Secure Payment Confirmation (SPC) is a proposed web standard that allows customers to authenticate with their card issuer, bank, or other payment service provider using a platform authenticator:
SPC is designed to enable streamlined SCA for the purpose of completing online payment transactions. It enables a consistent authentication experience across websites/Merchants and provides cryptographic evidence that the Cardholder has accepted the terms of the transaction. These terms include the Merchant details, the payment instrument, and the total amount of the transaction. When a Merchant or Issuer invokes the SPC API, the Browser displays the elements of the transaction in a secure modal window, and the Cardholder is asked to verify as illustrated below.
Once the SPC Transaction Data has been verified by the Cardholder, the Cardholder is then prompted to authenticate using the Platform Authenticator integrated with their device.
There are two steps to use SPC – registration and authentication:
This White Paper focuses on the Authentication stage of SPC and assumes that registration of the Cardholder’s credential has already occurred and is outside the scope of the Core Specification.
SPC is built upon WebAuthn and designed specifically for payment purposes. As WebAuthn credentials are registered for specific domains, these credentials cannot be used to authenticate on unregistered sites that may be impersonating a Merchant. This feature makes WebAuthn effective against phishing attacks. SPC is available for browsers built using Chromium software (such as Microsoft Edge or Google Chrome).
SPC adds a payment information layer on top of WebAuthn enabling the card issuer or bank to provide a consistent payment experience. Once a payer registers an authenticator with the Relying Party, it can be used to authenticate on different Merchant sites. The Relying Party can also choose to use the payment credential as a regular WebAuthn credential.
The ACS has an enrolled FIDO Authenticator on the device for the Cardholder.
The 3DS Requestor and/or the ACS have detected that the Cardholder Browser supports the related SPC APIs (allow=”payment *; publickey-credentials-get *”). For the ACS, this information can be obtained via the Browser User-Agent data element or via data obtained using the 3DS Method.
Table 4.2 below lists the data elements that may be provided in relation to SPC, whereas Table 4.3 lists the data elements that may be provided in relation to the SPC Transaction Data Object
Table 4.2: 3DS Data Elements Related to Secure Payment Confirmation
Data Element/ |
Description |
Version |
3DS Requestor Authentication Information |
Information about how the 3DS Requestor authenticated the Cardholder before or during the transaction. |
2.3.1 |
3DS Requestor Prior Transaction Authentication Information |
Information about how the 3DS Requestor authenticated the Cardholder as part of a previous 3DS transaction. |
2.3.1 |
3DS Requestor SPC Support
|
Indicate if the 3DS Requestor supports the SPC authentication. Note: If present, this field contains the value Y. |
2.3.1 |
ACS Information Indicator
|
Provides additional information for a particular Protocol Version to the 3DS Server. The element lists all applicable values for the card range. |
2.3.1 |
Authentication Method
|
Indicates the list of authentication types the Issuer will use to challenge the Cardholder, when in the ARes message or what was used by the ACS when in the RReq message. Note: For 03-3RI, only present for Decoupled Authentication. |
2.3.1 |
SPC Transaction Data |
Information that the 3DS Requestor passes in the SPC API for display in the Smart Modal Window. |
2.3.1 |
Transaction Status
|
Indicates whether a transaction qualifies as an authenticated transaction or account verification. The Final CRes message can only contain a value of Y or N or D. Transaction Status = C or S is not allowed for Device Channel = 3RI. |
2.3.1 |
WebAuthn Credential List |
List of credential IDs registered for the Cardholder Account Number. |
2.3.1 |
Table 4.3: 3DS Data Elements Related to the SPC Transaction Data Object
Data Element/ |
Description |
Version |
Additional Data |
For SPC API enhancement, to be defined in a future 3DS specification release |
2.3.1 |
Challenge |
Random string generated by the ACS to prevent replay attacks. |
2.3.1 |
Challenge Information Text |
Text provided by the ACS to be displayed during the SPC authentication. |
2.3.1 |
Currency |
Transaction amount currency to be displayed during the SPC authentication |
2.3.1 |
Display Name |
Card or product name (Payment Instrument) to be displayed during the SPC authentication. |
2.3.1 |
Icon |
Card image (Payment Instrument) URL or Data URL to be displayed during the SPC authentication. |
2.3.1 |
Issuer Image SPC
|
Issuer logo or Image URLs or Data URLs to be displayed during the SPC authentication. Includes at minimum the Default Image and at maximum the three Fully Qualified URLs or Data URLs defined as default, dark mode or monochrome images of the Issuer Image SPC. Default Image Example Fully Qualified URL: Example Data URL: |
2.3.1 |
Payee Name
|
The display name of the payee that this SPC call is for (e.g., the Merchant). |
2.3.1 |
Payee Origin
|
The origin of the payee that this SPC call is for (e.g. the Merchant). |
2.3.1 |
Payment System Image SPC
|
Payment System logo or Image URLs to be displayed during the SPC authentication. Includes at minimum the Default Image and at maximum the three Fully Qualified URLs defined as default, dark mode or monochrome images of the Payment System Image SPC. Default Image Example Fully Qualified URL: Example Data URL: |
2.3.1 |
Timeout |
The number of milliseconds before the request to sign the transaction details times out. |
2.3.1 |
Value |
Transaction amount as a decimal value to be displayed during the SPC authentication. |
2.3.1 |
WebAuthn SPC Extension Indicator |
For SPC and WebAuthn API enhancement. |
2.3.1 |
The SPC authentication can be initiated by the 3DS Requestor via an extra AReq/ARes message pair instead of the standard browser challenge flow.
