Loading...
You can flag an exemption request in both the authentication and authorization messages, or you can choose to flag an exemption in only the authorization. Submitting the request in both ensures the best chance that the exemption will be applied, as the Issuer receives much more data about the transaction and the customer. For certain low-risk transactions, however, you may want to flag an exemption in just the authorization message to see if the Issuer will approve the exemption without the use of 3D Secure.
When a merchant requests an exemption (whether via authentication or directly in authorization) and it's successfully applied, they'll no longer be able to avail of a liability shift if a fraud-related chargeback occurs.
Exemptions optimize frictionless payments for customers and minimize the impact of SCA. With our EOS solution enabled, we perform real-time Transaction Risk Analysis (TRA) automatically and responds with an outcome on exemption eligibility. If the response indicates eligibility, we ensure that the exemption request is flagged appropriately in the authentication message to the customer’s card Issuer. For more information, see Exemption Optimization Service (EOS).
We recommend that merchants include exemption requests in both the authentication and authorization messages (where applicable) to maximize the chances that the exemption will be applied.
Merchants should first consult with their Acquirer before managing their own exemption messaging.
In the authentication message, exemptions can be flagged using the Challenge Request Indicator field. For Mastercard transactions the Message Extension fields are also used. For more information on how to submit exemption requests in both messages, see the API Reference for 3D Secure 2 Authentication and Authorization.
For Mastercard exemption requests, see our Message Extension article.
For certain low-risk transactions, you may want to flag an exemption in just the authorization message to see if the Issuer will approve the exemption without making the customer complete a challenge.
For more information on how to submit exemption requests in the authorization message, see the API Reference for 3D Secure 2 Authorization.
When applying for an exemption through the authentication request, the response indicates whether the Issuer accepted the exemption. If the exemption was accepted, you’ll receive the below response, depending on the card scheme.
| Exemption Name | ECI | Authentication Value | Transaction Status | Transaction Status Reason | Whitelist Status |
| Transaction Risk Analysis (TRA) | 07 or blank | Present | AUTHENTICATION_SUCCESSFUL or CHALLENGE_PREFERENCE_ ACKNOWLEDGED_INFORMATIONAL_ONLY | N/A | N/A |
| Trusted merchant | 05 | Present | AUTHENTICATION_SUCCESSFUL | N/A | N/A |
| Exemption Name | ECI | Authentication Value | Transaction Status | Transaction Status Reason | Whitelist Status |
| Transaction Risk Analysis (TRA) | 06 | Leading indicator is kN | For Message Version 2.2 CHALLENGE_PREFERENCE_ ACKNOWLEDGED_ INFORMATIONAL_ONLY For Message Version 2.1 AUTHENTICATION_FAILED* | For Message Version 2.2 N/A For Message Version 2.1 SCHEME_STATUS_REASON81* | N/A |
| Trusted merchant | 02 | Leading indicator is kA | AUTHENTICATION_SUCCESSFUL | N/A | WHITELISTED_BY_ CARDHOLDER |
| Secure corporate payments | 02 | Leading indicator is kA | AUTHENTICATION_SUCCESSFUL | N/A | N/A |
*Only applies to exemptions requested in message version 2.1.
If you receive one of the above responses to your exemption request, you can proceed to authorization and add the corresponding value to the Exempt Status Value field.
| Exemption Name | Exempt Status Value |
| Transaction Risk Analysis (TRA) | TRANSACTION_RISK_ANALYSIS |
| Trusted merchant | TRUSTED_MERCHANT |
| Secure corporate payments | SECURE_CORPORATE_PAYMENT |
When applying for an exemption in only the authorization request and the payment is authorized, the result code will be 00. If the exemption request is rejected, the result code will be 111, which is known as a “soft decline.” In this case, you can use our API to proceed with authentication and a second authorization attempt using the stored card information, most likely without the customer’s awareness of the first attempt.
Because retrying involves one authentication and two authorization messages, you might incur additional transaction fees. For more information, contact your account manager.