Trust List Flow and Data

Preconditions

The ACS has a Trust List Management System and can display the Trust List prompt/screen to the Cardholder during a 3DS challenge.

Optional: The ACS indicates support of the Trust List in the Card Range Data (ACS Information Indicator – 04 = Trust List Supported).

Note: The ACS uses some or all of the merchant information (Merchant Name, 3DS Requestor Name, 3DS Requestor ID) to manage the Trust List. Therefore, it is essential that the Merchant and/or the 3DS Server provide consistent merchant information across the Trust List enrolment and subsequent transactions.

Sequence Diagram

The Cardholder enrols a Merchant on their Trust List that is managed by the Issuer/ACS.

  1. The Cardholder makes a purchase and proceeds to checkout.
  2. The 3DS Requestor/3DS Server may:
    1. Check if the ACS supports the Trust List by confirming that ACS Information Indicator = 04 (Trust List Supported)
    2. Set the 3DS Requestor Challenge Indicator to 09 (= Challenge requested – Trust List prompt requested if challenge required) in the Authentication Request (AReq) message to indicate to the ACS that it should prompt for the Trust List during the challenge.
  3. The 3DS Server sends the AReq message.
  4. The ACS responds with an Authentication Response (ARes) message requesting a challenge.
  5. The 3DS Server proceeds with the challenge.
  6. The ACS proceeds with the challenge and provides the prompt for the Trust List option.
  7. The Cardholder completes the challenge and accepts the Trust List option (enrols the Merchant on the Trust List).
  8. The ACS provides the outcome of the authentication in a Results Request (RReq) message, and optionally the Trust List Status using the Trust List Status and the Trust List Status Source.

In a subsequent transaction with the same Cardholder and Merchant:

  1. The Cardholder makes a purchase and proceeds to checkout.
  2. The 3DS Requestor/3DS Server may:
    1. Check the Trust List Status of the Cardholder.
    2. Check if the ACS supports the Trust List exemption by confirming that ACS Information Indicator = 09 (Trust List Exemption Supported)
    3. Set the 3DS Requestor Challenge Indicator to 08 (= No challenge requested – use Trust List exemption if no challenge required) in the AReq message. 
  3. The 3DS Server sends the AReq message.
  4. As a result of the risk assessment, the ACS may apply the Trust List exemption, and may report it in the Transaction Challenge Exemption (= 08) in an ARes message.
Note: Step 6. CReq/CRes: refer to Trust List templates for the user interface.

3DS Data Elements Related to the Trust List

The table below lists the data elements that may be provided in relation to the Trust List.

Table 2.5: 3DS Data Elements Related to the Trust List

Data Element

Description

Version

3DS Requestor Challenge Indicator

Indicates whether a challenge is requested for this transaction.

2.3.1

2.2

3RI Indicator

Indicates the type of 3RI request.

This data element provides additional information to the ACS to determine the best approach for handling a 3RI request.

A value of 10 indicates a Trust List Status check.

2.3.1

2.2

ACS Information Indicator

Provides additional information for a particular Protocol Version to the 3DS Server. The element lists all applicable values for the card range.

2.3.1

2.2

Card Range Data

Card range data from the DS indicating the most recent Protocol Versions supported by the ACS, and, optionally, the DS that hosts that range, and, if configured, the ACS URL for the 3DS Method. Additionally, it identifies the 3DS features supported by the ACS in the ACS Information Indicator, such as Trust List or Decoupled Authentication.

Trust List indicators are defined in the ACS Information Indicator:

  • 04 = Trust List Supported for v2.2 and v2.3
  • 09 = Trust List Exemption Supported for v2.3

2.3.1

2.2

Toggle Position Indicator

Indicates if the Trust List and/or Device Binding prompt should be presented below or above the action buttons.

2.3.1

Transaction Challenge Exemption

Exemption applied by the ACS to authenticate the transaction without requesting a challenge.

2.3.1

2.2 + Bridging Message Extension

Trust List Data Entry

Indicator provided by the 3DS SDK to the ACS to confirm whether the Cardholder gives consent to the Trust List.

2.3.1

2.2

Trust List Information Text

Text provided by the ACS to the Cardholder during a Trust List transaction.

2.3.1

2.2

Trust List Status

Enables the communication of Trust List Status between the ACS, the DS and the 3DS Requestor.

2.3.1

2.2

Trust List Status Source

This data element will be populated by the system setting Trust List Status.

2.3.1

2.2

Note: The term “Trust List” is used in version 2.3.1 of the 3DS Specification, replacing the terms “Whitelist” and “Whitelisting” used in version 2.2.

App Flow – User Interface Related to the Trust List

User Experience – Variant A – Trust List on Challenge Screen

User Experience – Variant B – Trust List on Separate Screen

Note: Checkbox, radio button or any relevant user interface may be used to offer the Trust List and Device Binding options.

