For version 2.3.1 of the 3DS Specification, it is possible to automate the switching from the 3DS Requestor App to the OOB Authentication App. This flow is also possible with version 2.2 of the 3DS Specification if the Bridging Message Extension with the Challenge Data object is present and supported by the ACS and the 3DS SDK.
During the challenge, the ACS instructs the Cardholder to switch from the payment/checkout page to the Authentication App using the provided button on the screen. When the Cardholder has completed the authentication, the OOB Authentication App will automatically return the Cardholder to the Challenge screen on the 3DS Requestor App.
Refer to OOB Flow App Channel – Automatic Switching to the 3DS Requestor App for details on automatic switching from the OOB Authentication App to the 3DS Requestor App.
The ACS has defined, deployed, and communicated an OOB authentication process to the Cardholder.
The ACS provides the OOB App URL to the 3DS SDK.
The OOB Authentication App can handle the 3DS Requestor App URL.
The 3DS Requestor provides the 3DS Requestor App URL to the 3DS SDK.
The 3DS Requestor App and the OOB Authentication App are on the same device.
The 3DS SDK and ACS communicate via the 3DS Requestor App URL Indicator and OOB App URL Indicator that they support the URLs for automatic switching.
The Cardholder authenticates the transaction using an OOB Authentication App that is on the Device used for the purchase. The switching between the 3DS Requestor and the OOB Authentication App is automated.
The ACS sends a Final CRes message to the 3DS SDK, the 3DS SDK conveys the information to the 3DS Requestor App.
Note: After Step 9, the ACS may continue the challenge if the OOB authentication was not performed or failed, OR send the Final CRes message as shown.
Note: If the ACS receives or knows the result of the OOB authentication (pass or fail) before the Cardholder confirms completion, it may send the RReq before receiving the “OOB complete” information from the 3DS SDK.
Note: It is recommended for the ACS to display the “Complete” button (refer to the OOB Continuation Label) if the OOB Authentication App is on a different device or if there is a technical issue when the 3DS Requestor App URL and OOB App URL are invoked.
Note: After Step 4, the ACS may continue the challenge if the OOB authentication was not performed or if it failed, OR send the Final CRes message as shown.
The Cardholder selects the “Open yourbank app” button.
The 3DS SDK invokes the OOB App URL (Universal App Link), but the Device Operating System cannot resolve the URL and opens the default Device Browser.
Note: The ACS would need to provide a landing page to instruct the Cardholder to manually switch to the OOB Authentication App.
Note: The ACS may also display the “Complete” button if the OOB Authentication App is on a different device.
Note: The ACS should display the “Complete” button if the OOB Authentication App is on a different device.
Table 3.4: 3DS Data Elements Related to OOB – Automatic Switching to and from the OOB App
Data Element | Description | Version |
---|---|---|
3DS Requestor App URL | 3DS Requestor App declaring its URL within the CReq message so that the Authentication App can call the 3DS Requestor App after OOB authentication has occurred. Each transaction would require a unique Transaction ID by using the SDK Transaction ID. | 2.3.1 |
3DS Requestor App URL Indicator | Indicates whether the OOB Authentication App used by the ACS during a challenge supports the 3DS Requestor App URL. | 2.3.1 |
ACS Interface | The ACS interface that the challenge presents to the Cardholder. | 2.3.1 |
ACS UI Template | Identifies the UI Template format that the ACS first presents to the Cardholder. | 2.3.1 |
ACS UI Type | User interface type that the 3DS SDK will render, which includes the specific data mapping and requirements. | 2.3.1 |
Authentication Method | Authentication approach that the ACS used to authenticate the Cardholder for this specific transaction. | 2.3.1 |
OOB App Label | Label to be displayed for the link to the OOB App URL. |
2.3.1 2.2 + Bridging Message Extension |
OOB App Status | Status code indicating the type of problem encountered when using the OOB App URL (fail to open). | 2.3.1 2.2 + Bridging Message Extension |
OOB App URL | Universal App Link to an Authentication App used in the OOB authentication. The OOB App URL will open the appropriate location within the OOB Authentication App. | 2.3.1 2.2 + Bridging Message Extension |
OOB App URL Indicator | Indicates if the 3DS SDK supports the OOB App URL. | 2.3.1 2.2 + Bridging Message Extension |
