3DS (3-Domain Secure) is an online transaction authentication protocol launched by international card schemes and issuing banks to enhance the security of cardholder online payments. In recent years, with the proliferation of e-commerce and the shift from PCs to diverse mobile devices, credit card transaction security authentication mechanisms have also evolved. Under diversified e-commerce environments, international card organizations submitted the 3DS authentication mechanism to EMVCo to establish an industry standard. EMV officially released the 3DS 2.0 specification in October 2016, which has been adopted by major international card schemes including Visa, MasterCard, UnionPay, JCB, American Express, and Discover. We recommend you to implement this protocol to comply with authentication regulations such as PSD2 SCA (Strong Customer Authentication requirements for online payments in the European Economic Area) and other identity verification regulations, while also benefiting from liability shift rules. Its advantages include: - Risk transaction protection: Effectively reduces fraudulent transaction and chargeback rates through the 3DS authentication mechanism.
- Liability shift mechanism: For potential chargeback transactions, liability can be transferred to the issuing bank.
- Cross-platform support: Supports 3DS authentication processes on both PC and mobile devices.
- Diverse authentication methods: Supports multiple authentication modes such as challenge flow and frictionless flow, significantly improving 3DS authentication success rates.
Antom 3DS authentication solutions
You can purchase Antom's risk control service to automatically determine whether to trigger 3DS authentication, or you can independently decide based on order risk, chargeback rates, and regional compliance requirements. Specific triggering logic is as follows:
- If you have purchased the Antom Shield service, no manual parameter configuration is required. Antom will intelligently decide whether to initiate 3DS authentication for each transaction based on real-time risk assessment models, transaction characteristics, and historical data, aiming to strike an optimal balance between security and conversion rates. For more details, refer to Antom Shield.
- If you have robust risk control capabilities, you can manually configure Antom’s 3DS authentication strategy based on transaction risk:
- For high-risk transactions, set is3DSAuthentication to
true
. Antom will always initiate 3DS transactions, and the value of the authenticationUpgrade parameter will be ignored. - If you set is3DSAuthentication to
false
, Antom will prioritize non-3DS transactions. In this scenario, the value of authenticationUpgrade determines the subsequent process if the transaction is declined by the issuer:
true
: Default value. If the transaction is soft-declined due to authentication requirements, Antom will automatically upgrade it to a 3DS transaction and retry. For more information, see Antom 3DS-Retry.false
: If the transaction fails, Antom will directly return the failure result without retrying.
- If you use a third-party 3DS service, you must pass the 3DS authentication result to Antom for liability shift. Additionally, set both is3DSAuthentication and authenticationUpgrade to
false
to disable Antom’s 3DS authentication. Currently, only server-to-server card integration supports the use of third-party 3DS services.
Common questions
Q: If I do not set the is3DSAuthentication parameter, will Antom decide whether to initiate a 3DS transaction on my behalf?
A: No. If the is3DSAuthentication parameter is not set, non-3DS transactions will be initiated by default, which may expose you to risks such as card fraud and chargebacks. Only after purchasing the Antom Shield service will Antom’s risk control model automatically determine whether to initiate 3DS authentication. In such cases, you do not need to set the is3DSAuthentication parameter. The following table illustrates the 3DS modes supported by different integration options:
3DS 2.0 authentication includes two modes: challenge flow and frictionless flow. Antom automatically determines the optimal mode based on risk level and the specific payment scenario. Below is the user experience for each mode:
Note: If you use a third-party 3DS service, no frontend page is involved. You must pass the 3DS authentication results obtained from the third-party provider to Antom though API.
You can choose to use Antom's risk control capabilities or make independent decisions regarding 3DS authentication based on your business needs:
Antom 3DS service & risk control
Recommended
If you have purchased Antom Shield, Antom will provide fraud protection services and decide whether to initiate 3DS authentication: - Antom Shield Pro: Configure custom risk control rules on the platform, and Antom will automatically decide whether to trigger 3DS authentication based on your rules.
- Antom Shield Premium: Antom’s risk control expert team makes real-time decisions on whether to initiate 3DS authentication for each transaction.
