Business Overview

Out-of-band (OOB) authentication adds an extra layer of security to the authentication process by requiring the Cardholder to authenticate with their bank through a separate channel. The use of a different channel makes the authentication process more resistant to attacks such as man- in-the-middle attacks, where an attacker intercepts and modifies the communication between the Cardholder and the authentication server.

In the context of 3DS, OOB authentication can be used to verify the identity of the Cardholder during a transaction. For example, the Cardholder initiates a payment, and the Issuer decides that a challenge is needed to confirm the transaction. Instead of conducting the challenge in the Merchant environment (App or Browser), the Issuer instructs the Cardholder to use a separate authentication app to verify their identity using an OOB channel. In the authentication app, the Issuer can request to the Cardholder any preferred authentication process. Issuers typically use their banking website or mobile banking apps that they fully control and trust. Once the Cardholder has been authenticated using the OOB channel, the Issuer can notify the Merchant that the authentication was successful.

Overall, the use of OOB authentication in 3DS can help reduce the risk of fraud and improve the security of online transactions, providing greater protection for both Cardholders and Merchants.

OOB authentication is an effective authentication mechanism that involves two signals from two separate channels. This method is used to block fraudulent users who have access to only one of the channels. OOB authentication is known to be effective in preventing fraudulent attacks, especially in e-commerce. The key benefit of 3DS OOB authentication is that it gives the Issuer full control over the selection of Cardholder authentication methods, which include biometric authentication, tokens, and one-time password via SMS or email. OOB authentication is an ideal choice to protect Cardholders while enabling Issuers to customise services according to their preferences.

The 3DS Specification supports OOB authentication for both Browser- and App-based transactions by providing a specific user interface template, and automation of the transition from the Merchant app to the OOB App in the context of mobile devices. Another key benefit is the ability to leverage consistent authentication methods across 3DS and other channels, e.g., online banking.