How EMV 3-D Secure protocol adoption will benefit the entire e-commerce ecosystem

The original release of 3-D Secure by the credit card networks took place in 1999 with the intention of combating online card fraud. The protocol was referred to as 3-D Secure 1 and mandated an additional security layer prior to the authorisation of an online transaction. However, it was not uniformly well received.

“Merchants have been resistant to adopting EMV 3-D Secure (sometimes referred to as 3-D Secure 2) due to the friction that the first version of the protocol added to their e-commerce experience. While the first version was rolled out with the best of intentions, outdated authentication mechanisms and prompts led to user frustration and high cart abandonment rates as well as false declines,” explains Konrad Karczmarczyk, business development manager at Entersekt. “As e-commerce booms in South Africa, it has become more important than ever to depend on improved security – but in a way that doesn’t diminish the user experience.”

Karczmarczyk explains that with the new EMV 3-D Secure version, the card issuing bank completes the consumer verification steps in a matter of seconds and informs the merchant whether the payment can be authorised or not. This exchange of data between merchants using EMV 3-D Secure and a card issuing bank to authenticate a cardholder, together with Strong Customer Authentication (SCA), is designed to significantly reduce the risk of fraud and improve check-out experiences.

What’s more, the amount of data for merchants to send to issuers has increased from the 15 fields supported by the first version of 3-D Secure (which made it difficult to get a clear picture of the user) to over 150 data fields in new EMV 3-D Secure and is designed to improve the consumer experience by enabling intelligent risk-based authentication and reducing the number of false declines – a real pain point of the first version and reckoned to cost the industry billions of dollars in lost card-not-present sales. Quite simply, the more information that is shared, the more accurate the transactional risk assessment is.

However, some merchants have been reluctant to share so much of their customer data which they see as an asset and are questioning why the banks need it.

“It’s really important for everyone to understand that the sharing of information and data by the merchant serves to drive down false declines, and with the banks better able to control the user experience, they now have more tools to reduce cart abandonment. By sharing more data you will ensure faster processing and more accurate assessments and thereby enable a better customer experience and an increase in sales. It’s in everyone’s interest to share the data and reap the rewards,” Karczmarczyk explains.

While EMV 3-D Secure is now mandatory for European merchants selling to EU citizens, the path to adoption in South Africa has not been a wholly seamless affair.

“There seems to be a fair amount of leniency in terms of deadlines from card networks on the deployment of the EMV 3-D Secure protocol. September 2020 was the scheduled date for South Africa implementation, but this has been pushed out to the latter part of 2021, which may see card networks enforce penalties for not implementing the protocol beyond the new deadline,” he warns.

Perhaps one of the biggest benefits to merchants adopting the new 3-D Secure protocol, and a reason for its swift adoption, is that the fraud liability would shift from the merchant to the issuing bank. While it would mean that the merchant would have to provide the bank with the required amount of data in order to qualify for the benefit, this liability shift alone would make it worth their while.

“At the end of the day, merchants aren’t being forced to use EMV 3-D Secure, but when applied together with the banks, payment gateways and the rest of the broader e-commerce ecosystem, the benefits of working together to get the new protocol up and running is in everyone’s interest – not least of all the customers’,” Karczmarczyk says.