How will data transfer look like with 3-D Secure 2.x?

• REQUEST: During the implementation of 3-D Secure 2.0 x and the necessary delivery of larger amounts of data, we recommend you to call our forms via Form-POST Method. Please note that the option iFrame is still available. Background are possible browser restrictions, which can lead to the fact that the sent data string is cut off.
  Example:

  Multiexcerpt
  MultiExcerptName payssl-request

• RESPONSE:
  Please also note a change to the final redirect to the URLSuccess | URLFailure.
  This will be excecuted as a body POST in the case of a 3-D Secure 2.0 x transactions. Therefore, you should be able to receive both a GET and a POST response on the URLSuccess | URLFailure.

How can I choose between 3-D Secure 1.0 or 2.

x?

• IMPORTANT: To be able to use and test 3-D Secure 1.0 or 3-D Secure 2.0x, we have to configure 3-D Secure on our

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Platform-Kurz PageWithExcerpt Wording

  on your behalf. Please contact 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Helpdesk-Name PageWithExcerpt Wording

  if you have not yet started this process.

• By default, each payment is made following the 3-D Secure 1.0 process.

• If you want to follow the 3-D Secure procedure 2.0x, please use the request parameter MsgVer=2.0. This applies to tests as well as in production at a later stage.

  • Parameter: MsgVer
    Value: 2.0

Use of JSON objects becomes mandatory

• Please note that a mandatory extension of existing parameters comes with the implementation of 3-D Secure 2.0 x. For this reason, 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

  expects and returns relevant additional data as JSON Object.
  The JSON Object must be Base64 encoded and regularly transmitted with all other parameters in the encrypted Blowfish data to

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

  .

• Please pass JSON Objects with values only. Empty or zero-filled objects/parameters lead to a rejection.

JSON Example request - encrypted data

BASEURL=

JSON Example request - request parameter before encryption

MerchantID=Generic3DSTest
&MsgVer=2.0
&TransID=1234567890
&RefNr=20200124
&Amount=100
&Currency=EUR
&URLNotify=https://www.computop.com
&URLSuccess=https://www.computop.com
&URLFailure=https://www.computop.com
&billToCustomer=ew0KICAgICJjb25zdW1lciI6IHsNCiAgICAgICAgInNhbHV0YXRpb24iOiAiTXIiLA0KICAgICAgICAiZmlyc3ROYW1lIjogIk5hcG9sZW9uIiwNCiAgICAgICAgImxhc3ROYW1lIjogIkJvbmFwYXJ0ZSIsDQogICAgICAgICJiaXJ0aERhdGUiOiAiMTc2OS0wOC0xNSINCiAgICB9LA0KICAgICJtb2JpbGVQaG9uZSI6IHsNCiAgICAgICAgImNvdW50cnlDb2RlIjogIjMzIiwNCiAgICAgICAgInN1YnNjcmliZXJOdW1iZXIiIDogIjEyMzQ1Njc4OTEwIg0KICAgIH0sDQogICAgImVtYWlsIjogIm5hcG9sZW9uLmJvbmFwYXJ0ZUBmcmFuY2UuY29tIg0KfQ==
&billingAddress=ew0KICAgICJjaXR5IjogIkFqYWNjaW8iLA0KICAgICJjb3VudHJ5Ijogew0KICAgICAgICAiY291bnRyeUEzIjogIkZSQSINCiAgICB9LA0KICAgICJhZGRyZXNzTGluZTEiOiB7DQogICAgICAgICJzdHJlZXQiOiAiRXhpbGVzdHJlZXQiLA0KICAgICAgICAic3RyZWV0TnVtYmVyIjogIjI3MCINCiAgICB9LA0KICAgICJwb3N0YWxDb2RlIjogIjIwMTY3Ig0KfQ==
&shipToCustomer=ew0KICAgICJjb25zdW1lciI6IHsNCiAgICAgICAgInNhbHV0YXRpb24iOiAiTXIiLA0KICAgICAgICAiZmlyc3ROYW1lIjogIkx1ZHdpZyIsDQogICAgICAgICJsYXN0TmFtZSI6ICJYVklJSSIsDQogICAgICAgICJiaXJ0aERhdGUiOiAiMTc1NS0xMS0xNyINCiAgICB9LA0KICAgICJtb2JpbGVQaG9uZSI6IHsNCiAgICAgICAgImNvdW50cnlDb2RlIjogIjMzIiwNCiAgICAgICAgInN1YnNjcmliZXJOdW1iZXIiIDogIjEyMzQ1Njc4OTEwIg0KICAgIH0sDQogICAgImVtYWlsIjogIkx1ZHdpZ0Byb3lhbC5mcmFuY2UuY29tIg0KfQ==
&shippingAddress=ew0KICAgICJjaXR5IjogIlBhcmlzIiwNCiAgICAiY291bnRyeSI6IHsNCiAgICAgICAgImNvdW50cnlBMyI6ICJGUkEiDQogICAgfSwNCiAgICAiYWRkcmVzc0xpbmUxIjogew0KICAgICAgICAic3RyZWV0IjogIlBsYWNlIGRlIGxhIENvbmNvcmRlIiwNCiAgICAgICAgInN0cmVldE51bWJlciI6ICIxIg0KICAgIH0sDQogICAgInBvc3RhbENvZGUiOiAiNzUwMDEiDQp9
&credentialOnFile=ew0KICAgICJ0eXBlIjogew0KICAgICAgICAidW5zY2hlZHVsZWQiOiAiQ0lUIg0KICAgIH0sDQogICAgImluaXRpYWxQYXltZW50IjogdHJ1ZQ0KfQ==
&OrderDesc=Test:0000