User Interface Related to Device Binding

Note: Checkbox, radio button or any relevant user interface may be used to offer the Trust List and Device Binding options.

User Experience – Variant A – Device Binding

User Experience – Variant B – Device Binding

The transaction value is below a predefined threshold, so the Merchant and/or 3DS Server can request an SCA exemption.
Before sending an Authentication Request with 3DS Requestor Challenge Indicator = 10 (No challenge requested – use low value exemption), the 3DS Server may check that the ACS supports the Low-Value Exemption using ACS Information Indicator (10 = Low Value Exemption Supported).
The ACS verifies that the transaction value is below the threshold, determines that a Cardholder challenge is not necessary, and applies the Low Value Exemption. It may return Transaction Challenge Exemption = 10 (Low Value exemption) with its response.

Merchant/3DS ServerIssuer / ACS

Low Value Exemption threshold = 50 € (example)

Transaction data elements

  • Purchase Amount = 999
  • Purchase Currency = 978 (€)
  • Purchase Currency Exponent = 2
  • Purchase Date & Time = 20241118092600
  • 3DS Requestor Challenge Indicator = 10

Transaction data elements

  • Transaction Status = Y
  • Transaction Challenge Exemption = 10

The Merchant or their acquiring bank assesses the risk associated with the transaction. If the transaction risk is low (below a certain threshold), the Merchant and/or 3DS Server can request an SCA exemption.
Before sending an Authentication Request with 3DS Requestor Challenge Indicator 05 = No challenge requested – transactional risk analysis is already performed), the 3DS Server may check that the ACS supports the Transaction Risk Analysis Exemption using ACS Information Indicator (08 = Transaction Risk Analysis Exemption Supported).
The ACS determines that the Merchant/Acquirer performed the transaction risk analysis and that a Cardholder challenge is not necessary, it applies the Transaction Risk Analysis exemption. It may return Transaction Challenge Exemption = 05 (Transaction Risk Analysis exemption) with its response.

Merchant/AcquirerIssuer

The Merchant assesses that the transaction risk is low.

Transaction data elements

  • Purchase Amount = 9999
  • Purchase Currency = 978 (€)
  • Purchase Currency Exponent = 2
  • Purchase Date & Time = 20241118104200
  • 3DS Requestor Challenge Indicator = 05

Transaction data elements

  • Transaction Status = Y
  • Transaction Challenge Exemption = 05

The Merchant or the 3DS Server knows that the Merchant is listed on the Cardholder’s Trust List (refer to Section 2.2.4 for more information on the Trust List), the Merchant and/or 3DS Server can request an SCA exemption.
Before sending an Authentication Request with 3DS Requestor Challenge Indicator = 08 (No challenge requested – use Trust List exemption if no challenge required), the 3DS Server may check that the ACS supports the Trust List Exemption using ACS Information Indicator = 09 (Trust List Exemption supported).
The ACS verifies that the Merchant is on the Cardholder’s Trust List, determines that a Cardholder challenge is not necessary, and applies the Trust List exemption. It may return Transaction Challenge Exemption = 08 (Trust List exemption) with its response.

Merchant/AcquirerIssuer

The Merchant knows that it is on the Cardholder’s Trust List.

Transaction data elements

  • Purchase Amount = 9999
  • Purchase Currency = 978 (€)
  • Purchase Currency Exponent = 2
  • Purchase Date & Time = 20241118111000
  • 3DS Requestor Challenge Indicator = 08

Transaction data elements

  • Transaction Status = Y
  • Transaction Challenge Exemption = 08

The Merchant or the 3DS Server knows that the card used for the transaction is a corporate payment card (i.e., card used for business expenditures or card account used for business-to-business payments), the Merchant and/or 3DS Server can request an SCA exemption.
Before sending an authentication request with 3DS Requestor Challenge Indicator = 11 (No challenge requested – Secure corporate payment exemption), the 3DS Server may check that the ACS supports the Secure Corporate Payments Exemption using ACS Information Indicator = 11 (Secure Corporate Payments Exemption Supported).
The ACS verifies that the type of card used for the transaction, determines that a Cardholder challenge is not necessary, and applies the Secure Corporate Payments exemption. It may return Transaction.

Merchant/AcquirerIssuer

The Merchant knows that the card used for the transaction is a corporate card.

Transaction data elements

  • Purchase Amount = 9999
  • Purchase Currency = 978 (€)
  • Purchase Currency Exponent = 2
  • Purchase Date & Time = 20241118111000
  • 3DS Requestor Challenge Indicator = 11

Transaction data elements

  • Transaction Status = Y
  • Transaction Challenge Exemption = 11