The Issuer/ACS offers the Cardholder the option to add their preferred or trusted Merchant to their trust list during a 3DS challenge when in direct communication with the Cardholder. The Issuer controls the selection of merchants proposed in the Trust List (for example, only offering the Trust List service for low-risk merchants). The Issuer will consider the risk associated with the merchant type and market, as well as the Cardholder’s transaction history.
The 3DS Trust List feature may be used for the trusted beneficiary exemption in countries in scope of the Revised Payment Services Directive (PSD2).
The 3DS Specification does not prevent issuers from providing alternative channels to cardholders to manage the trusted beneficiaries list (for example, e-banking).
An alternative use case is the Trust List managed by the DS as described in Alternative Use Case – Trust List Managed by the DS.
The ACS has a Trust List Management System and can display the Trust List prompt/screen to the Cardholder during a 3DS challenge.
Optional: The ACS indicates support of the Trust List in the Card Range Data (ACS Information Indicator – 04 = Trust List Supported).
Note: The ACS uses some or all of the merchant information (Merchant Name, 3DS Requestor Name, 3DS Requestor ID) to manage the Trust List. Therefore, it is essential that the Merchant and/or the 3DS Server provide consistent merchant information across the Trust List enrolment and subsequent transactions.
The Cardholder enrols a Merchant on their Trust List that is managed by the Issuer/ACS.
In a subsequent transaction with the same Cardholder and Merchant:
Table 2.1: 3DS Data Elements Related to the Trust List
Data Element | Description | Version |
---|---|---|
3DS Requestor Challenge Indicator | Indicates whether a challenge is requested for this transaction. | 2.3.1 2.2 |
3RI Indicator | Indicates the type of 3RI request. This data element provides additional information to the ACS to determine the best approach for handling a 3RI request. A value of 10 indicates a Trust List Status check. | 2.3.1 2.2 |
ACS Information Indicator | Provides additional information for a particular Protocol Version to the 3DS Server. The element lists all applicable values for the card range. | 2.3.1 2.2 |
Card Range Data | Card range data from the DS indicating the most recent Protocol Versions supported by the ACS, and, optionally, the DS that hosts that range, and, if configured, the ACS URL for the 3DS Method. Additionally, it identifies the 3DS features supported by the ACS in the ACS Information Indicator, such as Trust List or Decoupled Authentication. Trust List indicators are defined in the ACS Information Indicator:
| 2.3.1 2.2 |
Toggle Position Indicator | Indicates if the Trust List and/or Device Binding prompt should be presented below or above the action buttons. | 2.3.1 |
Transaction Challenge Exemption | Exemption applied by the ACS to authenticate the transaction without requesting a challenge. | 2.3.1 2.2 + Bridging Message Extension |
Trust List Data Entry | Indicator provided by the 3DS SDK to the ACS to confirm whether the Cardholder gives consent to the Trust List. | 2.3.1 2.2 |
Trust List Information Text | Text provided by the ACS to the Cardholder during a Trust List transaction. | 2.3.1 2.2 |
Trust List Status | Enables the communication of Trust List Status between the ACS, the DS and the 3DS Requestor. | 2.3.1 2.2 |
Trust List Status Source | This data element will be populated by the system setting Trust List Status. | 2.3.1 2.2 |
Note: The term “Trust List” is used in version 2.3.1 of the 3DS Specification, replacing the terms “Whitelist” and “Whitelisting” used in version 2.2.
Note: Checkbox, radio button or any relevant user interface may be used to offer the Trust List and Device Binding options.
The DS has a Trust List Management System and an agreement with the ACS to manage the Trust List on its behalf.
The ACS is able to display the Trust List prompt/screen to the Cardholder during the 3DS challenge.
Optional: The ACS or DS indicates support of the Trust List in the Card Range Data (ACS Information Indicator – 04 = Trust List Supported)
The Cardholder enrols a Merchant on their Trust List that is managed by the DS.
In a subsequent transaction with the same Cardholder and Merchant:
In this White Paper, Device Binding is understood to denote the process to link the Consumer Device used for a transaction to the Cardholder Account.
Device Binding may be managed by any 3DS component.
The ACS, the DS or the 3DS Server may be the source of the Device Binding Status information.
The ACS offers the Cardholder the option to link the device used for the transaction to the Cardholder Account Number during a 3DS challenge. The Device Binding Status provides to the ACS additional information that could be used for transaction risk assessment.
The 3DS Specification does not prevent issuers from providing alternative channels to cardholders to manage the Device Binding information (for example, e-banking).
The 3DS Specification does not define how the ACS identifies the Consumer Device.
The ACS has a Device Binding management system and is able to display the Device Binding prompt/screen to the Cardholder during the 3DS challenge.
The ACS is able to identify the Consumer Device.
Note: How the ACS identifies the Consumer Device is outside the scope of the 3DS Specification
The Cardholder accepts the Device Binding option that is managed by the ACS.
