The Bridging Message Extension enhances the existing 3DS version 2.2.0 specifications by enabling the implementation of features that are incorporated in the 3DS version 2.3.1.1 specification. In addition, during the migration to version 2.3.1.1, support of the Bridging Message Extension will increase consistency of the key 3DS features provided in version 2.2.0 and version 2.3.1.1.
The Bridging Message Extension covers different version 2.3.1.1 features and defines four sets of data:
Recurring Data, Challenge Data, Additional Data and File URL Data contain new data or new values for existing data in the AReq/ARes, PReq/PRes or RReq messages for version 2.2.0.
Note: As there are multiple versions of the Bridging Message Extension, the Extension Version Number must be kept the same across all message exchanges during a 3DS transaction. When responding, the recipient of the Bridging Message Extension must use the same Extension Version Number for the message pair (AReq/ARes, CReq/CRes, PReq/PRes) as the one received. If the recipient does not support that Extension Version Number, it must not include the Bridging Message Extension in its response.
Recurring Data is provided for recurring and instalment transactions. The use cases and the technical capabilities of 3DS with recurring data elements are presented in the Recurring and Installment Transactions section.
The table below lists the recurring data elements that may be provided in relation to the Bridging Message Extension.
Table 6.2: Recurring Data Elements Related to the Bridging Message Extension
Data Element/Field Name |
Description |
Version |
Recurring Amount |
Recurring amount in minor units of currency with all punctuation removed. |
2.2 |
Recurring Currency |
Currency in which the Recurring Amount is expressed. |
2.2 |
Recurring Currency Exponent |
Minor units of currency as specified in the ISO 4217 currency exponent. |
2.2 |
Recurring Date |
Effective date of the new authorised amount following the first/promotional payment in a recurring or instalment transaction. |
2.2 |
Recurring Expiry |
Date after which no further authorisations are performed. |
2.2 |
Recurring Frequency |
Indicates the minimum number of days between authorisations for a recurring or instalment transaction. |
2.2 |
Recurring Indicator
|
Indicates whether the recurring or instalment payment has a fixed or variable amount and frequency. The Recurring Indicator object contains:
|
2.2 |
Using Challenge Data, the ACS and 3DS SDK can automate switching from the 3DS Requestor App to the OOB Authentication App.
Challenge Data is only provided in CReq/CRes messages for the App-based flow when the Message Version Number is 2.2.0 (not 2.1.0).
The use cases and the technical details of switching from the 3DS Requestor App to the OOB Authentication App are presented in OOB Flow: App Channel – Automatic Switching to the OOB App section.
Note; The ACS shall implement Req 401, limited to ACS UI Type = 04, and the 3DS SDK shall implement Req 399, Req 400, Req 403, Req 404, Req 406, Req 407, Req 408 and Req 409, limited to ACS UI Type = 04 to enable automatic switching from the 3DS Requestor App to the OOB Authentication App.
Challenge Data is only supported for ACS UI Type = 04 (OOB), ACS UI Type = 06 (HTML OOB) is NOT supported.
For the Challenge Data Entry Masking, the ACS requests the Challenge Data Entry to be masked by setting Challenge Data Entry Masking to Y (limited to ACS UI Type = 01). The 3DS SDK shall implement Challenge Data Entry Masking (Figures 44 and 45, Table A.26).
The table below lists the challenge data elements that may be provided in relation to the Bridging Message Extension.
Table 6.3: Challenge Data Elements Related to the Bridging Message Extension
Data Element/Field Name |
Description |
Version |
Challenge Data Entry Masking |
Indicates that the 3DS SDK shall mask the data entered by the Cardholder. |
2.2 |
OOB App Label |
Label to be displayed for the link to the OOB App URL. |
2.2 |
OOB App Status |
Status code indicating the type of problem encountered when using the OOB App URL. |
2.2 |
OOB App URL |
Universal App Link to an authentication app used in the OOB authentication. The OOB App URL will open the appropriate location within the OOB Authentication App. |
2.2 |
OOB App URL Indicator |
Indicates if the 3DS SDK supports the OOB App URL. |
2.2 |
OOB Continuation Indicator
|
Indicator notifying the ACS that the Cardholder has selected the OOB Continuation button in an OOB authentication method, or that the 3DS SDK automatically completes without any Cardholder interaction. |
2.2 |
File URL Data is used in the PReq/PRes message when the Message Version Number is 2.2.0. If supported by both the 3DS Server and the DS, the 3DS Server downloads a file containing the Card Range data.
For additional details and processing requirements refer to Section 5.6 in version 2.3.1.1 of the Core Specification.
The table below lists the File URL data elements that may be provided in relation to the Bridging Message Extension.
Table 6.4: File URL Data Elements Related to the Bridging Message Extension
Data Element/Field Name |
Description |
Version |
Card Range Data Download Indicator
|
Indicates if the 3DS Server supports Card Range Data from a file. Note: If present, this field contains the value Y. |
2.2 |
Card Range Data File URL
|
Fully Qualified URL of the DS File containing the Card Range Data for download. Note: When the Card Range Data File URL is present, the file contains the entire Card Range Data, and the 3DS Server ignores any Card Range Data and Serial Number present in the PRes message. |
2.2 |
Using the Additional Data, the ACS, 3DS Server and DS may share additional information to improve the authentication or error reporting, indicating, for example:
Note: To provide the Challenge Cancelation Indicator, the ACS shall implement the updates to Section 5.9.5 (ACS CReq Message Error Handling—01-APP) in version 2.3.1.1 of the Core Specification.
The table below lists additional data elements that may be provided in relation to the Bridging Message Extension.