------

where:
billToCustomer=ew0KICAgICJjb25zdW1lciI6IHsNCiAgICAgICAgInNhbHV0YXRpb24iOiAiTXIiLA0KICAgICAgICAiZmlyc3ROYW1lIjogIk5hcG9sZW9uIiwNCiAgICAgICAgImxhc3ROYW1lIjogIkJvbmFwYXJ0ZSIsDQogICAgICAgICJiaXJ0aERhdGUiOiAiMTc2OS0wOC0xNSINCiAgICB9LA0KICAgICJtb2JpbGVQaG9uZSI6IHsNCiAgICAgICAgImNvdW50cnlDb2RlIjogIjMzIiwNCiAgICAgICAgInN1YnNjcmliZXJOdW1iZXIiIDogIjEyMzQ1Njc4OTEwIg0KICAgIH0sDQogICAgImVtYWlsIjogIm5hcG9sZW9uLmJvbmFwYXJ0ZUBmcmFuY2UuY29tIg0KfQ==
is base64-encoding of
{
"consumer":
{ "salutation": "Mr", "firstName": "Napoleon", "lastName": "Bonaparte", "birthDate": "1769-08-15" },
"mobilePhone": { "countryCode": "33", "subscriberNumber" : "12345678910" },
"email": "napoleon.bonaparte@france.com"
}

billingAddress=ew0KICAgICJjaXR5IjogIkFqYWNjaW8iLA0KICAgICJjb3VudHJ5Ijogew0KICAgICAgICAiY291bnRyeUEzIjogIkZSQSINCiAgICB9LA0KICAgICJhZGRyZXNzTGluZTEiOiB7DQogICAgICAgICJzdHJlZXQiOiAiRXhpbGVzdHJlZXQiLA0KICAgICAgICAic3RyZWV0TnVtYmVyIjogIjI3MCINCiAgICB9LA0KICAgICJwb3N0YWxDb2RlIjogIjIwMTY3Ig0KfQ==
is base64-encoding of
{
"city": "Ajaccio",
"country": { "countryA3": "FRA" },
"addressLine1": { "street": "Exilestreet", "streetNumber": "270" },
"postalCode": "20167"
}

shipToCustomer=ew0KICAgICJjb25zdW1lciI6IHsNCiAgICAgICAgInNhbHV0YXRpb24iOiAiTXIiLA0KICAgICAgICAiZmlyc3ROYW1lIjogIkx1ZHdpZyIsDQogICAgICAgICJsYXN0TmFtZSI6ICJYVklJSSIsDQogICAgICAgICJiaXJ0aERhdGUiOiAiMTc1NS0xMS0xNyINCiAgICB9LA0KICAgICJtb2JpbGVQaG9uZSI6IHsNCiAgICAgICAgImNvdW50cnlDb2RlIjogIjMzIiwNCiAgICAgICAgInN1YnNjcmliZXJOdW1iZXIiIDogIjEyMzQ1Njc4OTEwIg0KICAgIH0sDQogICAgImVtYWlsIjogIkx1ZHdpZ0Byb3lhbC5mcmFuY2UuY29tIg0KfQ==
is base64-encoding of
{
"consumer": { "salutation": "Mr", "firstName": "Ludwig", "lastName": "XVIII", "birthDate": "1755-11-17" },
"mobilePhone": { "countryCode": "33", "subscriberNumber" : "12345678910" },
"email": "Ludwig@royal.france.com"
}

