COPYandPAY

For users of COPYandPAY, minimal additional effort is required compared to the current integration. The workflow is identical to the current 3D Secure 1.0 implementation. The widget will handle the entire additional communication and will be responsible for collecting required browser based information automatically. Following data must be collected by the merchant and send in via

• Server/Server, create checkoutId
• being collected by adding additional input fields to the payment widget (see here)

Server to Server

For users who are integrating via server to server will need to follow EMVCo's guidelines on the frontend integration. Please follow the steps described below:

1. Prepare your front-end and follow EMVCo's recommendation (see Section 4 "EMV 3-D Secure User Interface Templates, Requirements, and Guidelines" here) on how the authentication window should be shown in the webshop (eg. in and iframe or in a lightbox).
2. Prepare your back-end and send following additional information along with the payment information:

Server to Server Examples

authentication.entityId=8ac7a49f6e4a18ae016e4b8b4c4b2146
amount=12.00
currency=EUR
paymentBrand=VISA
paymentType=PA
merchantTransactionId=order99234
transactionCategory=EC
card.number=4000000000000010
card.expiryMonth=12
card.expiryYear=2025
card.cvv=123
card.holder=John Smith
merchant.name=MerchantCo
merchant.city=Munich
merchant.country=DE
merchant.mcc=5399
shopperResultUrl=https://merchant.org
customer.ip=192.168.0.1
customer.browser.acceptHeader=text/html
customer.browser.screenColorDepth=48
customer.browser.javaEnabled=false
customer.browser.language=de
customer.browser.screenHeight=1200
customer.browser.screenWidth=1600
customer.browser.timezone=60
customer.browser.challengeWindow=4
customer.browser.userAgent=Mozilla/4.0 (MSIE 6.0; Windows NT 5.0)
testMode=EXTERNAL

{
    "id": "8ac7a4a0686138d701687eebfbc74747",
    "paymentType": "DB",
    "paymentBrand": "VISA",
    "result": {
        "code": "000.200.000",
        "description": "transaction pending"
    },
    "resultDetails": {
        "clearingInstituteName": "CI_Test"
    },
    "card": {
        "bin": "411111",
        "last4Digits": "1111",
        "holder": "Jane Jones",
        "expiryMonth": "05",
        "expiryYear": "2020"
    },
    "redirect": {
        "url": "https://test.oppwa.com/v1/threeDSecure/execute",
        "parameters": [{
            "name": "name",
            "value": "value"
        }],
        "preconditions": [{
            "origin": "iframe#hidden",
            "waitUntil": "iframe#onload",
            "description": "Hidden iframe post for 3D Secure 2.0",
            "method": "POST",
            "url": "methodURL",
            "parameters": [{
                "name": "threeDSMethodData",
                "value": "methodData"
            }]
        }]
    },
    "risk": {
        "score": "100"
    },
    "buildNumber": "deebd8c9af7d84ddee98c38b7f4afcc814012b5b@2019-01-22 13:58:00 +0000",
    "timestamp": "2019-01-24 08:13:41+0000",
    "ndc": "8a8294174b7ecb28014b9699220015ca_0557df43f75643d19479440642979e00"
}

{
  "id":"8ac7a49f6e4a18ae016e4b8b4c4b2146",
  "paymentType":"PA",
  "paymentBrand":"VISA",
  "amount":"12.00",
  "currency":"EUR",
  "result":{
    "code":"000.100.112",
    "description":"Request successfully processed in 'Merchant in Connector Test Mode'"
  },
  "resultDetails":{
    "ExtendedDescription":"Approved",
    "AcquirerResponse":"00",
  },
  "card":{
    "bin":"400000",
    "last4Digits":"0044",
    "expiryMonth":"12",
    "expiryYear":"2025"
  },
  "threeDSecure":{
    "eci":"05",
    "verificationId":"MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=",
    "version":"2.1.0",
    "dsTransactionId":"91caca63-5c4e-4aa2-a3f1-b4d418972de8",
    "acsTransactionId":"7055d78e-eb35-46e7-8c4e-56e15092b5f5",
  },
  "buildNumber":"7810ceecdd913cd9c4807becb99b89ce68454900@2019-11-08 12:20:52 +0000",
  "timestamp":"2019-11-08 15:05:42+0000",
  "ndc":"8ac7a4c76dd857ea016dda2ea6970684_3ba4c7691f854354906b2f6c402840e7"
}

How to handle the responses

1. Open a hidden iframe and post data to the methodURL

   <form name='' action='preconditions.url' method='POST'>
   	<INPUT type='hidden' name='preconditions.parameters[].name' value='preconditions.parameters[].value'>
   </form>
   <script>
   	window.onload = submitForm;
   	function submitForm() { downloadForm.submit(); }
   </script>

2. Redirect the shopper within and iframe to the redirect URL if onLoad event received from 1.

   <form name='' action='redirect.URL' method='POST'>
   	<INPUT type='hidden' name='redirect.parameters[].name' value='redirect.parameters[].value'>
   </form>
   <script>
   	window.onload = submitForm;
   	function submitForm() { downloadForm.submit(); }
   </script>

Fields required for 3D Secure 2

Please note that in order to have a better rate of successful risk-checks during the risk based authentication, it is recommended to send as many fields as possible. This will positively affect the number of frictionless flows.

Source is the cardholder or cardholder's environment

Merchant related fields configured in the gateway

Authentication amount and currency

In some cases the amount and/or currency that is used in the authentication can be different from the one that will be used in the payment later. For example the payment amount might not be known at the time of the authentication, or the merchant would like to authenticate the shopper for the full amount when the payment will be done in multiple installments.

If the authentication amount and the payment amount are different, then the authentication amount and currency can be sent in a separate field:

Please note that payment amount and currency are still mandatory fields for any payment request. If there are no authentication amount and currency defined then the shopper will be authenticated with the payment amount and currency.

Optional settings

Merchants have the possibility to set the preference of a transaction being challenged or not. This really is only a preference, and won't guarantee that the issuer will or will not request a challenge from the cardholder. It is up to the issuer if they consider the merchant's preference, and if they include it when they assess the risk of the transaction.

For example when a card is being stored for later use (eg. for One click checkout), a challenge may be requested by the merchant. In another example, there might be some regional mandates that certain transactions have to be challenged and the merchant should ask for a mandated challenge.

Send the field threeDSecure.challengeIndicator with one of the following values:

The field threeDSecure.challengeIndicator is optional. If not sent, the value "01 - No preference" applies by default.

Information about the cardholder's account and history with the merchant

The following fields are not mandatory, but it is strongly recommended to send them. They are affecting the accuracy of the issuer's risk check, and will result in more frictionless flows.

The field values below can be collected by the 3D Secure Requestor* about the cardholders activity on their webshop.

*3D Secure Requestor denotes the merchant