Table 6.5: Additional Data Elements Related to the Bridging Message Extension
Data Element/Field Name |
Description |
Version |
3DS Requestor App URL Indicator |
Indicates whether the OOB Authentication App used by the ACS during a challenge supports the 3DS Requestor App URL. |
2.2 |
3DS Requestor Authentication Indicator
|
Indicates the type of Authentication Request. This data element provides additional information to the ACS to determine the best approach for handling an Authentication Request. |
2.2 |
3RI Indicator |
Indicates the type of 3RI request. This data element provides additional information to the ACS to determine the best approach for handling a 3RI request. |
2.2 |
Acquirer Country Code
|
The code of the country where the acquiring institution is located (in accordance with ISO 3166-1). The DS may edit the value provided by the 3DS Server. |
2.2 |
Acquirer Country Code Source
|
This data element is populated by the system setting the Acquirer Country Code. The DS may edit the value provided by the 3DS Server. |
2.2 |
Authentication Method
|
Indicates the list of authentication types the Issuer will use to challenge the Cardholder, when in the ARes message, or what was used by the ACS, when in the RReq message. Note: For 03-3RI, only present for Decoupled Authentication. |
2.2 |
Browser Screen Color Depth |
Value representing the bit depth of the colour palette for displaying images, in bits per pixel. Obtained from the Cardholder browser using the screen.colorDepth property. Refer to Section A.6 in the Core Specification v2.3.1.1 for more details. |
2.2 |
Card Security Code |
Three- or four-digit security code printed on the card. |
2.2 |
Card Security Code Status |
Enables the communication of Card Security Code Status between the ACS, the DS and the 3DS Requestor. |
2.2 |
Card Security Code Status Source |
This data element will be populated by the system setting the Card Security Code Status. |
2.2 |
Challenge Cancelation Indicator
|
Indicator informing the ACS and the DS that the authentication has been cancelled. Note: The Additional Data object is not valid for the CReq/CRes messages. Therefore, the Challenge Cancelation Indicator may only be present in the RReq message. |
2.2 |
Challenge Error Reporting |
Copy of the Erro Message sent or received by the ACS in case of error in the CReq/CRes messages. |
2.2 |
Device Information Recognised Version |
Indicates the highest Data Version of the Device Information supported by the ACS. |
2.2 |
Transaction Challenge Exemption |
Exemption applied by the ACS to authenticate the transaction without requesting a challenge. Note: The accepted values match the values of the 3DS Requestor Challenge Indicator. |
2.2 |
Transaction Characteristics |
Indicates to the ACS specific transactions identified by the Merchant. Refer to Merchant Risk Indicator in the Core Specification v2.3.1.1 |
2.2 |
Last Updated: April 17, 2020
Welcome to EMVCo. By accessing or using the EMVCo website at www.emvco.com (“Site“) or any Site Materials, whether or not you obtained them via the Site, you agree to the following Terms of Use on behalf of yourself individually and the company or organization for which you are using the Site or Site Materials (“Organization“). If you do not agree to the following Terms of Use, do not use the Site or other Site Materials.
In these Terms of Use, “Site Materials” means all email messages sent to you by EMVCo in connection with your registration on the Site or participation in an EMVCo participation program, and all content, files and other materials that are available for viewing or download on the Site, including the EMV® Specifications, requirements, guidelines, white papers or other documents, APIs, SDKs, software, scripts, code, trademarks, videos, text, graphics, pictures, information, and other materials.
You represent that either (a) you are an authorized representative of your Organization with authority to bind your Organization to these Terms of Use, in which case the term “you” refers collectively to both you individually and your Organization, or (b) you are not authorized to bind any Organization to these Terms of Use and are using the Site or Site Materials solely in your personal capacity, in which case the term “you” refers to you individually. EMVCo, LLC (“EMVCo“) reserves the right to modify or replace these Terms of Use at any time and in EMVCo’s sole discretion.
EMVCo will indicate at the top of these Terms of Use the date such document was last updated. Any changes will be effective immediately upon posting the revised version on the Site (or such later effective date as may be indicated at the top of the revised Terms of Use). Your continued use of the Site or Site Materials following the posting of any changes to these Terms of Use will constitute your acceptance of such changes. If you do not agree to the changes, you must stop using the Site and Site Materials. In addition, EMVCo may provide other methods by which you may accept or receive notice of these Terms of Use or changes to these Terms of Use.
In these Terms of Use, “EMV Products” means products or services that are designed to comply with the EMV Specifications. The foregoing license applies retroactively to include activities prior to the date you agreed to these Terms of Use, but is granted solely under the intellectual property rights that EMVCo owns or has the right to license. To the extent the foregoing license includes rights to a third party’s patents, the license is limited to those patents or patent claims that would be necessarily infringed by an entity implementing the mandatory or optional requirements of the EMV Specifications.
And after the cover page of each copy of a translation, the following (or a substantially similar notice) must be printed:
Notwithstanding the foregoing, the Public Documents may be subject to a separate agreement you may have with EMVCo or to supplemental terms and conditions that are included in or accompany Public Documents, in which case you agree that such separate agreement or supplemental terms and conditions will apply to your use of the Public Documents. Any use of the Site or Site Materials other than as specifically authorized herein (or in such separate agreement or supplemental terms and conditions) is strictly prohibited and will automatically terminate the foregoing license without notice.
EMVCo's new website and Participant Dashboard are now live. To access your account for the first time on our new website you'll need to carry out a password reset here. You will then be sent an email to reset your password.
EMVCo Associates, Subscribers and public users of emvco.com can create accounts to manage their engagement and participation with EMVCo. Using your EMVCo account, you can create your own watchlist of EMV technologies documents, monitor queries and responses, and manage your profile.