shippingAddress=ew0KICAgICJjaXR5IjogIlBhcmlzIiwNCiAgICAiY291bnRyeSI6IHsNCiAgICAgICAgImNvdW50cnlBMyI6ICJGUkEiDQogICAgfSwNCiAgICAiYWRkcmVzc0xpbmUxIjogew0KICAgICAgICAic3RyZWV0IjogIlBsYWNlIGRlIGxhIENvbmNvcmRlIiwNCiAgICAgICAgInN0cmVldE51bWJlciI6ICIxIg0KICAgIH0sDQogICAgInBvc3RhbENvZGUiOiAiNzUwMDEiDQp9
is base64-encoding of
{
"city": "Paris",
"country": { "countryA3": "FRA" },
"addressLine1": { "street": "Place de la Concorde", "streetNumber": "1" },
"postalCode": "75001"
}

credentialOnFile=ew0KICAgICJ0eXBlIjogew0KICAgICAgICAidW5zY2hlZHVsZWQiOiAiQ0lUIg0KICAgIH0sDQogICAgImluaXRpYWxQYXltZW50IjogdHJ1ZQ0KfQ==
is base64-encoding of
{
"type": { "unscheduled": "CIT" },
"initialPayment": true
}

Key Parameter / Object

• If you do not use your own template, we a new template for the first tests for you. All you have to do is add "Template=ct_responsive_ch" to the encrypted data and the cardholderName entered by the customer will automatically be adopted by 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

  for the 3-D 2.0 x process. For the planned / upcoming 3DS-2.0 x rollout,  

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

  will adapt the standard templates accordingly and make them available to you.

• If you use your own merchant template and the cardholder query is not yet integrated in it, you need to integrate the cardholderName yourself.

• Example XSL file:

<!-- Cardholdername -->
	<div class="row ccholder">
		<span class="label">
			<xsl:value-of select="paygate/language/strCCHolder"/>
		</span>
		<div class="input">
			<input type="text" value="" id="creditCardHolder" name="creditCardHolder">
				<xsl:attribute name="value"><xsl:value-of select="paygate/creditCardHolder"/></xsl:attribute>
			</input>
		</div>
	</div>

• Example XML file:

For each language used:
<strCCHolder>Cardholdername</strCCHolder>

• For PaySSL.aspx | PayNow.aspx, the cardholderName is a key value pair.

• For Direct.aspx, the cardholderName is a JSON Parameter of the JSON-Objects "Card".

JSON Object – browserInfo

• For PaySSL.aspx 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

  captures the browser data on your behalf and there is no need for you to take any action.

• For a server-to-server connection via Direct.aspx or the use of PayNow.aspx, the individual additional queries must be implemented in the shop.

JSON Object – accountInfo

• The more data you transfer to us, the higher the probability that smooth payment processing (frictionless mode) will take effect.
  You should therefore check which data you already have and evaluate internally which data you would like to transfer.

JSON Object – customerInfo (billToCustomer | shipToCustomer)

• Please note that the transfer of address data is mandatory for 3-D Secure 2.0x. 
  IMPORTANT: If the delivery address is not identical to the billing address, both addresses must be transferred! In the case of digital goods, the billing address is sufficient.

JSON Object – merchantRiskIndicator

• We strongly recommend to pass the merchantRiskIndicator (shipping method).
  The shipping type is transferred in the JSON object merchantRiskIndicator in the JSON parameter shippingAddressIndicator.
  This can have a positive effect on smooth payment processing (frictionless mode).

Use cases for transaction flagging

Scenario 01 – Credit Card One-Time Payment

• You offer your customers payment by credit card

• Each payment is a one-time payment, and therefore always a newly initiated payment

• You do not use a pseudo card number to store and reuse the card data

Credentials on File (CoF)

• You must use 3-D Secure

• No further adjustments are necessary

Scenario 02 – Credit Card Subscriptions

• You offer your customers payment by credit card

• Customers enter into a subscription with you that ALWAYS maintains the same amount and payment interval

• You use the pseudo card number to store and reuse the card data

• IMPORTANT: The following initial payment is subject to the liability shift for you as a merchant. In the case of the subsequent payment, however, this expires, so that there is no liability shift.