This mode ensures compliance with specific market regulations while reducing chargeback rates and improving payment success rates. The following figure illustrates the payment flow under this mode:
If you have robust risk control capabilities or use a third-party risk control service, you can independently decide whether to enable 3DS authentication based on order risk, chargeback rates, and regional compliance requirements. The following figure illustrates the payment flow under this mode:
After the buyer initiates a payment, you determine whether to trigger 3DS authentication based on order risk by configuring the availablePaymentMethod.paymentMethodMetaData.is3DSAuthentication parameter in the createPaymentSession (One-time Payments) request: - For high-risk orders, set is3DSAuthentication to
true
, Antom will initiate 3DS transactions. - For low-risk orders, set is3DSAuthentication to
false
, Antom will initiate non-3DS transactions by default. Additionally, Antom will decide whether to upgrade non-3DS transactions to 3DS based on the value of enableAuthenticationUpgrade (default value: true
, which allows non-3DS transactions to be upgraded to 3DS transactions).
Note: Some regions (e.g., Europe, Japan) have specific 3DS compliance rules. Consult Antom Technical Support to confirm the applicable 3DS requirements.
- For high-risk transactions, set is3DSAuthentication to
true
in the createPaymentSession (One-time Payments) request to ensure Antom initiates 3DS transactions:
{
...
"availablePaymentMethod": {
"paymentMethodMetaData": {
"is3DSAuthentication": true
}
},
...
}
- If you set to initiate 3DS authentication, after the buyer completes the 3DS verification and the payment, Antom will send an asynchronous notification to you through the notifyPayment API. The paymentResultInfo.threeDSResult parameter in the asynchronous notification returns the corresponding 3DS information:
{
...
"paymentResultInfo": {
...
"threeDSResult": {
"cavv": "kB**************************",
"challengeCancel": "",
"challenged": true,
"dsTransactionId": "7ab0a8ad-*******-eed10f4b772",
"eci": "02",
"threeDSOffered": true,
"threeDSVersion": "2.2.0",
"threeDStransactionStatusReason": ""
},
"useAccountUpdate": false
},
...
}
You can choose to use Antom's risk control capabilities or make independent decisions regarding 3DS authentication based on your business needs:
Antom 3DS service & risk control
Recommended
If you have purchased Antom Shield, Antom will provide fraud protection services and decide whether to initiate 3DS authentication: - Antom Shield Pro: Configure custom risk control rules on the platform, and Antom will automatically decide whether to trigger 3DS authentication based on your rules.
- Antom Shield Premium: Antom’s risk control expert team makes real-time decisions on whether to initiate 3DS authentication for each transaction.
This mode ensures compliance with specific market regulations while reducing chargeback rates and improving payment success rates. The following figure illustrates the payment flow under this mode:
If you have robust risk control capabilities or use a third-party risk control service, you can independently decide whether to enable 3DS authentication based on order risk, chargeback rates, and regional compliance requirements. The following figure illustrates the payment flow under this mode:
After the buyer initiates a payment, you determine whether to trigger 3DS authentication based on order risk by configuring the availablePaymentMethod.paymentMethodMetaData.is3DSAuthentication parameter in the createPaymentSession (One-time Payments) request: - For high-risk orders, set is3DSAuthentication to
true
, Antom will initiate 3DS transactions. - For low-risk orders, set is3DSAuthentication to
false
, Antom will initiate non-3DS transactions by default. Additionally, Antom will decide whether to upgrade non-3DS transactions to 3DS based on the value of enableAuthenticationUpgrade (default value: true
, which allows non-3DS transactions to be upgraded to 3DS transactions).
Note: Some regions (e.g., Europe, Japan) have specific 3DS compliance rules. Consult Antom Technical Support to confirm the applicable 3DS requirements.
- For high-risk transactions, set is3DSAuthentication to
true
in the createPaymentSession (One-time Payments) request to ensure Antom initiates 3DS transactions:
{
...
"availablePaymentMethod": {
"paymentMethodMetaData": {
"is3DSAuthentication": true
}
},
...
}
- If you set to initiate 3DS authentication, after the buyer completes the 3DS verification and the payment, Antom will send an asynchronous notification to you through the notifyPayment API. The paymentResultInfo.threeDSResult parameter in the asynchronous notification returns the corresponding 3DS information:
{
...
"paymentResultInfo": {
...
