Loading...
In this article, we discuss how merchants can use our 3D Secure 2 Exemption Optimization and accompanying solutions to solve for both compliant transactions and a seamless customer experience. Exemptions are part of the European strong customer authentication (SCA) regulations set in PSD2. The idea is to allow for an easier payment experience with less friction for the customer under certain conditions. This includes transactions where the value of the payment is low or where robust risk analysis is performed.
Exemptions might be applied by the issuer based on the transaction details or might be specifically requested by the merchant, with their acquirer’s permission. 3D Secure 2, the authentication protocol used by card brands such as Visa and Mastercard, provides a framework for merchants to benefit from SCA exemptions.
You can flag an exemption request during both the 3D Secure 2 authentication and the payment authorization. Or, you can choose to flag an exemption during the payment authorization step only. Submitting the request during both steps ensures the best chance that the exemption will be applied, as the issuer receives much more data about the transaction and the customer. For certain low-risk transactions, however, you may want to flag an exemption in just the authorization message to see if the issuer will approve the exemption without the use of 3D Secure 2.
When a merchant requests an exemption (whether via authentication or directly in authorization) and it's successfully applied, they'll no longer be able to avail of a liability shift if a fraud-related chargeback occurs.
The following table provides the available exemptions and indicates whether they are applicable to be flagged during 3D Secure 2 authentication, authorization, or both.
| Exemption | Description | Authentication | Authorization |
|---|---|---|---|
| Transaction Risk Analysis | Allows for transactions to be exempted from SCA if a robust risk analysis is performed. Whether it can be applied also depends on fraud thresholds pertaining to your acquirer. | Y | Y |
| Low-Value Transactions | Transactions up to 30 EUR (or converted equivalent) can be exempted from SCA, dependent on the following criteria:
| N | Y |
| Trusted Beneficiary | Customers can add a merchant to a list of “trusted beneficiaries” held by the issuer. Subsequent payments to trusted merchants can then be exempted from SCA. | Y | Y |
| Secure Corporate Payments | Transactions that meet the following criteria:
| N | Y |
The following table provides the values in the response for exemptions that are available to request in the authentication message. The response indicates if the issuer accepted the exemption request or not.
| Card Type | ECI | Authentication Value | Authentication Status | Authentication Status Reason |
|---|---|---|---|---|
| Visa | 07 or Blank | Present | AUTHENTICATION_SUCCESSFUL | N/A |
| Mastercard | 06 | Leading indicator is kN (optional) | 3D Secure 2.2: AUTHENTICATION_SUCCESSFUL 3D Secure 2.1: AUTHENTICATION_FAILED | 3D Secure 2.2: SCHEME_STATUS_REASON81 3D Secure 2.1: SCHEME_STATUS_REASON81 |
If ECI == 06, and there is a present Authentication value, the transaction can be treated as successfully authenticated. The presence or absence of kN does not impact the success outcome. If the ECI is not present or is not the expected value, the transaction cannot be treated as successfully authenticated, regardless of Authentication Value.
| 3DS Version | Authentication Status | Authentication Status Reason |
|---|---|---|
| 3DS 2.2 | CHALLENGE_PREFERENCE_ACKNOWLEDGED_INFORMATIONAL_ONLY | N/A |
Under the updated scheme logic for 3DS 2.2, if the expected values are present (e.g. ECI + Authentication Value), transactions may proceed with exemptions applied — regardless of card scheme.
Check out the following guides to learn more about our exemption solutions.