Decoupled authentication is a 3DS feature that allows for an alternative authentication method when the primary authentication method (i.e., challenge) is not possible, available or fails.
In the 3DS protocol, the primary authentication method is typically the challenge flow where the Cardholder is directed to their card issuer (ACS) to complete the authentication process. However, there may be situations where the challenge is not possible or successful, for example, when:
In such cases, the Core Specification allows for a Decoupled Authentication, where the authentication process is performed separately from the payment transaction flow. While the authentication method used for Decoupled Authentication is outside the scope of this White Paper, example methods could include a text message, an email, a phone call, or a push notification to a banking app that completes authentication, and then sends the results to the ACS.
Typically, this involves the following steps:
Decoupled Authentication is applicable to all Device Channels, but it is the only authentication method available to facilitate Cardholder challenges for 3RI transactions. This helps to improve the overall user experience and reduce the risk of abandoned transactions.
Note: Although Decoupled Authentication is a 3DS challenge method, the flow may differ from the general Challenge Flow as the CReq/CRes messages are not always present.
The below table lists the data elements that may be provided by 3DS Servers and ACSs to support Decoupled Authentication.
For additional information, refer to Table A.1 in the Core Specification and to the EMV 3-D Secure Bridging Message Extension.
Table 4.4: 3DS Data Elements Related to Decoupled Authentication
Data Element |
Description |
Version |
3DS Requestor Decoupled Request Indicator |
Indicates whether the 3DSRequestor requests the ACS to use Decoupled Authentication and agrees to use Decoupled Authentication if the ACS confirms its use. |
2.3.1.1 2.2 |
3DS Requestor Decoupled Max Time |
Indicates the maximum amount of time that the 3DS Requestor will wait for an ACS to provide the results of a Decoupled Authentication transaction (in minutes). |
2.3.1.1 2.2 |
3DS Requestor Decoupled Request Indicator |
Indicates whether the 3DS Requestor requests the ACS to use Decoupled Authentication and agrees to use Decoupled Authentication if the ACS confirms its use. Note: if the element is not provided, the expected action is for the ACS to interpret as N (Do not use Decoupled Authentication). |
2.3.1.1 2.2 |
3DS Requestor Prior Transaction Authentication Information |
Information about how the 3DS Requestor authenticated the Cardholder as part of a previous 3DS transaction. Required for 3RI in the case of Decoupled Authentication Fallback or for SPC. |
2.3.1.1 2.2 |
3RI Indicator |
Indicates the type of 3RI request. This data element provides additional information to the ACS to determine the best approach for handling a 3RI request. |
2.3.1.1 2.2 |
ACS Decoupled Confirmation Indicator |
Indicates whether the ACS confirms use of Decoupled Authentication and agrees to use Decoupled Authentication to authenticate the Cardholder. |
2.3.1.1 2.2 |
Authentication Method |
Indicates the list of authentication types the Issuer will use to challenge the Cardholder, when in the ARes message or what was used by the ACS when in the RReq message. Note: For 03-3RI, only present for Decoupled Authentication. |
2.3.1.1 2.2 |
Card Range Data – ACS Information Indicator |
Provides additional information for a particular Protocol Version to the 3DS Server. The element lists all applicable values for the card range. |
2.3.1.1 2.2 |
Cardholder Information Text |
Text provided by the ACS/Issuer to Cardholder during a Frictionless or Decoupled transaction. The Issuer can provide information to Cardholder. For example, “Additional authentication is needed for this transaction, please contact (Issuer Name) at xxx-xxx-xxxx” with optionally the Issuer and Payment System images. Refer to Section A.20 in the Core Specification for UI example. |
2.3.1.1 2.2 |
Challenge Cancelation Indicator |
Indicator informing the ACS and the DS that the authentication has been cancelled. |
2.3.1.1 2.2 |
Results Message Status |
Indicates the status of the Results Request message from the 3DS Server to provide additional data to the ACS. This will indicate if the message was successfully received for further processing or will be used to provide more detail on why the Challenge could not be completed from the 3DS Client to the ACS. |
2.3.1.1 2.2 |
Transaction Status |
Indicates whether a transaction qualifies as an authenticated transaction or account verification. The Final CRes message can only contain a value of Y or N or D. Transaction Status = C or S is not allowed for Device Channel = 3RI. |
2.3.1.1 2.2 |
Transaction Status Reason |
Provides information on why the Transaction Status field has the specified value. |
2.3.1.1 2.2 |
The 3DS Requestor needs to authenticate a transaction with the Issuer, but the Cardholder is not present. This may happen in the case of:
To determine if the ACS supports Decoupled Authentication as an authentication method, the 3DS Server should refer to the ACS Information Indicator data element.