OOB Continuation Indicator | Indicator notifying the ACS that the Cardholder has selected the OOB Continuation button in an OOB authentication method, or that the 3DS SDK automatically completes without any Cardholder interaction. | 2.3.1 2.2 + Bridging Message Extension |
OOB Continuation Label | Label to be used in the UI for the button that the Cardholder selects when they have completed the OOB authentication. | 2.3.1 |
SDK Authentication Type | Authentication methods preferred by the 3DS SDK in order of preference. | 2.3.1 |
SDK UI Type | Lists all UI types that the device supports for displaying specific challenge user interfaces within the 3DS SDK. | 2.3.1 |
Last Updated: April 17, 2020
Welcome to EMVCo. By accessing or using the EMVCo website at www.emvco.com (“Site“) or any Site Materials, whether or not you obtained them via the Site, you agree to the following Terms of Use on behalf of yourself individually and the company or organization for which you are using the Site or Site Materials (“Organization“). If you do not agree to the following Terms of Use, do not use the Site or other Site Materials.
In these Terms of Use, “Site Materials” means all email messages sent to you by EMVCo in connection with your registration on the Site or participation in an EMVCo participation program, and all content, files and other materials that are available for viewing or download on the Site, including the EMV® Specifications, requirements, guidelines, white papers or other documents, APIs, SDKs, software, scripts, code, trademarks, videos, text, graphics, pictures, information, and other materials.
You represent that either (a) you are an authorized representative of your Organization with authority to bind your Organization to these Terms of Use, in which case the term “you” refers collectively to both you individually and your Organization, or (b) you are not authorized to bind any Organization to these Terms of Use and are using the Site or Site Materials solely in your personal capacity, in which case the term “you” refers to you individually. EMVCo, LLC (“EMVCo“) reserves the right to modify or replace these Terms of Use at any time and in EMVCo’s sole discretion.
EMVCo will indicate at the top of these Terms of Use the date such document was last updated. Any changes will be effective immediately upon posting the revised version on the Site (or such later effective date as may be indicated at the top of the revised Terms of Use). Your continued use of the Site or Site Materials following the posting of any changes to these Terms of Use will constitute your acceptance of such changes. If you do not agree to the changes, you must stop using the Site and Site Materials. In addition, EMVCo may provide other methods by which you may accept or receive notice of these Terms of Use or changes to these Terms of Use.
In these Terms of Use, “EMV Products” means products or services that are designed to comply with the EMV Specifications. The foregoing license applies retroactively to include activities prior to the date you agreed to these Terms of Use, but is granted solely under the intellectual property rights that EMVCo owns or has the right to license. To the extent the foregoing license includes rights to a third party’s patents, the license is limited to those patents or patent claims that would be necessarily infringed by an entity implementing the mandatory or optional requirements of the EMV Specifications.
And after the cover page of each copy of a translation, the following (or a substantially similar notice) must be printed:
Notwithstanding the foregoing, the Public Documents may be subject to a separate agreement you may have with EMVCo or to supplemental terms and conditions that are included in or accompany Public Documents, in which case you agree that such separate agreement or supplemental terms and conditions will apply to your use of the Public Documents. Any use of the Site or Site Materials other than as specifically authorized herein (or in such separate agreement or supplemental terms and conditions) is strictly prohibited and will automatically terminate the foregoing license without notice.
EMVCo's new website and Participant Dashboard are now live. To access your account for the first time on our new website you'll need to carry out a password reset here. You will then be sent an email to reset your password.
EMVCo Associates, Subscribers and public users of emvco.com can create accounts to manage their engagement and participation with EMVCo. Using your EMVCo account, you can create your own watchlist of EMV technologies documents, monitor queries and responses, and manage your profile.