In a subsequent transaction with the same Cardholder and Merchant:
Table 2.2: 3DS Data Elements Related to Device Binding
Data Element | Description | Version |
---|---|---|
3DS Requestor Challenge Indicator | Indicates whether a challenge is requested for this transaction. | 2.3.1 |
3RI Indicator | Indicates the type of 3RI request. This data element provides additional information to the ACS to determine the best approach for handling a 3RI request. A value of 10 indicates a Trust List Status check. | 2.3.1 |
ACS Information Indicator | Provides additional information for a particular Protocol Version to the 3DS Server. The element lists all applicable values for the card range. | 2.3.1 |
Card Range Data | Card range data from the DS indicating the most recent Protocol Versions supported by the ACS, and, optionally, the DS that hosts that range, and, if configured, the ACS URL for the 3DS Method. Additionally, it identifies the 3DS features supported by the ACS, such as Trust List or Decoupled Authentication. The Device Binding indicator is defined in the ACS Information Indicator:
| 2.3.1 |
Device Binding Data Entry | Indicator provided by the 3DS SDK to the ACS to confirm whether the Cardholder gives consent to bind the device. | 2.3.1 |
Device Binding Information Text | Text provided by the ACS to the Cardholder during the Device Binding process. | 2.3.1 |
Device Binding Status | Enables the communication of Device Binding Status between the ACS, the DS and the 3DS Requestor. For bound devices (value = 11–14), Device Binding Status also conveys the type of binding that was performed. | 2.3.1 |
Device Binding Status Source | This data element will be populated by the system setting Device Binding Status. | 2.3.1 |
Toggle Position Indicator | Indicates if the Trust List and/or Device Binding prompt should be presented below or above the action buttons. | 2.3.1 |
Note: Checkbox, radio button or any relevant user interface may be used to offer the Trust List and Device Binding options.
The 3DS Server (and/or 3DS Requestor) has a Device Binding management system.
The 3DS Server (and/or 3DS Requestor) is able to identify the Device used by the Cardholder.
The Cardholder accepts the Device Binding option that is managed by the 3DS Server/3DS Requestor.
The DS has a Device Binding management system, and is able to identify the Consumer Device.
Note: How the DS identifies the Consumer Device is outside the scope of the 3DS Specification.
The DS and ACS have an agreement for the management of the Device Binding information.
The ACS is able to display the Device Binding prompt/screen to the Cardholder during the 3DS challenge.
The Cardholder accepts the Device Binding option that is managed by the DS.
In a subsequent transaction with the same Cardholder and Merchant:
Last Updated: April 17, 2020
Welcome to EMVCo. By accessing or using the EMVCo website at www.emvco.com (“Site“) or any Site Materials, whether or not you obtained them via the Site, you agree to the following Terms of Use on behalf of yourself individually and the company or organization for which you are using the Site or Site Materials (“Organization“). If you do not agree to the following Terms of Use, do not use the Site or other Site Materials.
In these Terms of Use, “Site Materials” means all email messages sent to you by EMVCo in connection with your registration on the Site or participation in an EMVCo participation program, and all content, files and other materials that are available for viewing or download on the Site, including the EMV® Specifications, requirements, guidelines, white papers or other documents, APIs, SDKs, software, scripts, code, trademarks, videos, text, graphics, pictures, information, and other materials.
You represent that either (a) you are an authorized representative of your Organization with authority to bind your Organization to these Terms of Use, in which case the term “you” refers collectively to both you individually and your Organization, or (b) you are not authorized to bind any Organization to these Terms of Use and are using the Site or Site Materials solely in your personal capacity, in which case the term “you” refers to you individually. EMVCo, LLC (“EMVCo“) reserves the right to modify or replace these Terms of Use at any time and in EMVCo’s sole discretion.
EMVCo will indicate at the top of these Terms of Use the date such document was last updated. Any changes will be effective immediately upon posting the revised version on the Site (or such later effective date as may be indicated at the top of the revised Terms of Use). Your continued use of the Site or Site Materials following the posting of any changes to these Terms of Use will constitute your acceptance of such changes. If you do not agree to the changes, you must stop using the Site and Site Materials. In addition, EMVCo may provide other methods by which you may accept or receive notice of these Terms of Use or changes to these Terms of Use.
In these Terms of Use, “EMV Products” means products or services that are designed to comply with the EMV Specifications. The foregoing license applies retroactively to include activities prior to the date you agreed to these Terms of Use, but is granted solely under the intellectual property rights that EMVCo owns or has the right to license. To the extent the foregoing license includes rights to a third party’s patents, the license is limited to those patents or patent claims that would be necessarily infringed by an entity implementing the mandatory or optional requirements of the EMV Specifications.
And after the cover page of each copy of a translation, the following (or a substantially similar notice) must be printed:
Notwithstanding the foregoing, the Public Documents may be subject to a separate agreement you may have with EMVCo or to supplemental terms and conditions that are included in or accompany Public Documents, in which case you agree that such separate agreement or supplemental terms and conditions will apply to your use of the Public Documents. Any use of the Site or Site Materials other than as specifically authorized herein (or in such separate agreement or supplemental terms and conditions) is strictly prohibited and will automatically terminate the foregoing license without notice.
EMVCo's new website and Participant Dashboard are now live. To access your account for the first time on our new website you'll need to carry out a password reset here. You will then be sent an email to reset your password.
EMVCo Associates, Subscribers and public users of emvco.com can create accounts to manage their engagement and participation with EMVCo. Using your EMVCo account, you can create your own watchlist of EMV technologies documents, monitor queries and responses, and manage your profile.