Bridging Message Extension

Business Overview

The Bridging Message Extension enhances the existing 3DS version 2.2.0 specifications by enabling the implementation of features that are incorporated in the 3DS version 2.3.1.1 specification. In addition, during the migration to version 2.3.1.1, support of the Bridging Message Extension will increase consistency of the key 3DS features provided in version 2.2.0 and version 2.3.1.1.
The Bridging Message Extension covers different version 2.3.1.1 features and defines four sets of data:

  • Recurring Data, which enhances the information exchange between the 3DS Requestor and the ACS regarding the recurring transaction information, and a better communication to the Cardholder in case of a challenge.
  • Challenge Data, which enables automation of the switching between the 3DS SDK and an Out-of-Band (OOB) authentication application.
  • File URL Data, which enables the 3DS Server to retrieve Card Range Data via a file download from the DS rather than from PRes messages.
  • Additional Data, which is used by the 3DS Server, the ACS and the DS to share additional information from 3DS version 2.3.1.1 during a 3DS authentication.

Technical Features

Recurring Data, Challenge Data, Additional Data and File URL Data contain new data or new values for existing data in the AReq/ARes, PReq/PRes or RReq messages for version 2.2.0.

Note: As there are multiple versions of the Bridging Message Extension, the Extension Version Number must be kept the same across all message exchanges during a 3DS transaction. When responding, the recipient of the Bridging Message Extension must use the same Extension Version Number for the message pair (AReq/ARes, CReq/CRes, PReq/PRes) as the one received. If the recipient does not support that Extension Version Number, it must not include the Bridging Message Extension in its response.

Recurring Data

Recurring Data is provided for recurring and instalment transactions. The use cases and the technical capabilities of 3DS with recurring data elements are presented in the Recurring and Installment Transactions section.

 

The table below lists the recurring data elements that may be provided in relation to the Bridging Message Extension.

Table 6.2: Recurring Data Elements Related to the Bridging Message Extension

Data Element/Field Name

Description

Version

Recurring Amount

Recurring amount in minor units of currency with all punctuation removed.

2.2

Recurring Currency

Currency in which the Recurring Amount is expressed.

2.2

Recurring Currency Exponent

Minor units of currency as specified in the ISO 4217 currency exponent.

2.2

Recurring Date

Effective date of the new authorised amount following the first/promotional payment in a recurring or instalment transaction.

2.2

Recurring Expiry

Date after which no further authorisations are performed.

2.2

Recurring Frequency

Indicates the minimum number of days between authorisations for a recurring or instalment transaction.

2.2

Recurring Indicator

 

Indicates whether the recurring or instalment payment has a fixed or variable amount and frequency.

The Recurring Indicator object contains:

  • the Amount Indicator
  • the Frequency Indicator

2.2

 

Challenge Data

Using Challenge Data, the ACS and 3DS SDK can automate switching from the 3DS Requestor App to the OOB Authentication App.
Challenge Data is only provided in CReq/CRes messages for the App-based flow when the Message Version Number is 2.2.0 (not 2.1.0).

The use cases and the technical details of switching from the 3DS Requestor App to the OOB Authentication App are presented in OOB Flow: App Channel – Automatic Switching to the OOB App section. 

Note; The ACS shall implement Req 401, limited to ACS UI Type = 04, and the 3DS SDK shall implement Req 399, Req 400, Req 403, Req 404, Req 406, Req 407, Req 408 and Req 409, limited to ACS UI Type = 04 to enable automatic switching from the 3DS Requestor App to the OOB Authentication App.

Challenge Data is only supported for ACS UI Type = 04 (OOB), ACS UI Type = 06 (HTML OOB) is NOT supported.

For the Challenge Data Entry Masking, the ACS requests the Challenge Data Entry to be masked by setting Challenge Data Entry Masking to Y (limited to ACS UI Type = 01). The 3DS SDK shall implement Challenge Data Entry Masking (Figures 44 and 45, Table A.26).

The table below lists the challenge data elements that may be provided in relation to the Bridging Message Extension.

Table 6.3: Challenge Data Elements Related to the Bridging Message Extension

Data Element/Field Name

Description

Version

Challenge Data Entry Masking

Indicates that the 3DS SDK shall mask the data entered by the Cardholder.

2.2

OOB App Label

Label to be displayed for the link to the OOB App URL.

2.2

OOB App Status

Status code indicating the type of problem encountered when using the OOB App URL.

2.2

OOB App URL

Universal App Link to an authentication app used in the OOB authentication. The OOB App URL will open the appropriate location within the OOB Authentication App.