Credentials on File (CoF) – Initial Subscription Payment

• Applies to PaySSL.aspx + PayNow.aspx

• 3-D Secure is mandatory

• Necessary adjustments:

  • Example:

    • JSON object credentialOnFile with JSON parameter recurring (3 keys included)

    • JSON object credentialOnFile with JSON parameter initialPayment and the value "true"

    • Example Initial Subscription Payment:

{
    "type": {
        "recurring": {
            "recurringFrequency": 30,
            "recurringStartDate": "2019-09-14",
            "recurringExpiryDate": "2020-09-14"
        }
    },
    "initialPayment": true
}

{
    "type": {
        "recurring": {
            "recurringFrequency": 30,
            "recurringStartDate": "2019-09-14",
            "recurringExpiryDate": "2020-09-14"
        }
    },
    "initialPayment": true,
    "useCase": "flexibleAmount"
}

Credentials on File (CoF) – Subsequent Subscription Payment

• Applies to Direct.aspx

• 3-D Secure is NOT mandatory

• Necessary adjustments:

  • Example:

    • Please always send the schemereferenceID from the initial payment so that the downstream systems can link the two transactions accordingly.

    • JSON object credentialOnFile with JSON parameter recurring (3 keys included)

    • JSON object credentialOnFile with JSON parameter initialPayment and value "false"

    • Example Subsequent Subscription Payment:

{
    "type": {
        "recurring": {
            "recurringFrequency": 30,
            "recurringStartDate": "2019-09-14",
            "recurringExpiryDate": "2020-09-14"
        }
    },
    "initialPayment": false
}

{
    "type": {
        "recurring": {
            "recurringFrequency": 30,
            "recurringStartDate": "2019-09-14",
            "recurringExpiryDate": "2020-09-14"
        }
    },
    "initialPayment": false,
    "useCase": "flexibleAmount"
}

Scenario 03 – Credit Card Recurring Payment / Down Payment / Final Payment

• You offer your customers payment by credit card

• Customers shop repeatedly in your shop using the same credit card data

• You use the pseudo card number to store and reuse the card data

• IMPORTANT: The following initial payment is subject to the liability shift for you as a merchant. In the case of the subsequent payment, however, this expires, so that there is no liability shift.

Credentials on File (CoF) - Initial Recurring Payment

• Applies to PaySSL.aspx + PayNow.aspx

• 3-D Secure is mandatory

• Necessary adjustments:

  • Example:

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "CIT"

    • JSON object credentialOnFile with JSON parameter initialPayment and the value "true"

    • Example Initial Recurring Payment:

{
    "type": {
        "unscheduled": "CIT"
    },
    "initialPayment": true
}

Credentials on File (CoF) - Subsequent Recurring Payment

• Applies to Direct.aspx

• 3-D Secure is NOT mandatory

• Necessary adjustments:

  • Example:

    • Please always send the schemereferenceID from the initial payment so that the downstream systems can link the two transactions accordingly

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "MIT"

    • JSON object credentialOnFile with JSON parameter initialPayment and value "false"

    • Example Subsequent Recurring Payment:

{
    "type": {
        "unscheduled": "MIT"
    },
    "initialPayment": false
 }

Scenario 04 – Credit Card Account Verification

• You offer your customers payment by credit card

• In this scenario, you only want to validate the customer's credit card

• You use the pseudo card number to store and reuse the card data

• IMPORTANT: Currently and in the future, schemes/card brands want to prevent merchants from carrying out card data validations with a minimum amount (e.g. 1 cent authorization). Therefore, 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

  offers you the corresponding "ZeroValueAuthentication". This is controlled by passing the additional parameter "AccVerify" in the encrypted data – see the example below for details.
  Please make sure that your credit card acquirer supports this function for you.

