Payment Gateways, 3D Secure, Mastercard and Visa

[zezima]

Hi all,

I'm investigating a phenomenon that we are seeing with our MyGate payment gateway. Every time a MasterCard is put to 3D secure, the payment fails. Front end experience by customers who fail into this narrow category is sketchy, but it sounds like they can't get passed the screen that asks them to put in details for where they should receive their one-time-PIN.

So I'm keen for any info on the detail on 3D secure. I'm not after the high-level stuff that you can pull from Google, but an explanation as to how 3D secure is implemented, and how it treats customers who have Visa cards versus those who have MasterCards. From what I understand, at the authentication step, a third party is contacted to find out whether a person is registered for 3D secure. And I also don't know whether "3D secure" is meant to be a worldwide thing, because we are also seeing the same phenomenon with foreign issued card.

Any pointers?

Thanks!

 

[sp4ceman]

It's an international anti fraud initiative.

Practically you have one more step in the checkout process. Instead of sending a request to the payment gateway and receiving a response you are given a url to display in a frame or whatever.

you send the user to that url and also pass the url a notification url that the 3rd party can use to notify you of the verifications outcome.

when they hit the notification url they will pass you a transaction id and whether or not it succeeded or not

 

[Praemon]

I'm actually seeing the exact same thing, but with a different payment gateway. A large majority of MasterCard credit cards fail on the first attempt with 3D Secure error, and then go through on the second one. Spoke to someone who experienced the problem and they said that it "hung" after entering the OTP and trying to verify it. Oddly enough, when trying to do the payment again, it then skipped 3D Secure, even though it's a 3D Secure registered card.

Definitely sounds like there's something wrong with the MasterCard 3D Secure mechanism.

 

[zezima]

Hi sp4ceman, thanks for the response, but you've essentially replied with the high level detail that is already widely known. What I've figured out since is that the extra third party here is BankServ. And thanks for pointing out that it is an international thing. The issue is still troublesome, but it's helpful to know that international cards are also being pushed through the same mechanism. (Or some of them, at least.)

It's an international anti fraud initiative.

Practically you have one more step in the checkout process. Instead of sending a request to the payment gateway and receiving a response you are given a url to display in a frame or whatever.

you send the user to that url and also pass the url a notification url that the 3rd party can use to notify you of the verifications outcome.

when they hit the notification url they will pass you a transaction id and whether or not it succeeded or not

 

[zezima]

Thanks for the feedback, Denouncer. Yes, we are seeing the same thing too, and other variations as well! Could you PM me the gateway you're using? It will be just a bit of extra data for me concerning how widespread the problem could be.

Also, just to add to my original message: the extra third party (ie the Directory Server and ACS) is BankServ. Still, we are not much further in resolving the issue. And it's not helpful that there are bugs in our data extra from MyGate!

I'm actually seeing the exact same thing, but with a different payment gateway. A large majority of MasterCard credit cards fail on the first attempt with 3D Secure error, and then go through on the second one. Spoke to someone who experienced the problem and they said that it "hung" after entering the OTP and trying to verify it. Oddly enough, when trying to do the payment again, it then skipped 3D Secure, even though it's a 3D Secure registered card.

Definitely sounds like there's something wrong with the MasterCard 3D Secure mechanism.

 

[HApyM3al]

Hi there,

I am not sure what your gateway is doing exactly. We have a sagepay gateway and I know foreign cards is always a issue.

Our sagepay gateway is used to sell data. and I know if use mikrotik we had to add the URL of different banks in the walled garden for it to be able to send you the OTP. If this is same case let me know. I can send you the list that needs to be added to walled garden.