Implementing 3DS for Enhanced Payment Security

Three Domain Secure (3DS) is a protocol designed to reduce fraud and improve the online checkout experience. Let’s dive into the key aspects of implementing 3DS, focusing on device data collection and best practices.

Understanding 3DS

What is 3DS?

3DS stands for Three Domain Secure. It’s a protocol that enhances the security of card-not-present transactions, particularly for e-commerce and m-commerce payments.

The Three Domains

1. Acquiring Domain: The domain of the merchant acquiring the transaction.
2. Issuer Domain: The domain of the card issuer (bank).
3. Interoperability Domain: A shared domain facilitating communication between Acquiring and Issuer domains.

EMV 3-D Secure 2.0

EMV 3-D Secure 2.0 is the latest version of the 3DS protocol. It builds upon the original 3DS specification and offers improved security features and a better user experience.

Implementing 3DS: Device Data Collection

Device Data Collection is a crucial step in the 3DS process. It involves gathering information about the device being used for the transaction.

Step 2: Device Data Collection

The device data collection process typically includes:

1. Browser Information
2. Network Information
3. Device Information
4. Hologram Information (if available)

Recommendations for Device Data Collection

1. Immediate Start: Begin device data collection immediately after the customer enters their credit card number.

2. Precedence: Device data collection must complete before the enrollment check begins.

3. Browser Fields: Include values from the 11 browser-based fields in the request. These serve as a backup if device data collection fails.

4. Comprehensive Billing Data: Provide as much billing data as possible, adhering to regional mandates. This ensures the issuer’s risk assessment has comprehensive information.

5. ISO 3166-2 Format: Format billing data (state and country) according to ISO 3166-2 specifications for accurate validation.

6. Error Handling: Implement robust error handling to manage cases where device data collection fails.

7. User Experience: Minimize disruption to the user experience during the device data collection process.

8. Security: Ensure all collected data is handled securely and in compliance with relevant data protection regulations.