Credentials on File (CoF) - Validation Request

• Applies to PaySSL.aspx + PayNow.aspx

• 3-D Secure is mandatory

• Necessary adjustments:

  • Example:

    • Please send the parameter AccVerify=Yes in the encrypted data (for further details please refer to our programming manual)

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "CIT"

    • JSON object credentialOnFile with JSON parameter initialPayment and the value "true"

    • Example Account Verification:

{
    "type": {
        "unscheduled": "CIT"
    },
    "initialPayment": true
}

Scenario 05 – Credit Card Token Storage / Form Prefill – PayNow interface

• You offer your customers payment by credit card

• Customers buy in your shop and you store the credit card data in the form of the pseudo card number

A: When the customer returns, you prefill the credit card form with the saved data. In the case of CIT with initial=false, flagging is used if the merchant prefills the pseudo card number to the customer using a template prefill option.

B: When the customer returns, you prefill the credit card form with the saved data. If the customer deletes the existing card number and stores a new one or, if necessary, adds another card, then the flagging for CIT must be used again (initial=true), if the customer also wants this card to be preassigned.

Credentials on File (CoF) – Initial Payment for Token Storage

• Applies to PayNow.aspx

• 3-D Secure is mandatory

• Necessary adjustments:

  • Example:

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "CIT".

    • JSON object credentialOnFile with JSON parameter initialPayment and the value "true"

    • Example Initial Payment for Token Storage:

{
    "type": {
        "unscheduled": "CIT"
    },
    "initialPayment": true
}

Credentials on File (CoF) – Subsequent Payment for Token Storage

• Applies to PayNow.aspx

• 3-D Secure is mandatory

• Necessary adjustments:

  • Example:

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "CIT"

    • JSON object credentialOnFile with JSON parameter initialPayment and value "false"

    • Please always send the schemereferenceID from the initial payment (COF-CIT-TRUE) so that the downstream systems can link the two transactions accordingly

    • Example subsequent payment für Token Storage:

{
    "type": {
        "unscheduled": "CIT"
    },
    "initialPayment": false
}

Szenario 05 – Credit Card Token Storage / Form Prefill – PaySSL interface

The obligatory control of the initial and recurring payments is managed by

Please note the following requirements in relation to merchant specific or

• Applies to PaySSL.aspx

• 3-D Secure is mandatory

• The shift in liability is subject to the liability shift for you as a merchant

• Necessary adjustments (merchant template):

  • Please integrate a prefill checkbox using the code snippet provided below
  • Please activate (comment in) the code contained in the XSL file for preassigning the pseudo card number
  • If the customer decides to save the card data (clicks the checkbox), the merchant system will receive the additional, encrypted response parameter "prefill=on". If the checkbox is not clicked, there is no additional notification about the prefill parameter.
  • If you want to prefill the form with the card data for the registered customer, please deliver in the encrypted data the Card JSON object and within it send the existing pseudo card number (token), expiration date, card brand and the credit card holder.
  • Please do NOT submit a Credential On File object for the initial request as well as for further pre-filled payment.
• Necessary adjustments (

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

  standard form):
  • If you would like the prefill checkbox to be displayed on

    Multiexcerpt include
    SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

    's own form, please let us know via the

    Multiexcerpt include
    SpaceWithExcerpt EN MultiExcerptName Helpdesk-Name PageWithExcerpt Wording

    . Then we will configure the complete function (checkbox + COF control) for you.
  • Please do NOT send a Credential On File object for the initial request as well as for further pre-filled payment.
  • If the customer decides to save the card data (clicks the checkbox), the merchant system will receive the additional, encrypted response parameter "prefill=on". If the checkbox is not clicked, there is no additional notification about the prefill parameter.
  • If you want to prefill the form with the card data for the registered customer, please deliver in the encrypted data the Card JSON object and within it send the existing pseudo card number (token), expiration date, card brand and the credit card holder

// Adds a Change-Event to the checkbox called 'cbPrefill'
$("#cbPrefill").change(function() {
 if ($("#cbPrefill").is(':checked'))
{   // If the checkbox was activated, the value of hiddenfield with name 'prefill' is set to 'on'   $("input[type='hidden'][name='prefill']").val('on');  }

else
{   // If the checkbox was deactivated, the value of hiddenfield with name 'prefill' is deleted again   $("input[type='hidden'][name='prefill']").val('');  }

});
// In case of retries (If form gets called a second time due to errors),
// the last status will be set
if ($("input[type='hidden'][name='prefill']").val() == 'on') {
 $("#cbPrefill").attr('checked', true);
}

