What Online Merchants Need to Know about 3-D Secure 2.0
Ian Poole, Sales Engineering Director, CardinalCommerce
Thursday, February 16, 2017, 1:45 p.m.
What you can expect to learn from this session
Things Merchants Need to Consider
• Adaptability to changing marketplace
• Need to do homework on providers
• What you should be considering now
What is 3-D Secure?
• Authenticates digital transactions in real-time
• Holds private session between the cardholder
and issuer
History of 3-D Secure
• Launched in the early 2000s
• Authenticates cardholders with their issuing bank
• Traditional implementation challenged every transaction
• Results = checkout friction and cart abandonment
Known as Verified by Visa, Mastercard SecureCode,
American Express SafeKey, Discover ProtectBuy, and
other brands
History of 3-D Secure, PART 2
Fast forward to today …
• Moving to risk-based authentication
• Rules-based approach
- Gives merchants control
- Friction-free consumer experience
- 1.0.2 was built for PCs only
Specs for 3-D Secure 2.0 were released in October, 2016
Risk-Based Authentication – Issuer Roles
• Risk-based approach – issuers know a lot about their cardholders
• Use the additional data points for 2.0 to assess risk and to authenticate
• Minimal consumer checkout friction
Rules-Based Authentication – Merchant Roles
• Provide additional data fields, shared with the issuer, to make a better
risk-based decision
• Use rules to decide which transactions to authenticate based on
issuer’s approach
• Delivers better consumer
experience across all devices
Merchant Benefits of 3-D Secure
• Liability shift on fraudulent transactions
• Lower acquiring costs
• Increased authorization rates
• 3-D Secure 1.0 has been used for more than a decade
– Authentication methods
– Built for PCs
– Friction in the consumer experience
• EMVCo released specifications for 2.0 in October, 2016
– Flexible
– Data-driven approach
– More merchant data to allow better decisioning
– Device agnostic
– Non-payments transaction authentication
3-D Secure 2.0
• Issuers are making a risk assessment and authentication decision
• Merchants will have control over friction-less and challenge flows
• Merchants can run 3DS 2.0 on all devices and shopping channels
2.0 is a Data-Driven Solution – Here’s Why
• Passing data earlier gives merchants the ability to decide whether to
authenticate a transaction
• 1.0.2 and 2.0 will co-exist – need to have a solution that supports
both
• Data benefits both issuers and merchants – creates a symbiotic
relationship
2.0 is a Data-Driven Solution – Here’s Why Continued
What do Merchants Need to Do?
• The Majority of the Activity to Become 3DS 2.0-Ready is on the Issuer/Vendor Side
• What to Look for in a Vendor
–Support of both 1.0.2 and 2.0 versions of 3DS
–Experienced with rules management
–Provide an easy integration to collect additional data fields
–Performance and analytics – visibility into transaction results
What Does this Mean to Me?
• Specs need to be made into products
– Networks need to customize
– Vendors need to build
– Issuers need to integrate
• This is the starting line, not the finish line
• Lots of work needs to be done
Here are some things you may be thinking
• What’s the timeline for 2.0 to be market-ready?
• Should I wait until 2.0 is fully baked?
• What is the bottom line impact?
– Liability Shift
– Authorization Lift
– Can use 2.0 with more traffic - superior consumer experience
What can you do now to prepare? • If you are not running 3DS at all, start there
• Start passing additional data fields to your provider
• Look at where you are (and aren’t) running 3DS today
• There are things you can do today that will impact your bottom line
• Not just “online” orders for 3DS
Cardinal – Trusted Industry Advisor
• Involved since early 2000s
• Developed Cardinal Consumer Authentication to make 3DS more merchant-friendly
• Global footprint – in 198 countries and territories
• Business and Technical Associate of EMVCo
Key Takeaways
Things Merchants Need to Consider
• Adaptability to changing marketplace
• Need to do homework on providers
• What you should be considering now
Questions?
Disclaimer
This presentation contains general information only. The MAG and its guest speakers are not, by
means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Neither the MAG nor its guest speakers shall be responsible for any loss sustained by any person who relies on this presentation.