Message Extension

In the 3D Secure 2 protocol, the Message Extension fields allow for more customized and card-specific information to be passed in both the request and response messages. This article focuses on what Mastercard uses the Message Extension fields for, including:

• Strong Customer Authentication (SCA) exemptions and allowlisting
• Merchant fraud rate
• Acquirer country code
• Secure corporate payments

To get the most out of this article, we recommend you first read our Browser Authentication for 3D Secure article.

One of the key advantages of 3D Secure 2 is that it provides a framework for merchants to benefit from exemptions from SCA under certain conditions. With 3D Secure version 2.2, merchants can flag specific exemptions using the Challenge Request Indicator field.

For 3D Secure version 2.1, for Mastercard authentications, the specific exemption the merchant is requesting must be included in the Message Extension fields during the Initiate Authentication step.

Sample request (specific fields)

In the Initiate request, include the following fields.

Sample response (specific fields)

If the request for an exemption is successful, the response of the authentication request will contain the following values. The authentication value will start with kN.

3D Secure 2 allows customers to add certain merchants to an allowlist of trusted beneficiaries—effectively telling the Issuer that transactions with particular merchants should be trusted. If this occurs, the Issuer may return information in the authentication response regarding the allowlist status of the merchant.

In version 2.1, Mastercard does not support allowlisting merchants as trusted beneficiaries. However, Mastercard is able to share the allowlist status of a merchant through message extension.

Sample response (specific values) (version 2.1)

Mastercard allows the merchant fraud rate to be shared with the Issuer as part of the Authentication Request message using a specific Message Extension field. Sharing the merchant fraud rate can increase the Issuer's level of confidence in the transaction. Issuers can also use it to decide if a merchant should be eligible for the allowlist exemption.

Sample request (specific fields)

In the Initiate request, include the following fields.

Merchants can use this extension to inform the Issuer if the Acquirer country and merchant country differ. This is particularly important for transaction processing in countries where regulations may apply based on the Acquirer country.

If a transaction is "two-leg"—that is, the country code of both the Acquirer and Issuer is in the European Economic Area (EEA)—then it is in scope of SCA. It is therefore important to share the Acquirer country code; otherwise, an Issuer could incorrectly flag a transaction as a "one-leg" transaction, which would be out of scope of SCA.

Sample request (specific fields)

In the authentication request, include the following fields.