3DS Requestor-Initiated Flow
The 3DS Requestor initiates an authentication with the card issuer, the ACS assesses the risk associated with the transaction and selects Decoupled Authentication as challenge method. This may happen if:
The ACS verifies that Decoupled Authentication is supported by the 3DS Server by checking the 3DS Requestor Decoupled Request Indicator
Decoupled Authentication as a Challenge Method
During a challenge, the Cardholder or the ACS may experience technical issues that prevent its normal completion. The ACS has the option to invoke Decoupled Authentication as an alternative way to complete the challenge, as long as it is supported by the 3DS Server and the 3DS Requestor.
The Decoupled Authentication Fallback flow is identical to the Decoupled Authentication flow initiated by the Merchant, except it starts after the challenge when the ACS sends Transaction Status = D to the 3DS Requestor in an RReq message. The 3DS Server confirms its support in an RRes message (Result Message Status = 04), and then initiates a 3RI transaction with Decoupled Authentication as the challenge method.
Decoupled Authentication Fallback
Last Updated: April 17, 2020
Welcome to EMVCo. By accessing or using the EMVCo website at www.emvco.com (“Site“) or any Site Materials, whether or not you obtained them via the Site, you agree to the following Terms of Use on behalf of yourself individually and the company or organization for which you are using the Site or Site Materials (“Organization“). If you do not agree to the following Terms of Use, do not use the Site or other Site Materials.
In these Terms of Use, “Site Materials” means all email messages sent to you by EMVCo in connection with your registration on the Site or participation in an EMVCo participation program, and all content, files and other materials that are available for viewing or download on the Site, including the EMV® Specifications, requirements, guidelines, white papers or other documents, APIs, SDKs, software, scripts, code, trademarks, videos, text, graphics, pictures, information, and other materials.
You represent that either (a) you are an authorized representative of your Organization with authority to bind your Organization to these Terms of Use, in which case the term “you” refers collectively to both you individually and your Organization, or (b) you are not authorized to bind any Organization to these Terms of Use and are using the Site or Site Materials solely in your personal capacity, in which case the term “you” refers to you individually. EMVCo, LLC (“EMVCo“) reserves the right to modify or replace these Terms of Use at any time and in EMVCo’s sole discretion.
EMVCo will indicate at the top of these Terms of Use the date such document was last updated. Any changes will be effective immediately upon posting the revised version on the Site (or such later effective date as may be indicated at the top of the revised Terms of Use). Your continued use of the Site or Site Materials following the posting of any changes to these Terms of Use will constitute your acceptance of such changes. If you do not agree to the changes, you must stop using the Site and Site Materials. In addition, EMVCo may provide other methods by which you may accept or receive notice of these Terms of Use or changes to these Terms of Use.
In these Terms of Use, “EMV Products” means products or services that are designed to comply with the EMV Specifications. The foregoing license applies retroactively to include activities prior to the date you agreed to these Terms of Use, but is granted solely under the intellectual property rights that EMVCo owns or has the right to license. To the extent the foregoing license includes rights to a third party’s patents, the license is limited to those patents or patent claims that would be necessarily infringed by an entity implementing the mandatory or optional requirements of the EMV Specifications.
And after the cover page of each copy of a translation, the following (or a substantially similar notice) must be printed:
Notwithstanding the foregoing, the Public Documents may be subject to a separate agreement you may have with EMVCo or to supplemental terms and conditions that are included in or accompany Public Documents, in which case you agree that such separate agreement or supplemental terms and conditions will apply to your use of the Public Documents. Any use of the Site or Site Materials other than as specifically authorized herein (or in such separate agreement or supplemental terms and conditions) is strictly prohibited and will automatically terminate the foregoing license without notice.
EMVCo's new website and Participant Dashboard are now live. To access your account for the first time on our new website you'll need to carry out a password reset here. You will then be sent an email to reset your password.
EMVCo Associates, Subscribers and public users of emvco.com can create accounts to manage their engagement and participation with EMVCo. Using your EMVCo account, you can create your own watchlist of EMV technologies documents, monitor queries and responses, and manage your profile.