"threeDSResult": {
"cavv": "kB**************************",
"challengeCancel": "",
"challenged": true,
"dsTransactionId": "7ab0a8ad-*******-eed10f4b772",
"eci": "02",
"threeDSOffered": true,
"threeDSVersion": "2.2.0",
"threeDStransactionStatusReason": ""
},
"useAccountUpdate": false
},
...
}
You can choose to use Antom's risk control capabilities or make independent decisions regarding 3DS authentication based on your business needs:
Antom 3DS service & risk control
Recommended
If you have purchased Antom Shield, Antom will provide fraud protection services and decide whether to initiate 3DS authentication: - Antom Shield Pro: Configure custom risk control rules on the platform, and Antom will automatically decide whether to trigger 3DS authentication based on your rules.
- Antom Shield Premium: Antom’s risk control expert team makes real-time decisions on whether to initiate 3DS authentication for each transaction.
This mode ensures compliance with specific market regulations while reducing chargeback rates and improving payment success rates. The following figure illustrates the payment flow under this mode:
After the buyer initiates a payment, Antom's risk control model will automatically determine whether to trigger 3DS authentication, without the need for manual configuration of the is3DSAuthentication parameter. You only need to specify paymentMethodType as CARD
in the pay (One-time Payments) request. The following sample code shows the scenario where Antom's risk model decides to initiate a 3DS transaction: "paymentMethod":
{
"paymentMethodMetaData": {
},
"paymentMethodType": "CARD"
}
If you have robust risk control capabilities or use a third-party risk control service, you can independently decide whether to enable 3DS authentication based on order risk, chargeback rates, and regional compliance requirements. The following figure illustrates the payment flow under this mode:
After the buyer initiates a payment, you determine whether to trigger 3DS authentication based on order risk by configuring the availablePaymentMethod.paymentMethodMetaData.is3DSAuthentication parameter in the pay (One-time Payments) request: - For high-risk orders, set is3DSAuthentication to
true
, Antom will initiate 3DS transactions. - For low-risk orders, set is3DSAuthentication to
false
, Antom will initiate non-3DS transactions by default. Additionally, Antom will decide whether to upgrade non-3DS transactions to 3DS based on the value of enableAuthenticationUpgrade (default value: true
, which allows non-3DS transactions to be upgraded to 3DS transactions).
Note: Some regions (e.g., Europe, Japan) have specific 3DS compliance rules. Consult Antom Technical Support to confirm the applicable 3DS requirements.
"paymentMethod":
{
"paymentMethodMetaData":
{
"is3DSAuthentication": true
},
"paymentMethodType": "CARD"
}
If you set to initiate 3DS transactions, after the buyer completes the 3DS verification and the payment, Antom will send an asynchronous notification to you through the notifyPayment API. The paymentResultInfo.threeDSResult parameter in the asynchronous notification returns the corresponding 3DS information: {
"paymentResultInfo": {
"cardBrand": "VISA",
"cardNo": "**********9954",
"funding": "DEBIT",
"issuingCountry": "DE",
"paymentMethodRegion": "DE",
"threeDSResult": {
"cavv": "AJkBCVSAkwAAAABkcCCQdAAA****",
"dsTransactionId": "e39d744b-b3af-4e0f-9141-c74d1979****",
"eci": "05",
"threeDSVersion": "2.1.0",
"threeDSOffered":true
}
},
"notifyType": "PAYMENT_RESULT",
"paymentAmount": {
"currency": "EUR",
"value": "30000"
},
"paymentCreateTime": "2023-01-09T22:07:22-08:00",
"paymentId": "2023011019401080010018892020491****",
"paymentRequestId": "20230110140713pay_req_APM_evie126396****",
"paymentTime": "2023-01-09T22:07:34-08:00",
"result": {
"resultCode": "SUCCESS",
"resultMessage": "success.",
"resultStatus": "S"
}
}
You can choose whether to use Antom 3DS and Antom's risk control capabilities based on your business needs, including the following three modes:
Antom 3DS service & risk control
Recommended
If you have purchased Antom Shield, Antom will provide fraud protection services and decide whether to initiate 3DS authentication: - Antom Shield Pro: Configure custom risk control rules on the platform, and Antom will automatically decide whether to trigger 3DS authentication based on your rules.
- Antom Shield Premium: Antom’s risk control expert team makes real-time decisions on whether to initiate 3DS authentication for each transaction.
