3-D Secure 2.0 What Merchants Need to Know Hap Huynh, Visa, Sr. Director- Risk and Authentication Products Mark Hey, Mastercard, Director of Product Management Arvind Ronta, Discover, Global Head of Products Ian Poole, CardinalCommerce, Director of Technical Product Management

3-D Secure 2.0 3DS Evolution 2.0 Highlights and Improvements Network Updates and Enhancements What do merchants need to do? Q & A

3-D Secure Evolution 1999- Visa introduced 3DS protocol 2002- Visa began licensing the 3DS protocol to other card networks and become global standard for online authentication 2014- Visa and Mastercard developed and contributed a draft of the 3DS 2.0 specs to EMVCo 1.0 primarily PC based Static passwords and step up challenges for most transactions High friction and abandonment

3DS 2.0 Aim to improved user experience & increase approvals Removal of Activation During Shopping Reduced number of messages required Reduction in checkout time Move towards risk-based authentication/challenge only the riskiest transactions Increase use of dynamic one-time passwords Device agnostic Mobile/App-based authentication support Digital Wallet, Non-payment-based authentication Increase data exchange between the merchant and issuer to enhance risk- based authentication Payment-related data Non-payment related data

1.0 vs 2.0 What will my customer’s experience look like? Does it work for mobile, web or app? How long does it take to authenticate the customer?

3DS 2.0 Mobile or Merchant App Frictionless Flow Cardholder selects product from the Merchant App Cardholder enters payment details and checks out 3DS Requestor App communicates with 3DS Server which communicates with the ACS The ACS authenticated via risk-based decisioning and no challenge required

3DS 2.0 Mobile or Merchant (OTP)One Time Passcode Cardholder selects product from the Merchant App Cardholder enters payment details and checks out 3DS Requestor App communicates with 3DS Server which communicates with the ACS Cardholder receives and enters the OTP via an SMS OTP entered is communicated with the ACS for validation The ACS authenticates and communicates back to the 3DS requestor application

2.0 is Data-Driven – Here’s Why Issuers are making a risk assessment and authentication decision without a re-directing the consumer to the ACS Merchant’s will have control over friction-less and challenge flows Merchant’s can run 3DS 2.0 on all devices and shopping channels Passing data earlier benefits the merchant and issuer when deciding to authenticate a transaction Data benefits issuers and merchants 1.0.2 and 2.0 will co-exist

Questions for the panel How is 2.0 different than what is available now? Does it expand to app-based transactions? Will there be a specification for non-payment transactions

Network Insight Why is authentication important in the digital world? How are the 2.0 changes beneficial? What do the Networks like about 2.0 & why should merchants care?

3DS 2.0 Panel Hap Huynh, Visa, Sr. Director- Risk and Authentication Products Mark Hey, Mastercard, Director of Product Management Arvind Ronta, Discover, Global Head of Products Ian Poole, CardinalCommerce, Director of Technical Product Management If you have any questions about the presentation, go to our LinkedIn Group (the Payments Education Forum) and request an invitation (this is a closed group specifically for the payments industry).