Juniper research reported that card fraud (CNP fraud), which is committed by card-not–present criminals, will hit $71 Billion between 2017-2021. This includes remote physical goods transactions, which are the primary target of online fraudsters.
In the next few years, this will average $14.2 million annually. CNP fraud, which is expected to be 4X higher than physical, points-of-sale fraud (POS), in 2018, will continue to grow as eCommerce and mCommerce become more popular.
CNP fraud does not pose a threat far away but is a present danger that does not discriminate. Anyone can become a victim.
Customers and vendors need protection against sophisticated cybercriminals, who are becoming increasingly sophisticated in security breaches.
The good news is there are advanced prevention and detection tools available that could protect everyone involved in CNP transactions. 3D Secure was identified as one of the most effective tools against CNP fraud, alongside machine learning and biometrics.
In conjunction with the 3DS2 protocol’s finalization this year, PCI SSC (Payment Card Industry Security Standards Council), has released a new standard for 3DS2 support.
Three brand new documents
Three new documents should be noted:
These documents can be downloaded at the PCI Security Standards Council Website.
The PCI 3DS Core Security Standard or simply PCI 3DS is the supporting standard. This standard defines security measures for specific 3DS environments. We’ll be discussing them below.
It provides baseline security controls for merchants and consumers within the 3DS environment.
The standard is split into two main sections.
The PCI 3DS Data Matrix, a supporting documentation to be used together with the PCI 3DS, is the PCI 3DS Data Matrix. It is used to identify data elements most commonly found in 3D Secure transactions. It basically consists of two tables that contain different data categories, a 3DS Data Element with descriptions of each 3D Secure Core component, and the PCI 3DS Data Element.
The first table contains 3DS sensitive data that must conform to PCI 3DS Core Security Standard specifications, while the second contains 3DS encryption keys that must generate and store in an HSM.
Different data categories include Authentication Challenge Data or Public Key Data.
The PCI 3DS SDK Security security standard is the last document. This is an independent standard that aims to provide security controls to allow 3DSSDK implementations to be secure.
It is intended for companies that create 3DS Software Development Kits. The goal is to make sure that these SDKs are designed with consumer security foremost in mind.
The PCI 3DS was developed with three core security components in mind. They are 3DS Server (3DSS), 3DS Directory Server (DS), and 3DS Access Control Server 3DS.
Each of them is part of one of three ecosystem domains that make up the 3DS protocols (i.e. 3 Domains).
The 3DS Server, also known as the merchant/acquirer Domain, is responsible for handling interactions between the 3DS Demandor environments, 3DS environments, and messaging.
The 3DS Directory Server comes under the Interoperability Domain. It is usually managed by a network of payment providers and includes the following functions.
Authenticates 3DS Server Requests while validating the 3DS requestor to be trusted and registered.
Routes 3DS messages to and from the 3DS Server, ACS.
Maintains account information and ACS routing data.
The 3DS Security Access Control Server (ACS) is part of Issuer Dom. This system is managed by account issues. It verifies whether authentication is available for a given card, performs a risk assessment for frictionless flows (if required), and manages cardholder challenges when necessary (through standardized message).
Compliance with the PCI 3DS Core Security Standard will be required if your organization performs any one of these functions.
It is important to remember that even if the core functions you perform are not yours, you still must comply with the standard in the event that you are a third-party provider who could have an impact on 3D Secure or any security of it.
This goal is to increase security for online payments. As mentioned previously, CNP fraud continues to increase. Online criminals use increasingly sophisticated techniques to access customer account details and to facilitate fraudulent transactions.
The online marketplace is changing, and mobile transactions will continue to be dominant in the coming years.
The different functionalities of the 3DS2 Protocol make it more adaptable to the changing marketplace and growing threat levels. It makes it a favorite defense mechanism against online payment fraud.
As such, PCI 3DS Core Security Standard is designed to support the 3DS 2 authentication system by helping to protect 3D Secure components which are crucial to the transaction.
With many years of rich experience in technology development, Logibiz Technologies aim to boost your online presence by offering 360-degree solutions related to Online Payments and its Security.
From Online Fraud Prevention solutions to White Label Payment Gateway Platform and complete 3DS testing environment, Logibiz has got your back. Additionally, we also offer consultancy services for all your EMVCo & Card Scheme certification needs.
We provide Free Demo & POC of our products which are certified globally and trusted by leading Financial Institutions worldwide.
Book a Free Consultation Call with our experts to discuss how we can help grow your online payments business.
We provide Tailored Payment Solutions for PSPs, Payment Gateways, Banks and Merchants with a complete range of top-tier payment gateway platforms, robust authentication solutions, and cutting-edge testing tools.
We’ll update you on our upcoming events, newsand publications.
Try our solutions for free! Sign up now and see how we can help you.
Explore our comprehensive services. Download our brochure for detailed information on our offerings and solutions.
The 3DS Server provides a functional interface between the Directory Server (DS) and the 3DS Requestor Environment flows. 3DS Server is responsible for gathering necessary data elements for 3-D Secure messages, authenticating the DS, validating the DS, the 3DS SDK, and the 3DS Requestor, safeguarding the message contents. The 3DS Server also helps to protect the message content while it is being transferred to DS and vice versa.
