Online payments have revolutionized how we shop and do business.

But they have also opened the door to a new kind of crime. Annual worldwide eCommerce fraud is estimated to be at 48 Billion dollars this year.

One of the best defenses against it is 3D Secure 2.0.

Let's take a look at what it is, what its predecessor (and contemporary) 3D Secure is, and more. We also explain how it relates to Strong Customer Authentication.

What is 3D Secure?

3D Secure (3DS) is an authentication protocol used for online payments and mobile payments.

The earliest version of it appeared in 1999. It provided an advanced extra layer of security for cardholders and merchants.

'3D' refers to the 'three domains' involved in the authentication process. These three domains are the card issuer, the merchant, and the 3D Secure infrastructure:

  1. The card issuer is the financial institution that issues a debit or credit card to the customer, i.e., the ca`rdholder's bank
  2. The merchant is the business that will receive the payment
  3. The 3D Secure infrastructure is the layer of added security between customers and merchants through the card issuer.

3D Secure is implemented to prevent and reduce fraud. It does this primarily by placing additional authentication factors into the transaction process.

Is implementing 3D Secure mandatory?

The Financial Conduct Authority's Strong Customer Authentication (SCA) regulation requires the use of 3D Secure for all online transactions in the European Economic Area (EEA).

In other international regions, it is optional but highly encouraged.

How does the 3D Secure process appear to the customer?

When a cardholder enters their card details to confirm a payment, they might be redirected to an authentication page or portal.

This is where the issuing bank will ask the customer for additional verification with a static password.

Authentication pages are typically co-branded by the given card network. These are usually familiar and trusted brand names from the major card schemes, such as Visa Secure, American Express' SafeKey, and Mastercard's Identity Check.

After completing authentication, the customer will be redirected to the checkout page. The customer and merchant will see the authentication result.

What is 3D Secure 2.0?

3D Secure 2.0 is a security protocol for online transactions that provides higher level identity verification information than standard 3D Secure.

It is designed by some of the major card networks to address some of the shortcomings of the original version released in 2016.

It has a less disruptive authentication process, better user experience and a higher level of security than the original version for reduced risk.

Its mass adoption has taken place alongside the consumer shift to using mobile devices and online shopping.

How does 3D Secure 2.0's authentication protocol work?

1. Initial assessment

It performs high-risk based authentication on an access control server (ACS) - an advanced type of server that that can validate credentials and control access to resources.

Using 3D Secure 2.0, a cardholder's issuing bank can quickly assess a transaction's risk levels. It looks at a wealth of rich data, including merchant's contextual data, the cardholder's previous transactions, etc.

2. 1. Immediate authorization of authentication

If each authentication standard is met, the initial transaction process can be completed with no additional cardholder input.

2. 2. Additional customer authentication

If the protocol raises a red flag indicating a high risk rather than a normal transaction risk, an advanced layer of security is requested from the person trying to make the transaction.

At checkout they will be sent through a 'challenge flow'. This will be an iframe (an element within a html page) which uses the entire existing browser window or just part of it. Here, the customer is asked to provide additional information for authentication.

What are the differences between 3D Secure and 3D Secure 2.0?

1. Customer experience

与最初的 3D Secure 相比,2.0 版的部分目的是提供一个无痛的结账流程

它是通过将验证流程直接嵌入浏览器和移动结账流程而实现的,不需要任何页面重定向。而使用 3D Secure 验证支付则需要重定向。

2.无摩擦认证

3D Secure 2.0 支付比 3D Secure 支付提供更无摩擦的身份验证体验。

在支付领域,"无摩擦"是指支付过程简单、快捷、方便。

在这种情况下,身份验证请求可被视为一种摩擦,因为它会使交易复杂化并减慢交易速度。这有可能导致用户放弃在销售点(POS)进行在线银行卡支付。

3D Secure需要双因素验证措施,如静态密码和弹出窗口。而 3D Secure 2.0 则在相同的数字位置对交易进行验证,持卡人输入的信息更少(见下文 "验证方法")。

这种差异会对销售产生影响。根据 Visa 的数据,使用3D Secure 2.0协议可减少 70% 的弃卡率和 85% 的结账时间。

3.移动一体化

3D Secure 2.0 增加了移动SDK(软件开发工具包)组件。它允许商家建立应用内身份验证流程,避免浏览器重定向。

该功能使移动结账体验更快、更无缝。

4.不付款认证

与 3D Secure 不同,3D secure 2.0 不仅仅可用于验证在线购买和交易。它的非支付验证功能使发卡银行能够在持卡人没有进行网上购物的情况下对其进行验证。

例如,这可用于将借记卡或信用卡添加到移动钱包中。发卡银行通过无摩擦流程验证持卡人和设备信息,以防欺诈。

5.认证方法

3D 安全身份验证依靠手动输入密码或 PIN 码来验证客户身份

3D Secure 2.0 提供不同的客户身份验证方法,如生物识别身份验证(指纹或面部识别)、一次性密码或 PIN 码。

减少支持,降低成本

人们经常忘记密码。谷歌在 2019 年进行的一项研究发现,75% 的受访者表示对记录密码感到沮丧

其负面影响之一是,24% 的人选择了普通易记的密码,如 "密码"、abc123、111111 等。这显然不是有效的防欺诈措施。

另一个负面结果是需要客户支持或系统来帮助合法客户找回或重置密码。

3D Secure 和 3D Secure 2.0 可以协同工作

许多支付服务提供商都向客户提供这两种版本的 3D Secure 作为选项。

它们可以协同工作,提供更安全、更灵活的身份验证流程。

这取决于交易的风险程度和客户发卡银行的能力。

例如,身份验证过程可以从 3D Secure 2.0 开始,然后重定向到 3D Secure,通过标准密码或 PIN 输入进行额外身份验证。

Nuvei 的 3D Secure 2.0 解决方案

使用 Nuvei,您的业务将受到高性能欺诈检测和预防功能的保护。

我们的软件可让您在电子商务业务的客户身份验证(SCA)、安全性和转换率之间取得平衡。

您可以根据豁免、规则和个人风险评估,通过我们先进的验证流程自动引导任何支付流程。

我们提供与收单银行无关的解决方案,帮助您管理市场法律限制和 PSD2 SCA 法规所要求的 3D 安全 2.0 复杂性。

摘要

3D Secure 是一种用于验证在线支付的安全协议。自 1999 年以来,它一直通过增加验证因素来防止和减少支付欺诈。

其认证过程包括重定向到一个认证页面或门户网站,在那里发卡银行会要求进行额外的验证,如输入注册密码。

3D Secure 2.0是该协议的下一代版本。它解决了原始版本的一些缺陷,具有干扰性更小的验证过程、更好的用户体验和更高的安全级别。

3D Secure 和 3D Secure 2.0 的主要区别包括客户体验增强、无摩擦认证、移动设备集成、非支付认证、认证方法和成本降低。

两者都能使持卡人受益,甚至可以无缝协作。

更多见解

准备好在各地拓展业务了吗?

立即开始使用 Nuvei——适用于任何支付场景、覆盖全球的增长基础设施。一个智能系统,专为扩展而设计。