Overview

3DS is a powerful fraud protection tool that provides a merchant with the ability to authenticate if a person is allowed to use a card. In certain cases, authentication also provides a shift in liability for certain types of chargebacks. TabaPay offers 3DS via our 3DS partner Cardinal Commerce.

3DS integration can be broken up into two broad categories:

1. Frontend integration -> Integrating with the Cardinal Commerce 3DS SDKs.
2. Backend integration -> Integrating with the TabaPay 3DS APIs.

The frontend integration can be further divided into two additional categories:

1. Frontend integration:
   1. Mobile SDK integration (iOS and Android SDKs)
   2. Browser flow integration (Songbird.js)

📘

What's a browser?

Browser:

"A Browser is a dedicated software application for accessing information on the World Wide Web, for example Chrome, Safari, Edge, Firefox. When a user requests a web page from a particular website, the Browser retrieves the necessary content from a web server and then displays the page on the consumer’s screen. In the context of 3-D Secure, the Browser is a conduit to transport messages between the Acquirer Domain and the Issuer Domain. A Browser is distinguished from a UI component for example, a WebView, or Custom Tabs, which can be used to display content within an App on a mobile device. The Browser flow is invoked by a Browser whereas the EMVCo specification does not support a UI component within an app invoking the Browser flow."

-EMV® 3-D Secure Protocol and Core Functions Specification v2.3.1.0

2. Backend integration:
   1. There are three primary APIs for 3DS authentication:
      1. 3D Secure Initialize
      2. 3D Secure Lookup
      3. 3D Secure Authenticate

3. Additional APIs and tools:
   1. The 3DS APIs only perform customer authentication, you will need a few additional APIs and tools to complete your flow:
      1. Transmitting Card data - if you are not PCI compliant, you can use the TabaPay PCI helpers:
         1. PCI Helper - RSA for mobile applications
         2. PCI-Compliant iFrame for websites
      2. Card storing and passing card info the the 3DS APIs - you can store card data with TabaPay using our TabaPay Tokens. Once you store the card data, you will be able to use these TabaPay Tokens to call the 3DS APIs.
         1. Create Account - To store card data, you will need the resulting accountID to send card data to the 3DS APIs and the Create Transaction API.
      3. Authorization Request - 3DS is purely an authentication tool. It does not, on its own perform any authorizations. It is up to the merchant to analyze the results of the authentication, and perform any additional fraud prevention checks/analysis before moving forward with authorization. Once the merchant is confident of the transaction, and ready to request that funds be moved, then they must use the Create Transaction API.
         1. To attach the results of the authentication to a transaction, you will need to use the pullOptions.3DSecure object.

Implementation Guides:

TabaPay offers two implementation guides:

1. 3DS Browser flow implementation: Includes information about both the frontend and backend integrations.
2. 3DS Mobile SDK implementation: Includes information about both the frontend and backend integrations.

Important information

🚧

Please read the following information about required data before beginning your integration.

3DS authenticates whether a person is allowed to use a card. As such, 3DS needs the following information about the cardholder as part of its authentication process.

1. Card number [Required]
2. Expiration date [Required]
3. Address [Required]
   1. Line 1 - Required unless market or regional mandate restricts sending this information.
   2. Line 2 - Conditional - Required if information is available, unless market or regional mandate restricts sending this information.
   3. City - Required unless market or regional mandate restricts sending this information.
   4. State - Conditional - Required if information is applicable and BillingCountryCode is present, unless market or regional mandate restricts sending this information.
   5. Country code - Required unless market or regional mandate restricts sending this information.
4. Phone [Required]
5. First name [Required] - Has to be added to the AccountID. Has to be Personal Name, NOT Company Name (e.g. "Stacy", "Neal").
6. Last name [Required] - Has to be added to the AccountID. Has to be Personal Name, NOT Company Name (e.g. "Wayne", "Wang").
7. Email address [Required] - This is provided in the 3D Secure Lookup call.

Recommendations

1. In the 3DS APIs OrderID is a unique identifier generated by the merchant. We recommend using the same value as your CreateTransaction ReferenceID. This is not required, but it makes it easier for the support team to find the lookup request associated with your transaction.

Additional information

📘

For more information:

3DS FAQs: https://developers.tabapay.com/reference/3ds-faq