Hello EricSLink opens in new window.
Thank you for the update. With this information about Visa and Amex cards, I took a deep dive into the technical world of 3D Secure and would like to share these insights: Datatrans uses EMV® 3D Secure (also known as 3DS 2.x) because this has been required by EU law with PSD2 (Payment Service Directive 2) since 2021 and has also been implemented in Europe by non-EU countries such as Switzerland or the UK as a global standard. Some issuers (banks) still partially rely on 3DS 1.0 or do not respond correctly to 3DS 2.x requests. Visa / Mastercard Directory Server should actually bridge this communication, but in case of compatibility problems there can be silent errors. Do all Payment Service Providers (PSPs) in Europe use 3DS 2.x (e.g., Datatrans)? Yes – all reputable and compliant PSPs in Europe today use 3D Secure 2.x (EMV 3DS). 3DS 1.0 was officially decommissioned Visa, Mastercard, and other networks have globally disabled 3D Secure 1.0. This means that new transactions with 3DS 1.0 are no longer technically possible. Although Visa and Mastercard officially discontinued support for 3D Secure 1.0 in 2022, this does not automatically mean that all issuers (banks) worldwide have fully switched to 3DS 2.x or are handling it correctly. EU law requires Strong Customer Authentication (SCA) Under the PSD2 directive, since 2021 the EU requires strong customer authentication for almost all online payments. This is only possible with 3DS 2.x. 3DS 1.0 no longer meets these requirements. Why do 3DS2 problems occur more frequently in some countries? Some issuers (banks) run older Access Control Servers (ACS), which support 3DS2 nominal, but are still technically based on old 3DS1 backends or frameworks and behave like 3DS1 gateways. Visa / Mastercard Directory Server is actually trying to mediate between 3DS2 and old ACS systems. However, this mediation (3DS bridging) does not work reliably with incompatible or incorrectly configured ACS setups of the issuers (banks). As a result, the systems may not respond correctly to modern 3DS2 requests from Europe, and such transactions are often automatically declined. In countries without PSD2/SCA regulations, 3DS2 is not mandatory, so older components remain in use. Many issuers (banks) see no economic incentive to fully modernise their systems, as migration to 3DS2 requires IT investments and coordination with networks, which causes costs and effort. Problems with obsolete or incompatible 3DS systems are particularly an issue in countries without mandatory 3DS2 regulations. In the EU, on the other hand, the standard has been mandatory since 2021. What can cardholders do when the 3D Secure process fails and the payment is declined? Option 1: Use a different card AMEX: American Express operates its own 3DS system (SafeKey), which is not tied to the Visa / Mastercard Directory servers, but runs entirely within Amex. Since Amex is an Issuer, ACS and SafeKey platform, there are hardly any bridging problems. SafeKey works the same worldwide, unlike Visa / Mastercard, where Issuer (banks) implement these solutions differently. Alternatively, try a Mastercard (e.g., from Capital One): Mastercard may offer more reliable 3DS bridging solutions between PSP and issuer than Visa. Option 2: Contact your issuer (bank) – preferably in writing: Ask whether the current card may still be connected via an outdated or only partially compatible ACS system. Ask for a card with proven EMV 3DS 2.x support, including an active Access Control Server (ACS) that can correctly receive and respond to 3DS2 requests from European Payment Service Providers (e.g. via Visa or Mastercard Directory Server). Kind regards,
Nicole