Card brand changes: June 2023

All card brands – Sunset of 3DS 2.1

All card brands have confirmed the sunsetting of support for EMV 3DS 2.1 from September 2024.

After 24 September 2024, no transactions authenticated using EMV 3DS 2.1 can be processed.

In addition Mastercard previously announced a requirement to support additional EMV 3DS features from October 2022: 

• All ecommerce businesses must support and perform authentication app re-direction through the merchant app, the 3DS SDK and EMC 3DS v2.2 transactions if the cardholder authentication method is OOB (out of band). 

• 3RI payments are optional. However, they offer you the option to system-generate a payment transaction when the cardholder is not in session. These transactions are used for use cases where there is an initial purchase transaction while the cardholder is in session, called consumer-initiated transaction (CIT), followed by subsequent transactions that are 3RI MIT (Merchant-initiated Transaction). With 3RI payments, you can provide evidence, using the DS Transaction ID field, that SCA has been performed where the customer was involved and maintain your fraud liability protection for the full amount that has been authenticated.

What you need to do:

To avoid potential non-compliance penalties, you should contact your gateway support team to make sure they are correctly supporting EMV 3DS 2.2 in line with the above requirements and that they are aware of the recently announced sunset dates for EMV 3DS 2.1.

Mastercard have introduced a new check to monitor adoption of the latest version of EMV 3DS.

This check will monitor 3DS authentications to ensure that the transactions are being authenticated with the minimum required version of EMV 3DS or higher. 

Where the version used is lower than EMV 3DS 2.2, and the issuer supports 2.2 or higher, a transaction will be considered non-performing.

Mastercard have announced a comply-by date of 1 August 2023 with assessments beginning from 24 September 2023.

What you need to do: 

Contact your gateway support team to make sure transactions are being processed using the highest version of EMV 3DS to avoid potential non-compliance penalties.

Under PSD2, most ecommerce transactions require Strong Customer Authentication (SCA) unless an exemption or exclusion (like merchant-initiated transactions (MITs)) is applied. 

To satisfy these PSD2 SCA requirements, customers are required to use the EMV 3DS or any other SCA-compliant method to avoid issuer SCA soft declines. A SCA soft decline is a declined authorisation where the issuer requests SCA to make it successful. Whenever an issuer sends a SCA soft decline authorisation response, the transaction must be sent for authentication via EMV 3DS and the authorisation request must be resubmitted after successfully authenticating your customer.

 
Mastercard launched the PSD2 optimisation programme to monitor transactions to check if EMV 3DS 2.x was used after a SCA soft decline. Where a customer is identified as failing this check, under this programme, non-compliance penalties could apply.

What you need to do: 

Contact your gateway support team to make sure that when transactions are soft declined, the transaction is retried with EMV 3DS 2.x. 

Elavon are continuing to work with our customers to make the necessary changes to the way Merchant Initiated Transactions (MIT) are processed.

MITs with the Interim Transaction Identifier should not be used and instead the original transaction ID must be used. If this change is not implemented these transactions will be declined.  In addition, fines levied by Visa for non-compliance may be passed onto you.   
 
There are two options to obtain a valid Original Transaction Identifier (OTID) to replace the Interim transaction ID: 

• Request a cardholder initiated transaction (reauthenticate) and store OTID for future use.

• Use Transaction ID of any previous MIT within the same merchant-cardholder agreement.

What you need to do:

If you have not already spoken to your gateway provider about this change, you need to contact them immediately.  It is important that you know what the implementation plan is for your business, so that you do not end up with declined MITs and potential fines. 

To make sure cardholders are aware of the terms and conditions for agreements they are entering into; Visa have updated their core rules relating to disclosure requirements for recurring transactions, free trials and subscriptions.

The disclosure requirement include: 

• The length of any trial period, introductory offer or promotional period

• Confirmation of how the cardholder will be charged (where the cardholder does not cancel in advance)

• The amount and timing of any subsequent transactions

• Confirmation of how the cardholder can cancel the agreement and/or subsequent transactions

What you need to do:

You should make sure the required disclosure information is displayed as soon as the cardholder’s card details are requested, and then throughout the entire payment process for any recurring transactions, subscriptions or free trials.