MasterCard SecureCode

MASTERCARD SECURECODE TECHNIQUE OVERVIEW

Consumer authentication techniques, such as MasterCard SecureCode, are intended to validate that the authorized credit card holder is the one actually attempting to make a purchase. The key benefit to this program for merchants is that it provides a liability shift for covered transactions.

Key considerations when implementing or buying this functionality include:

• Works only on e-commerce transactions. Merchants need to have fraud processes to handle their MOTO traffic.

• The merchant, consumer, issuer and acquiring bank must all be participating in the program. So make sure your acquiring bank is set up to support the e-commerce indicator, and check on their certification requirements.

• Merchants still need to perform other fraud checks. This tool does not cover many of the card types on the market today and there are legitimate cases in which a merchant may not be able to complete the authentication process with the consumer. Merchants also need to make sure their overall fraud rates are kept within standards.

• Companies doing little transactional volume should consider using an outsourced service bureau to perform this service.

• Make sure you are checking and providing all of the correct data points: Merchants have to mark transactions as e-commerce with the ECI, and they must check AVS, enrollment, and they need the CAVV/AVV, which shows the order was checked for enrollment. Merchants also need the XID (the unique transaction number).

• Merchants will have to get a digital certificate from MasterCard, which takes about two weeks. See the acquiring bank to get the form and start the process.

HOW DOES IT WORK?

The process used by MasterCard SecureCode to authenticate consumers is pretty simple. The consumer enrolls with the issuing bank and is given a password, PIN or device to authenticate themselves. When the consumer makes a purchase online the consumer is asked to give that password, PIN or device to authenticate. Depending on issuer implementations and mandates in certain countries, 2 Factor Authentication (2FA), a One-Time Password (OTP) or other dynamic authentication mechanisms may be required.

The purchase sequence can be broken down into five stages, first the consumer goes through the check-out procedure, the same way they do today, providing the same data fields they do today. When the buy button is pressed on their system, using the commercially available software on the market, it sends a message to MasterCard and card issuer, to find out if the consumer is participating in the SecureCode authentication program. If the consumer is participating in the program, the service will send a pop-up window to the consumer. The pop-up looks like it is coming from the consumer’s issuing bank. The pop-up asks the consumer to enter their password, OTP or PIN. The issuing bank then validates this password or PIN and returns the results to the merchant.

The benefits to merchants are that transactions covered by SecureCode shift the liability of fraud losses from the merchant to the card issuer. However, the requirements for eligible transactions can differ by region or country. In the United States, MasterCard SecureCode provides the liability shift not only for transactions where the consumer successfully authenticates, but also for transactions where merchant attempts SecureCode authentication but the consumer is not enrolled. The liability coverage expanded in October, 2011 to include transactions where the consumer is not enrolled, but this is only for U.S. domestic transactions, meaning the merchant is U.S. based and the card used was issued in the U.S.

Outside of the U.S. market only transactions where the consumer is authenticated with MasterCard SecureCode are eligible for the liability shift. Additionally, only certain chargeback reason codes are covered:

• Reason Code 4837 - No Cardholder Authorization

• Reason Code 4863 - Cardholder Does Not Recognize/Potential Fraud

Several countries have mandates related to 3-D Secure and MasterCard SecureCode. For all of Europe, merchants that want to be able to accept Maestro debit online must support MasterCard SecureCode to do so. In Singapore, all 3-D Secure implementations must use a dynamic One Time Password (OTP).

HOW DO YOU USE THE RESULTS?

When using this technology you should implement the following with MasterCard orders:

For orders in which the consumer is participating in the program, the order type is a covered type, and the consumer successfully authenticates, accept the order.

For orders in which the consumer is not participating in the program, the order type is a covered type, the merchant has checked for enrollment, and the order characteristics are within their normal order tolerances, accept the order.

For orders in which the consumer is not participating in the program, the order type is a covered type, the merchant has checked for enrollment, and the order characteristics are not in-line with their normal orders, review the order or perform further fraud checks favoring sales conversion.

For orders in which the consumer is participating in the program, cannot successfully authenticate and the order characteristics are in line with their normal orders; perform other fraud-screening checks or manually review the order favoring risk aversion.

For non-covered orders perform traditional checks.