← Payment Reference GuidesAuthentication Reference

3D Secure / EMV 3DS

The cardholder authentication protocol for card-not-present transactions. 3DS2 adds frictionless, decoupled, and challenge flows while enabling SCA compliance under PSD2 and reducing CNP fraud liability.

Message Reference

EMV 3DS uses JSON messages over HTTPS. Key message types are AReq/ARes (authentication), CReq/CRes (challenge), and RReq/RRes (results).

AReq (Authentication Request) — Key Fields

Field	Type	Description
`messageType`	String	Always "AReq"
`messageVersion`	String	"2.1.0" or "2.2.0" — protocol version
`threeDSServerTransID`	UUID	Unique transaction identifier assigned by the 3DSS
`acctNumber`	String	Cardholder PAN (16-19 digits)
`acctExpiry`	String	Card expiry in YYYYMM format
`deviceChannel`	String	01=App, 02=Browser, 03=3RI (3DS Requestor Initiated / Decoupled)
`messageCategory`	String	01=Payment authentication, 02=Non-payment authentication
`mcc`	String	Merchant Category Code (4 digits)
`merchantCountryCode`	String	ISO 3166-1 numeric country code
`purchaseAmount`	String	Amount in minor currency units
`purchaseCurrency`	String	ISO 4217 numeric currency code
`notificationURL`	String	Merchant URL for receiving CRes and RReq callbacks
`browserInfo`	Object	Browser fingerprint: userAgent, acceptHeader, screenHeight/Width, colorDepth, timeZoneOffset, javaEnabled, language
`threeDSCompInd`	String	Y/N — indicates whether 3DS Method completed (device fingerprinting pre-step)

ARes (Authentication Response) — Key Fields

Field	Description
`transStatus`	Authentication outcome — see table below
`acsChallengeMandated`	Y/N — issuer requires challenge regardless of requestor preference
`acsTransID`	ACS-assigned transaction UUID — required for challenge messages
`authenticationValue`	CAVV (28-char base64) — present when transStatus=Y or A
`eci`	Electronic Commerce Indicator — see ECI table below
`transStatusReason`	Reason code when transStatus is N, U, or R (e.g., 01=card auth failed, 07=suspected fraud)

transStatus Values

Value	Meaning	Action
Y	Authentication verified	Proceed to authorization. Full liability shift to issuer. Include CAVV + ECI.
A	Proof of authentication attempt	Proceed to authorization. Partial liability shift. Include CAVV + ECI=06.
C	Challenge required	Initiate challenge flow. Wait for CRes/RReq before proceeding.
D	Decoupled authentication confirmed	Initiate decoupled flow. Wait for RReq (up to 1 hour).
N	Not authenticated / denied	Do not proceed to authorization. Transaction should be declined.
U	Authentication could not be performed	Proceed at merchant's discretion (no liability shift). Technical error in ACS.
R	Authentication rejected	Do not proceed. Issuer is rejecting the transaction outright (fraud suspicion).

ECI Values by Network

Network	ECI	Meaning
Visa	`05`	Fully authenticated (transStatus=Y)
	`06`	Authentication attempted (transStatus=A)
	`07`	No 3DS authentication
Mastercard	`02`	Fully authenticated (transStatus=Y)
	`01`	Authentication attempted (transStatus=A)
	`00`	No 3DS authentication
Amex	`05`	Fully authenticated
	`06`	Authentication attempted
	`07`	No authentication