Note: It is expected that, if the Assertion Data is verified correctly, no further challenge is needed and the 3DS Server will then receive an ARes message with Transaction Status = Y. However, the ACS is able to respond with any applicable Transaction Status, including Transaction Status = C, if the ACS determines that an additional challenge is necessary.
Note: The DS may act as the FIDO Relying Party and perform some or all the actions described for the ACS within the SPC flow.
When the ACS initiates and performs an SPC authentication as part of a challenge, the steps are identical to a standard Browser flow, where SPC authentication is used instead of the other 3DS challenge methods. This section outlines some of the details and values for specific steps when an ACS performs an SPC authentication as part of the Challenge Flow.
Last Updated: April 17, 2020
Welcome to EMVCo. By accessing or using the EMVCo website at www.emvco.com (“Site“) or any Site Materials, whether or not you obtained them via the Site, you agree to the following Terms of Use on behalf of yourself individually and the company or organization for which you are using the Site or Site Materials (“Organization“). If you do not agree to the following Terms of Use, do not use the Site or other Site Materials.
In these Terms of Use, “Site Materials” means all email messages sent to you by EMVCo in connection with your registration on the Site or participation in an EMVCo participation program, and all content, files and other materials that are available for viewing or download on the Site, including the EMV® Specifications, requirements, guidelines, white papers or other documents, APIs, SDKs, software, scripts, code, trademarks, videos, text, graphics, pictures, information, and other materials.
You represent that either (a) you are an authorized representative of your Organization with authority to bind your Organization to these Terms of Use, in which case the term “you” refers collectively to both you individually and your Organization, or (b) you are not authorized to bind any Organization to these Terms of Use and are using the Site or Site Materials solely in your personal capacity, in which case the term “you” refers to you individually. EMVCo, LLC (“EMVCo“) reserves the right to modify or replace these Terms of Use at any time and in EMVCo’s sole discretion.
EMVCo will indicate at the top of these Terms of Use the date such document was last updated. Any changes will be effective immediately upon posting the revised version on the Site (or such later effective date as may be indicated at the top of the revised Terms of Use). Your continued use of the Site or Site Materials following the posting of any changes to these Terms of Use will constitute your acceptance of such changes. If you do not agree to the changes, you must stop using the Site and Site Materials. In addition, EMVCo may provide other methods by which you may accept or receive notice of these Terms of Use or changes to these Terms of Use.
In these Terms of Use, “EMV Products” means products or services that are designed to comply with the EMV Specifications. The foregoing license applies retroactively to include activities prior to the date you agreed to these Terms of Use, but is granted solely under the intellectual property rights that EMVCo owns or has the right to license. To the extent the foregoing license includes rights to a third party’s patents, the license is limited to those patents or patent claims that would be necessarily infringed by an entity implementing the mandatory or optional requirements of the EMV Specifications.
And after the cover page of each copy of a translation, the following (or a substantially similar notice) must be printed:
Notwithstanding the foregoing, the Public Documents may be subject to a separate agreement you may have with EMVCo or to supplemental terms and conditions that are included in or accompany Public Documents, in which case you agree that such separate agreement or supplemental terms and conditions will apply to your use of the Public Documents. Any use of the Site or Site Materials other than as specifically authorized herein (or in such separate agreement or supplemental terms and conditions) is strictly prohibited and will automatically terminate the foregoing license without notice.
EMVCo's new website and Participant Dashboard are now live. To access your account for the first time on our new website you'll need to carry out a password reset here. You will then be sent an email to reset your password.
EMVCo Associates, Subscribers and public users of emvco.com can create accounts to manage their engagement and participation with EMVCo. Using your EMVCo account, you can create your own watchlist of EMV technologies documents, monitor queries and responses, and manage your profile.