This mode ensures compliance with specific market regulations while reducing chargeback rates and improving payment success rates. The following figure illustrates the payment flow under this mode:
After the buyer initiates a payment, Antom's risk control model will automatically determine whether to trigger 3DS authentication, eliminating the need for manual configuration of the is3DSAuthentication parameter.
You only need to pass in card information and specify paymentMethodType as CARD
in the pay (One-time Payments) request. The following sample code shows the scenario where Antom's risk model decides to initiate a 3DS transaction: "paymentMethod":
{
"paymentMethodMetaData":
{
"cvv": "682",
"expiryMonth": "11",
"expiryYear": "28",
"cardNo": "411227******9954"
},
"paymentMethodType": "CARD"
}
If Antom decides to initiate a 3DS transaction and the buyer successfully completes 3DS authentication and payment, Antom will send an asynchronous notification to you through the notifyPayment API. The paymentResultInfo.threeDSResult parameter in the asynchronous notification returns the corresponding 3DS information: Note: You can determine whether Antom 3DS service was used for the transaction by checking the value of the threeDSOffered parameter in the asynchronous notification. If threeDSOffered is true
, it indicates that this transaction used Antom 3DS service. {
...
"paymentResultInfo": {
...
"threeDSResult": {
"cavv": "kB**************************",
"challengeCancel": "",
"challenged": true,
"dsTransactionId": "7ab0a8ad-*******-eed10f4b772",
"eci": "02",
"threeDSOffered": true,
"threeDSVersion": "2.2.0",
"threeDStransactionStatusReason": ""
},
"useAccountUpdate": false
},
...
}
If you have robust risk control capabilities or have integrated a third-party risk control service, you can independently decide whether to enable 3DS authentication based on order risk, chargeback rates, and regional compliance requirements. Antom will then handle the subsequent 3DS and authorization processes while ensuring liability shift eligibility. The figure below illustrates the payment flow under this mode:
After the buyer initiates a payment, you determine whether to trigger 3DS authentication based on order risk by configuring the availablePaymentMethod.paymentMethodMetaData.is3DSAuthentication parameter in the pay (One-time Payments) request: - For high-risk orders, set is3DSAuthentication to
true
, Antom will initiate 3DS transactions. - For low-risk orders, set is3DSAuthentication to
false
, Antom will initiate non-3DS transactions by default. Additionally, Antom will decide whether to upgrade non-3DS transactions to 3DS based on the value of enableAuthenticationUpgrade (default value: true
, which allows non-3DS transactions to be upgraded to 3DS transactions).
Note: Some regions (e.g., Europe, Japan) have specific 3DS compliance rules. Consult Antom Technical Support to confirm the applicable 3DS requirements.
"paymentMethod":
{
"paymentMethodMetaData":
{
"cvv": "682",
"expiryMonth": "11",
"expiryYear": "28",
"cardNo": "411227******9954",
"is3DSAuthentication": true
},
"paymentMethodType": "CARD"
}
If you set to initiate 3DS transactions, after the buyer completes the 3DS verification and the payment, Antom will send an asynchronous notification to you through the notifyPayment API. The paymentResultInfo.threeDSResult parameter in the asynchronous notification returns the corresponding 3DS information: Note: You can determine whether Antom 3DS service was used for the transaction by checking the value of the threeDSOffered parameter in the asynchronous notification. If threeDSOffered is true
, it indicates that this transaction used Antom 3DS service. {
...
"paymentResultInfo": {
...
"threeDSResult": {
"cavv": "kB**************************",
"challengeCancel": "",
"challenged": true,
"dsTransactionId": "7ab0a8ad-*******-eed10f4b772",
"eci": "02",
"threeDSOffered": true,
"threeDSVersion": "2.2.0",
"threeDStransactionStatusReason": ""
},
"useAccountUpdate": false
},
...
}
If you use a third-party 3DS service for authentication, Antom will proceed with the authentication process. You need to pass the 3DS authentication results to Antom to qualify for liability shift. The figure below illustrates the payment flow under this mode:
After the buyer initiates payment, they complete 3DS authentication through the third-party 3DS provider. You need to pass the 3DS authentication results to Antom and set the following parameters in the pay (One-time Payments) API: - mpiData: When integrating an external 3DS service, use this parameter to specify your plugin (MPI) information. It includes the following parameters:
- threeDSVersion: The 3D Secure protocol version returned by the third-party 3DS provider.
