Introduction

Issuing and acquiring institutions are now enforcing Strong Customer Authentication (SCA) as part of the MIT/COF Mandate from the following dates:

• January 2021 for all EU countries other than Ireland.
• March 8, 2022 for Ireland.
• March 14, 2022 for the United Kingdom.

For both financial transactions and non-financial transactions (Zero Value Authorization / Account Verification), the initial Customer-Initiated Transaction (CIT) used as part of the Establishment of the Relationship now requires complete authentication of the customer through Payer Authentication.

Depending on how you intend to use the token or Network Transaction ID, saved from auth_payment_network_transaction_id, the following scenarios apply.

Scenarios

Scenario 1: Token Used Only for CIT Transactions

If you intend to use your token only for CIT transactions, where the customer initiates the transaction, you may use Payer Authentication during the Establishment of the Relationship.

Scenario 2: Token Used for MIT Transactions

If you intend to use your token for Merchant-Initiated Transactions (MIT), you must use Payer Authentication during the Establishment of the Relationship.

Impact of Non-Compliance

Failure to comply may result in an increase in soft declines and hard declines, including:

• Reason Code 478 — Strong Customer Authentication Required, a soft decline.
• Reason Code 203 — General Decline by the Processor, a hard decline.

Summary

• If the Establishment of the Relationship was performed without Payer Authentication, you should expect to receive a decline from the issuer.
• If the Establishment of the Relationship was performed with Payer Authentication, you may use your token or Network Transaction ID for both CIT and MIT transactions.

Payer Authentication Customer Experiences

Payer Authentication provides three types of customer experiences.

Frictionless

In a frictionless experience, the issuer does not require a step-up challenge for the customer.

The customer will not see any Payer Authentication windows during checkout.

You can identify a successful frictionless authentication in the Business Center by seeing a Payer Authentication Enrollment call in green with the following values:

• pa_enroll.reason_code=100
• pa_enroll_eci=05 or pa_enroll_eci=02

Step-Up Frictionless

In a step-up frictionless experience, the issuer requests a step-up but does not ultimately send a One-Time Password (OTP) to the customer.

The customer will see a Payer Authentication window but will not ultimately be challenged.

You can identify a successful step-up frictionless authentication in the Business Center by seeing a Payer Authentication Validation in green with the following values:

• pa_validate.reason_code=100
• pa_validate_eci=05 or pa_validate_eci=02

Step-Up Challenged

In a step-up challenged experience, the issuer requests a step-up and sends a One-Time Password (OTP) to the customer.

The customer will see a Payer Authentication window and will be prompted to enter the One-Time Password.

You can identify a successful step-up challenged authentication in the Business Center by seeing a Payer Authentication Validation in green with the following values:

• pa_validate.reason_code=100
• pa_validate_eci=05 or pa_validate_eci=02

Recommended Challenge Code

To minimize issuer declines, it is recommended that you pass the following field in your Payer Authentication Enrollment requests:

If you do not pass this field, the step-up challenge will not be enforced to the issuer. The issuer may then decline your CIT Establishment of the Relationship transaction and subsequent MIT transactions if the original transaction was processed as Frictionless or Step-Up Frictionless.

In this scenario, some issuers may decline the transaction because of insufficient authentication, even if the customer successfully completed the Payer Authentication pipeline.

Potential Client Questions

• Why am I receiving a Reason Code 478 or Reason Code 203 even though my transaction was authenticated?
  • If the Establishment of the Relationship was performed without Payer Authentication, the issuer will likely decline the transaction. Additionally, if the challenge code was not passed during enrollment, some issuers may decline the transaction due to insufficient authentication, even when the customer successfully completed the Payer Authentication pipeline.
• When did Strong Customer Authentication enforcement begin?
  • Enforcement began in January 2021 for all EU countries other than Ireland, March 8, 2022 for Ireland, and March 14, 2022 for the United Kingdom.
• Do I need to use Payer Authentication if I only use my token for CIT transactions?
  • You may use Payer Authentication during the Establishment of the Relationship if your token will only be used for CIT transactions.
• Do I need to use Payer Authentication if I plan to use my token for MIT transactions?
  • Yes. You must use Payer Authentication during the Establishment of the Relationship if you intend to use the token for Merchant-Initiated Transactions.
• How can I tell if my Payer Authentication was successful?
  • You can verify successful authentication in the Business Center. A frictionless authentication shows a green Payer Authentication Enrollment call with pa_enroll.reason_code=100 and pa_enroll_eci=05 or 02. Step-up frictionless and step-up challenged authentications show a green Payer Authentication Validation with pa_validate.reason_code=100 and pa_validate_eci=05 or 02.
• What field should I pass to minimize issuer declines?
  • Pass the challenge code field =04 in your Payer Authentication Enrollment request. The exact field name varies by integration method (REST API, SCMP API, Simple Order API, or Secure Acceptance Hosted Checkout / Checkout API).
• What happens if I do not pass the challenge code?
  • If the challenge code is not passed, the step-up challenge will not be enforced to the issuer. The issuer may decline the CIT Establishment of the Relationship transaction and subsequent MIT transactions if the original transaction was processed as Frictionless or Step-Up Frictionless.