<!-- Hiddenfield, which tells Paygate that prefill function should get activated -->
<!-- value="on" means that Paygate will return 'prefill=on' in the response to merchant -->
<!-- value=""  means that Paygate will not return 'prefill=on' in the response to merchant -->
<input type="hidden" name="prefill"><xsl:attribute name="value"><xsl:value-of select="paygate/prefill"/></xsl:attribute></input>

<!-- Checkbox to (de)activate prefill function -->
 <div id="div_cbPrefill" class="div_cbPrefill">
  <input type="checkbox" name="cbPrefill" id="cbPrefill"></input>
  <span><xsl:value-of select="paygate/language/strCCSaveData" disable-output-escaping="yes"/></span>
  <div class="row"></div>
 </div>

Scenario 06 – Credit Card Recurring Payment incl. Liability Shift (e.g. Travel business)

• IMPORTANT: The following scenario only applies to PCI-certified systems

• There are several scenarios for the travel industry that allow recurring payments to also be subject to liability shift

• Example:

  • Customer books a hotel room via a booking platform, enters his card data and executes 3-D Secure 2.0x. This is processed via a separate PSP. This transaction only serves to validate the card data -ZeroValueAuthentication-.

    This results in an Authenticate Status = CAVV, which the central booking platform then reports to the hotel operator (and any other service providers such as rental car agencies, insurance agencies, etc.). The hotel operator makes a NON-3DS 2.0 x payment via

    Multiexcerpt include
    SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

    , but including the CAVV and any other data. The second transaction also contains the corresponding liability shift.

• The basis for this to work and for the liability shift to take place is the passing on of the Authenticate Status (CAVV). This is determined via a so-called "External 3DS Authentication". Two steps are necessary:

  1. The external merchant system that initiated the first payment (AccVerify/ZeroValueAuthentication) stores the authentication status

  2. Subsequently, a recurring payment can be made via

     Multiexcerpt include
     SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

     . In this case, the merchant must include the JSON object threeDSData in the JSON data as well as the original card data of the initial authenticate (Card-JSON). The card data must therefore be transferred in its original form from the booking platform to all relevant service providers / agencies in compliance with PCI.
     For this purpose a separate section explains the necessary steps.

• All necessary technical information can be found in the Multi-party Ecommerce / Agent Model section.

Scenario 07 – Credit Card MoTo (MailOrder / TelephoneOrder) via PaySSL, Direct or PayNow

• You offer your customers payment by credit card, which is collected by telephone.

• The credit card data is entered in a separate call centre application which triggers a payment via 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

  using PaySSL.aspx, Direct.aspx or Paynow.aspx.

• You use the pseudo card number to store and reuse the card data

• IMPORTANT: MoTo payments are not subject to the liability shift as 3-D Secure is not possible. (Out of Scope)

Credentials on File (CoF) - Initial MoTo Payment

• Applies to PaySSL.aspx, PayNow.aspx und Direct.aspx

• 3-D Secure is not possible (Out of Scope)

• Necessary adjustments:

  • Example:

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "MIT"

    • JSON object credentialOnFile with JSON parameter initialPayment and the value "true"

    • Example Initial MoTo Payment:

{
    "type": {
        "unscheduled": "MIT"
    },
    "initialPayment": true,
     "useCase": "ucof" 
}

Credentials on File (CoF) - Subsequent MoTo Payment

• Applies to automated payment initiation via Direct.aspx

• 3-D Secure is not possible (Out of Scope)

• Necessary adjustments:

  • Example:

    • Please always send the schemereferenceID from the initial payment so that the downstream systems can link the two transactions accordingly

    • JSON object credentialOnFile with JSON parameter unscheduled and the value "MIT"

    • JSON object credentialOnFile with JSON parameter initialPayment and value "false"

    • Example Subsequent MoTo Payment:

{
    "type": {
        "unscheduled": "MIT"
    },
    "initialPayment": false,
      "useCase": "ucof"  
}

Scenario 08 – Credit Card MoTo (MailOrder / TelephoneOrder) via Virtual Terminal

• You offer your customers payment by credit card, which is collected by telephone.

• The credit card data is entered via Virtual Terminal.

• IMPORTANT: MoTo payments are not subject to the liability shift as 3-D Secure is not possible. (Out of Scope)

Credentials on File (CoF)

• By using the Virtual Terminal no further adjustments are necessary.

