EMVCo has updated the EMV® 3-D Secure (EMV 3DS) Specifications to support more secure and convenient e-commerce authentication. In this post, EMVCo 3DS Working Group Chair Elint Chu answers key questions about EMV 3DS v2.3.1.1.
Q: Why is EMVCo updating the EMV 3DS Specifications?
The EMV 3DS Specifications deliver a common set of requirements that product providers can use to integrate EMV 3DS technology into their solutions to support seamless and secure e-commerce payments.
To address emerging payments industry opportunities and challenges, EMVCo engages extensively with Associates, Subscribers, industry partners and the wider payments ecosystem to evolve the specifications and supporting testing infrastructure.
Following the release of Version 2.3.1.0 in 2022, additional updates and improvements were identified to enhance implementations of the EMV 3DS Specifications. This includes improved support for Secure Payment Confirmation (SPC) and out-of-band (OOB) authentication features.
Q: How is EMVCo addressing these enhancements and improvements?
To incorporate these elements and other additional clarifications, EMVCo is publishing Version 2.3.1.1 of the EMV 3DS Specifications. The following documents, which include editorial updates to simplify and optimise implementation, have been published for Associate and Subscriber review and are expected to be finalised by the end of May 2023:
- EMV® 3-D Secure—Protocol and Core Functions Specification v2.3.1.1
- EMV® 3-D Secure—Default-SDK Specification v2.3.1.1
- EMV® Specification Bulletin No. 255 (SB 255)
- EMV® 3-D Secure—SDK – Device Information Data Version v1.6
As background, EMV® 3-D Secure—SDK – Device Information Data Version v1.6 specifies the format and representation of the data elements to be collected by the 3DS SDK, and includes updates to align with the latest APIs from operating system (OS) platform providers.
The EMV 3DS Bridging Message Extension, which was initially published in 2022 to enable current v2.1.0 and v2.2.0 products to utilise selected features introduced in v2.3.1.0, will also be updated to align with v2.3.1.1.
Separately, EMVCo is also making security enhancements to EMV 3DS v2.1.0 and v2.2.0. (SB 204 v7 and SB 214 v3).
Q: Will EMV 3DS v2.3.1.1 replace EMV 3DS v2.3.1.0?
Yes. To ensure full interoperability, EMV 3DS v2.3.1.1 is effective immediately and replaces EMV 3DS v2.3.1.0 in that EMV 3DS testing will only be available for EMV 3DS v2.3.1.1.
Q: What impact does this have on EMV 3DS testing?
As part of our ongoing work to facilitate and streamline testing and approval of EMV 3DS products to validate compliance with the EMV 3DS Specifications, the test plan is being updated to reflect the latest enhancements in EMV 3DS v2.3.1.1. EMVCo is coordinating with laboratories and test tool providers to support this transition.
Q: How will EMV 3DS v2.3.1.1 benefit the wider payments industry?
The latest enhancements will help to further promote seamless consumer authentication, prevent remote payments fraud and increase e-commerce security.
by Oliver Manahan