2.2

OOB App URL Indicator

Indicates if the 3DS SDK supports the OOB App URL.

2.2

OOB Continuation Indicator

 

Indicator notifying the ACS that the Cardholder has selected the OOB Continuation button in an OOB authentication method, or that the 3DS SDK automatically completes without any Cardholder interaction.

2.2

File URL Data

File URL Data is used in the PReq/PRes message when the Message Version Number is 2.2.0. If supported by both the 3DS Server and the DS, the 3DS Server downloads a file containing the Card Range data.

For additional details and processing requirements refer to Section 5.6 in version 2.3.1.1 of the Core Specification.

The table below lists the File URL data elements that may be provided in relation to the Bridging Message Extension.

Table 6.4:  File URL Data Elements Related to the Bridging Message Extension

Data Element/Field Name

Description

Version

Card Range Data Download Indicator

 

Indicates if the 3DS Server supports Card Range Data from a file.

Note: If present, this field contains the value Y.

2.2

Card Range Data File URL

 

Fully Qualified URL of the DS File containing the Card Range Data for download.

Note: When the Card Range Data File URL is present, the file contains the entire Card Range Data, and the 3DS Server ignores any Card Range Data and Serial Number present in the PRes message.

2.2

Additional Data

Using the Additional Data, the ACS, 3DS Server and DS may share additional information to improve the authentication or error reporting, indicating, for example:

  • whether the OOB Authentication App used by the ACS supports the 3DS Requestor App URL
  • the Acquirer Country Code
  • the Authentication Method used by the ACS
  • the Card Security Code
  • the Device Information Version supported by the ACS
  • the Transaction Challenge Exemption applied by the ACS
  • the Challenge Error Reporting – detailed information in case of an error in the CReq/CRes messages
  • the reason for cancelling the Challenge.

Note: To provide the Challenge Cancelation Indicator, the ACS shall implement the updates to Section 5.9.5 (ACS CReq Message Error Handling—01-APP) in version 2.3.1.1 of the Core Specification.

The table below lists additional data elements that may be provided in relation to the Bridging Message Extension.

Table 6.5: Additional Data Elements Related to the Bridging Message Extension

Data Element/Field Name

Description

Version

3DS Requestor App URL Indicator

Indicates whether the OOB Authentication App used by the ACS during a challenge supports the 3DS Requestor App URL.

2.2

3DS Requestor Authentication Indicator

 

Indicates the type of Authentication Request.

This data element provides additional information to the ACS to determine the best approach for handling an Authentication Request.

2.2

3RI Indicator

Indicates the type of 3RI request.

This data element provides additional information to the ACS to determine the best approach for handling a 3RI request.

2.2

Acquirer Country Code

 

The code of the country where the acquiring institution is located (in accordance with ISO 3166-1).

The DS may edit the value provided by the 3DS Server.

2.2

Acquirer Country Code Source

 

This data element is populated by the system setting the Acquirer Country Code.

The DS may edit the value provided by the 3DS Server.

2.2

Authentication Method

 

Indicates the list of authentication types the Issuer will use to challenge the Cardholder, when in the ARes message, or what was used by the ACS, when in the RReq message.

Note: For 03-3RI, only present for Decoupled Authentication.

2.2

Browser Screen Color Depth

Value representing the bit depth of the colour palette for displaying images, in bits per pixel.

Obtained from the Cardholder browser using the screen.colorDepth property.

Refer to Section A.6 in the Core Specification v2.3.1.1 for more details.

2.2

Card Security Code

Three- or four-digit security code printed on the card.

2.2

Card Security Code Status

Enables the communication of Card Security Code Status between the ACS, the DS and the 3DS Requestor.

2.2

Card Security Code Status Source

This data element will be populated by the system setting the Card Security Code Status.

2.2

Challenge Cancelation Indicator

 

Indicator informing the ACS and the DS that the authentication has been cancelled.

Note: The Additional Data object is not valid for the CReq/CRes messages. Therefore, the Challenge Cancelation Indicator may only be present in the RReq message.

2.2

Challenge Error Reporting

Copy of the Erro Message sent or received by the ACS in case of error in the CReq/CRes messages.

2.2

Device Information Recognised Version

Indicates the highest Data Version of the Device Information supported by the ACS.

2.2

Transaction Challenge Exemption

Exemption applied by the ACS to authenticate the transaction without requesting a challenge.

Note: The accepted values match the values of the 3DS Requestor Challenge Indicator.

2.2

Transaction Characteristics

Indicates to the ACS specific transactions identified by the Merchant.

Refer to Merchant Risk Indicator in the Core Specification v2.3.1.1

2.2