Scenario 09 – Batch Processing

The requirement of the card brands to mark recurring transactions correctly is already an older requirement; we provided information on this in January 2019. In the course of the PSD2-SCA implementation, this will become fully mandatory so that recurring transactions can be clearly identified and the downstream systems can recognize why 3-D Secure was not processed in these cases. Since in those cases no end customer actively participates in the payment process, as consequence, the implementation is mandatory for all merchants.

Below you will find our descriptions & details, i.e. in the first step the initial payment from the store has to be marked as CredentialOnFile and based on that the recurring batch transactions will follow.

***initial shop transaction or AccountVerification:

On our application page the correct initial flagging (CredentialOnFile) is described for different use cases and the following chapter + scenario will apply to you.

3DS 2.0 x Merchant Use-Cases & Testing of 3D-Secure 2.0 x EN

Chapter: 2. use cases for transaction identification
Scenario 03 - Credit Card Recurring Payment / Deposit Payment / Final Payment

***Recurring batch submission
Since the schemeReferenceID was generated from the initial store request and reported back, that initial value must be used for all subsequent batch submissions + RTF=M (M=Merchant Initiated Transaction) needs to be included & specified.
Card+processing+EN

Chapter: Batch usage of the interface

affected batch format / action:

CC,Sale,<Amount>,<Currency>,<TransID>,(<RefNr>),<CCBrand>,<CCNr|PCNr>,<CCExpiry>,<OrderDesc>,<textfeld1>,<textfeld2>,<RTF>,<cardholder>,<transactionID>,<schemeReferenceID>
CC,Authorize,<Amount>,<Currency>,<TransID>,(<RefNr>),<CCBrand>,<CCNr|PCNr>,<CCExpiry>,<OrderDesc>,<textfeld1>,<textfeld2>,<RTF>,<cardholder>,<transactionID>,<schemeReferenceID>

In the batch request there exists the "transactionID" on the one hand and in addition the "schemeReferenceID" as well and we recommend that you take field schemeReferenceID.

Examples ‒ Batch Versions 1.2 ‒ schemeReferenceID field delivery:
CC,Sale,<Amount>,<Currency>,<TransID>,(<RefNr>),<CCBrand>,<CCNr|PCNr>,<CCExpiry>,<OrderDesc>,<textfeld1>,<textfeld2>,<RTF>,<cardholder>,<1234567890>

The Scheme Identifier must be transferred in batch format by using the TransactionID / schemeReferenceID, i.e. you will receive the schemeReferenceID / TransactionID for the initial 3DS-2.X transaction. This value must then be included in the batch format so that all recurring payments are correctly identified. The field cardHolder must be present but can also be submitted as an empty field and using schemeReferenceID the TransactionID field also empty.

Example:

CC,Sale,999,EUR,987456321,123456789,<VISA>,<0123456789123456>,<052029>,<mein Warenkorb>,,,M,,,<1234567890>

***Token/PCN Mandate - SchemeReferenceID

You can try to submit payments without using a schemeReferenceID, but we cannot prevent card transactions to be declined.
In case of a rejection, we recommend to execute a separate transaction as Card Check (AccVerify=YES) transaction via our ...PaySSL.aspx, i.e. the customer receives a payment link which he can use to process an initial 3DS-2.X transaction and the schemeReferenceID is then reported back and can be included in the process of recurring payments again.

Scenario 10 – Extended Transaction Management (ETM)

• When using the

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

  ETM, 

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Platform-Name PageWithExcerpt Wording

  takes care of the correct flagging of transactions for you.

Test 3-D Secure 2.

x

Take the opportunity to test 3-D Secure 2.0 x now!

While not all downstream systems currently offer 3-D Secure for testing, you can perform a test simulation within

Please proceed as follows for testing:

• Activate 3-D Secure 2.0 x for your your

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Partner-Name PageWithExcerpt Wording

  MerchantID. If you are unsure whether it has already been activated, please contact

  Multiexcerpt include
  SpaceWithExcerpt EN MultiExcerptName Helpdesk-Name PageWithExcerpt Wording

• In the encrypted data request, use the default parameter OrderDesc with the value "Test:0000". This will give you a correspondingly successful authorization after successful authentication.

• Perform 3-D Secure Authentication

• Please ONLY use the available Testcards (expiration date always in the future + CVV/CVC may contain any value)

• Depending on the desired scenario (e.g. Browser 3-D Secure 2.0 x challenge, frictionless browser authentication, etc.), please use the appropriate One-Time Passwords