- cavv: The Cardholder Authentication Value returned by the third-party 3DS provider.
- dsTransactionId: A unique ID returned by the third-party 3DS provider.
- eci: The Electronic Commerce Indicator (ECI) returned by the third-party 3DS provider.
- is3DSAuthentication: Since the buyer has already completed 3DS authentication, there is no need to initiate it again through Antom. Set this parameter to
false
or leave it empty. - enableAuthenticationUpgrade: Set this parameter to
false
to disable the upgrade from non-3DS transactions to 3DS transactions.
Below is sample code for completing 3DS authentication through the third-party 3DS provider:
"paymentMethodMetaData": {
"enableAuthenticationUpgrade": false,
"is3DSAuthentication": false,
"mpiData": {
"eci": "02",
"threeDSVersion": "2.2.0",
"cavv": "cavvSample",
"dsTransactionId": "sample_dsTranascti****"
},
"cvv": "850",
"cardholderName": {
"firstName": "Tom",
"lastName": "Jay"
},
"expiryMonth": "12",
"expiryYear": "29",
"cardNo": "****0615"
}
If you use a third-party 3DS service or Antom's risk control service decides not to initiate 3DS authentication, after the buyer completes payment, Antom will send an asynchronous notification to you through the notifyPayment API. In this case, the asynchronous notification will not include 3DS result information, and the value of threeDSOffered is false
: {
...
"paymentResultInfo": {
...
"threeDSResult": {
"cavv": "",
"challengeCancel": "",
"challenged": false,
"eci": "",
"threeDSOffered": false,
"threeDStransactionStatusReason": ""
},
"useAccountUpdate": false
},
...
}
You can choose to use Antom's risk control capabilities or make independent decisions regarding 3DS authentication based on your business needs:
Antom 3DS service & risk control
Recommended
If you have purchased Antom Shield, Antom will provide fraud protection services and decide whether to initiate 3DS authentication: - Antom Shield Pro: Configure custom risk control rules on the platform, and Antom will automatically decide whether to trigger 3DS authentication based on your rules.
- Antom Shield Premium: Antom’s risk control expert team makes real-time decisions on whether to initiate 3DS authentication for each transaction.
This mode ensures compliance with specific market regulations while reducing chargeback rates and improving payment success rates. The following figure illustrates the payment flow under this mode:
If you have robust risk control capabilities or use a third-party risk control service, you can independently decide whether to enable 3DS authentication based on order risk, chargeback rates, and regional compliance requirements. The following figure illustrates the payment flow under this mode:
After the buyer initiates a payment, you determine whether to trigger 3DS authentication based on order risk by configuring the availablePaymentMethod.paymentMethodMetaData.is3DSAuthentication parameter in the createPaymentSession (One-time Payments) request: - For high-risk orders, set is3DSAuthentication to
true
, Antom will initiate 3DS transactions. - For low-risk orders, set is3DSAuthentication to
false
, Antom will initiate non-3DS transactions by default. Additionally, Antom will decide whether to upgrade non-3DS transactions to 3DS based on the value of enableAuthenticationUpgrade (default value: true
, which allows non-3DS transactions to be upgraded to 3DS transactions).
Note: Some regions (e.g., Europe, Japan) have specific 3DS compliance rules. Consult Antom Technical Support to confirm the applicable 3DS requirements.
- For high-risk transactions, set is3DSAuthentication to
true
in the createPaymentSession (One-time Payments) request to ensure Antom initiates 3DS transactions:
{
...
"availablePaymentMethod": {
"paymentMethodMetaData": {
"is3DSAuthentication": true
}
},
...
}
- If you set to initiate 3DS authentication, after the buyer completes the 3DS verification and the payment, Antom will send an asynchronous notification to you through the notifyPayment API. The paymentResultInfo.threeDSResult parameter in the asynchronous notification returns the corresponding 3DS information:
{
...
"paymentResultInfo": {
...
"threeDSResult": {
"cavv": "kB**************************",
"challengeCancel": "",
"challenged": true,
"dsTransactionId": "7ab0a8ad-*******-eed10f4b772",
"eci": "02",
"threeDSOffered": true,
"threeDSVersion": "2.2.0",
"threeDStransactionStatusReason": ""
},
"useAccountUpdate": false
},
...
}
