the shopper. The merchant in all probability would need to handle data with precision (in order to adhere to privacy regulations) and the impact on the issuer, too, has been under the scrutiny. Also, counting on 3-D Secure 2.0 or EMV 3-D Secure is just one piece of the fraud prevention puzzle for merchants. It is being recommended that merchants should be seeking a fraud solution that is able to act as a filter for fraud, rather than only relying on 3DS. A multi-disciplinary approach, that combines machine learning and other techniques to make sense of the score automatically, is required to fully automate the fraud screening process.


Check upcoming Ai Conferences dates or

Follow Ai on Twitter: @Ai_Connects_Us