3DSv2 makes a distinction between frictionless and challenge authentication flows. Frictionless authentication occurs when a card issuer opts not to require further input from the cardholder, based on their own risk analysis. A challenge requires the cardholder to provide more information or take extra action to verify their identity. This step provides extra protection for the cardholder, and additional assurance for merchants, but can increase the likelihood of abandonment.
It is possible to provide additional information about the transaction, the customer, and their relationship with the merchant, which an issuer may use as part of their risk analysis. In some cases, this may influence their decision whether to issue a challenge or not. There are some scenarios in which a challenge will always be required, according to card scheme rules or applicable legislation.
We support passing through supplementary data to the issuer for this purpose, as well as a merchant preference indicator for a challenge – it is possible to request that a challenge not be performed, or conversely, to request that one is, or to indicate that one is mandated by specific regional or market requirements. The final decision to challenge or not remains with the issuer.
This data is provided in the strongCustomerAuthentication element available in Cashier API and Hosted Cashier requests, detailed below. If applicable, a shipping address may also be provided – see Shipping address and order details.
All fields below are optional.
| strongCustomerAuthentication { | |
| transactionType | string Possible Values: GOODS_OR_SERVICES, CHECK_ACCEPTANCE, ACCOUNT_FUNDING, QUASI_CASH, PREPAID_ACTIVATION Detailed classification of the transaction; where not provided, we default to GOODS_OR_SERVICES You may need to override this to reflect your specific business model; if unsure, consult your Acquirer for advice on what to use |
| challengeRequested | string Possible Values: NO_PREFERENCE, NO_CHALLENGE_REQUESTED, CHALLENGE_REQUESTED, CHALLENGE_MANDATED Permits the merchant to request that a challenge not be performed, or alternatively, to indicate that one is preferred or necessary Pay360 may override this value for certain types of transaction in accordance with card scheme rules; see threeDSecure.challengeRequest which contains what was ultimately used |
| merchantRisk { | |
| deliveryEmail | string; valid email address For electronic delivery, the email address to which the merchandise was delivered |
| deliveryTimeframe | string Possible Values: ELECTRONIC, SAME_DAY, OVERNIGHT, TWO_OR_MORE_DAYS Time frame for merchandise delivery |
| giftCardPurchase { | |
| totalAmount | integer Total value of gift cards being purchased (major units, e.g. for GBP 12.99, use 12) |
| currency | string; ISO-4217 alpha-3 code, e.g. “GBP”, “USD” Currency code of cards being purchased |
| count | integer; up to 99 Total number of cards being purchased |
| } | |
| preorder | boolean Is this a pre-order of merchandise which will be available in the future? |
| preorderDate | string; date in YYYY-MM-DD format For pre-orders, the date at which merchandise is expected to be available |
| reorder | boolean Is the cardholder re-ordering merchandise previously purchased from this merchant? |
| shippingTo | string Possible Values: BILLING_ADDRESS, VERIFIED_ADDRESS, OTHER_ADDRESS, STORE, DIGITAL, TRAVEL_EVENT, OTHER Indicates the type of shipping address (or shipping method) for the merchandise |
| } | |
| accountInfo { | |
| accountOpened { | |
| period | string Possible Values: GUEST_CHECKOUT, THIS_TRANSACTION, LESS_THAN_30_DAYS, BETWEEN_30_AND_60_DAYS, MORE_THAN_60_DAYS Relative time period when the account was opened |
| date | string; date in YYYY-MM-DD format Date the account was opened |
| } | |
| accountLastChanged { | |
| period | string Possible Values: THIS_TRANSACTION, LESS_THAN_30_DAYS, BETWEEN_30_AND_60_DAYS, MORE_THAN_60_DAYS Relative time period when the account was last changed |
| date | string; date in YYYY-MM-DD format Date the account was last changed |
| } | |
| passwordLastChanged { | |
| period | string Possible Values: NO_CHANGE, THIS_TRANSACTION, LESS_THAN_30_DAYS, BETWEEN_30_AND_60_DAYS, MORE_THAN_60_DAYS Relative time period when the password was last changed |
| date | string; date in YYYY-MM-DD format Date the password was last changed |
| } | |
| paymentAccountRegistered { | |
| period | string Possible Values: GUEST_CHECKOUT, THIS_TRANSACTION, LESS_THAN_30_DAYS, BETWEEN_30_AND_60_DAYS, MORE_THAN_60_DAYS Relative time period for the payment account registration |
| date | string; date in YYYY-MM-DD format Date the payment account was registered |
| } | |
| shippingAddressFirstUsed { | |
| period | string Possible Values: THIS_TRANSACTION, LESS_THAN_30_DAYS, BETWEEN_30_AND_60_DAYS, MORE_THAN_60_DAYS Relative time period for the first use of the shipping address |
| date | string; date in YYYY-MM-DD format Date the shipping address was first used |
| } | |
| activity { | |
| purchasesInLastSixMonths | integer; max 9999 Number of purchases made with the account in the previous six months |
| addCardAttemptsInLast24Hours | integer; max 999 Number of attempts to add a payment card to the account in the previous 24 hours |
| transactionAttemptsInLast24Hours | integer; max 999 Number of transactions (successful and abandoned) for the account in the previous 24 hours |
| transactionAttemptsInLastYear | integer; max 999 Number of transactions (successful and abandoned) for the account in the previous year |
| } | |
| shippingNameSameAsAccountName | boolean Is the name on the account identical to the recipient name in the shipping address? |
| suspiciousActivity | boolean Has suspicious activity (including fraud) previously occurred on this account? |
| } | |
| authenticationInfo { | |
| method | string Possible Values: NONE, MERCHANT_CREDENTIAL, FEDERATED_CREDENTIAL, ISSUER_CREDENTIAL, THIRD_PARTY, FIDO_AUTHENTICATOR Method used to authenticate |
| time | string; date/time in YYYY-MM-DDTHH:MM:SS format (the seconds are not used) Date/time (in UTC) of authentication |
| } | |
| priorAuthenticationInfo { | |
| reference | string ACS transaction ID (returned in threeDSecure.acsTransactionId) for the previous authentication |
| method | string Possible Values: FRICTIONLESS_AUTH, CHALLENGE_AUTH, AVS, OTHER_ISSUER Method used in prior authentication |
| time | string; date/time in YYYY-MM-DDTHH:MM:SS format (the seconds are not used) Date/time (in UTC) of prior authentication |
| } | |
| } | |