EMV Three Domain Secure (PCI 3DS) is an anti-fraud messaging protocol that allows consumers to authenticate with their payment card issuer at the time of a non-presential (CNP) transaction.
This additional security layer helps prevent unauthorized transactions in e-commerce environments while protecting the trade from fraud. de comercio electrónico y, al mismo tiempo, protege al comercio de fraude.
During this phase, topics on general concepts, key points for compliance are addressed and awareness within the organization is promoted.
Conducting interviews and reviewing the necessary documentation to establish and record the active processes and the suppliers involved that will determine the scope of PCI 3DS.
Free GAP Analysis for new clients, by collecting information, in order to analyze all existing security processes and determine the level of compliance of the organization
A QSA consultant conducts monthly visits for ongoing advice throughout the implementation process.
We retrieve information to determine the due compliance of the PCI 3DS. The evaluation is included in the final report ROC (Report on Compliance) and AOC (Attestation of Compliance).
Prepares the documentation of the PCI 3DS compliance status and the subsequent preparation of the ROC and AOC report.
It is called “Three Domains due to the interaction of three main actors:
At the time of the transaction, the card issuer asks the cardholder for additional authentication data from the CVV2, which may be:
The purpose of this check is to ensure that access to this additional data is only by the issuing bank, which is why the merchant or other intermediate entity should only receive the response to such validation.
This standard defines the logical and physical requirements, as well as the evaluation procedures for those entities that provide or execute the following functions, established in the EMV®3-D Secure Protocol and Core Functions Specification document:
• 3DS Server (3DSS): provides the functional interface between the environment from which the 3DS functionality is requested and the directory server (DS).
• 3DS Directory Server (DS): manages the list of card ranges for which authentication is available and coordinates communication between the 3DS server (3DSS) and the access control server (ACS) to determine which authentication is available for a particular card number and device type.
• 3DS Access Control Server (ACS): the ACS contains the authentication rules and is controlled by the issuer. It checks what type of authentication is available and authenticates the specific transaction.
Depending on the form of implementation, a 3D Secure environment can be part of a payment card data environment (Cardholder Data Environment-CDE) or be completely separate. If a 3DS environment contains card data, it may be subject to PCI DSS compliance.
Send us an email to info@botechfpi.com or fill out the following contact form.
