Verified by Visa Acquirer and Merchant Implementation Guide U.S. Region May 2011 Verified by Visa Acquirer and Merchant Implementation Guide U.S. Region May 2011 May 2011 VISA PUBLIC © 2011 Visa. All Rights Reserved. DISCLAIMER: THE RECOMMENDATIONS CONTAINED HEREIN ARE INTENDED FOR INFORMATIONAL PURPOSES ONLY AND SHOULD NOT BE RELIED UPON FOR MARKETING, LEGAL, TECHNICAL, TAX, FINANCIAL OR OTHER ADVICE. WHEN IMPLEMENTING ANY NEW STRATEGY OR PRACTICE, YOU SHOULD CONSULT WITH YOUR LEGAL COUNSEL TO DETERMINE WHAT LAWS AND REGULATIONS MAY APPLY TO YOUR SPECIFIC CIRCUMSTANCES. THE ACTUAL COSTS, SAVINGS AND BENEFITS OF THE VERIFIED BY VISA SERVICE MAY VARY BASED UPON YOUR SPECIFIC BUSINESS NEEDS AND PROGRAM REQUIREMENTS. PLEASE NOTE THAT THAT VISA MAKES NO REPRESENTATIONS AND WARRANTIES AS TO THE INFORMATION CONTAINED HEREIN AND MEMBER IS SOLELY RESPONSIBLE FOR ANY USE OF THE INFORMATION IN THIS PRESENTATION IN CONNECTION WITH ITS CARD PROGRAMS. THIS DOCUMENT IS PROVIDED ON AN “AS IS”, “WHERE IS” BASIS, “WITH ALL FAULTS” KNOWN AND UNKNOWN. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, VISA EXPLICITLY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE INFORMATION IN THIS DOCUMENT, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. YOU ARE SOLELY RESPONSIBLE FOR YOUR USE OF THE INFORMATION CONTAINED HEREIN. May 2011 VISA PUBLIC © 2011 Visa. All Rights Reserved. Verified by Visa Acquirer and Merchant Implementation Guide Contents Contents About This Guide 1 1 Verified by Visa Overview 7 1.1 Technology Platform 7 1.2 Channels and Technologies Supported 7 1.3 Verified by Visa Overview 8 1.4 Authorization versus Authentication 8 1.5 Summary of Verified by Visa Benefits 9 1.6 Merchant Benefits 10 1.7 Merchant Marketing Opportunities 12 2 3-D Secure Technology Platform 13 2.1 3-D Secure Participants 14 2.2 Software Components 15 3 Transaction Flows 17 3.1 Cardholder Enrollment/Activation 17 3.2 Online Purchases 18 4 3-D Secure Messages 23 4.1 Verify Enrollment Messages 23 4.2 Payer Authentication Messages 25 4.3 Handling of the Merchant Password Field in 3-D Secure Messages 27 4.4 Attempted Authentication Exclusions 27 4.5 Merchant Type Exclusions 28 4.6 Cache Messages 28 5 Authorization Processing 29 5.1 Electronic Commerce Indicator (ECI) 30 5.2 Cardholder Authentication Verification Value and Authentication Identifier 31 5.3 Authentication and Authorization 32 5.4 PARes Fields for Authorization Requests 35 5.5 Electronic Commerce Custom Payment Service Qualification 36 5.6 ACI and ECI Values Must Be Consistent 37 5.7 No Re-Use of Authentication Data 37 May 2011 VISA PUBLIC i © 2011 Visa. All Rights Reserved. Verified by Visa Acquirer and Merchant Implementation Guide Contents 5.8 Recurring Transactions 38 5.9 Installment Transactions 39 5.10 Online Auctions 39 5.11 Authentication Data Limits 39 6 Merchant Server Plug-In Functions 40 6.1 Message Processing Functions 40 6.2 Additional MPI Functional Requirements 41 7 Acquirer/Merchant Requirements and Best Practices 44 7.1 Acquirer Responsibility for Merchant Participation 44 7.2 Merchant Authentication to Access Visa Directory Server 45 7.3 Pre-Authentication Messaging at Checkout 45 7.4 Use of Framed Inline Page 47 7.5 Text for Inline Page with a Framed Window 48 7.6 Use of Verified by Visa Merchant Symbol 49 7.7 Activation Anytime 50 7.8 Failed Authentication Processing 50 7.9 Merchant Performance Standards 51 7.10 Data Quality in VEReq and PAReq Messages 51 7.11 Timing between VERes and PAReq 53 7.12 Merchant Customer Support 53 8 Digital Certificate Use 54 8.1 Visa Certificate Hierarchy 54 8.2 Merchant Authentication 55 8.3 Transport Security 56 9 MPI Implementation Options 57 9.1 Buy Options for MPI Software 58 9.2 Hosted MPI Options 59 9.3 Custom Software Development 60 10 Implementation Considerations 61 10.1 Participation, Decision, and Project Team 61 10.2 Development Phase 62 10.3 Testing Phase 63 10.4 Requirements for Pre-Production Readiness via Product Integration Testing (PIT) 64 ii VISA PUBLIC May 2011 © 2011 Visa. All Rights Reserved. Verified by Visa Acquirer and Merchant Implementation Guide Contents 10.5 Pre-Production Implementation Checklist 66 10.6 Merchant MPI System Resiliency 66 11 Risk Management 69 11.1 Related Security Programs 70 11.2 Excessive Chargebacks and/or Fraud 70 11.3 Visa Cardholder Information Security Program (CISP) 71 11.4 Verified by Visa Global Performance Standards 71 12 Dispute Resolution 72 12.1 Applicable Operating Regulations 72 12.2 Merchant Transaction Records 73 12.3 Dispute Processing – Acquirer Quick Reference 74 13 For Acquirers 76 13.1 Acquirer Role in Verified by Visa 76 13.2 Visa Directory Server: Acquirer and Merchant Registration 78 13.3 Acquirer Processing Requirements 78 13.4 Sample Acquirer Project Plan 80 Appendices A Planning and Implementation Example for Merchant Plug-In 83 B Verified by Visa Activation Anytime 90 C Best Practices for Fraud Screening 93 D VbV Global Performance Enhancement Program 96 Glossary 99 Index 105 May 2011 VISA PUBLIC iii © 2011 Visa. All Rights Reserved. Verified by Visa Acquirer and Merchant Implementation Guide Contents Tables Table 1: Document Conventions 4 Table 2–1: Roles of Verified by Visa Program Participants 14 Table 4–1: Verify Enrollment Messages 23 Table 4–2: Verify Enrollment Response Values 23 Table 4–3: Payer Authentication Messages 25 Table 4–4: Issuer Authentication Results Values 26 Table 5–1: Transaction Status Values 29 Table 5–2: 3-D Secure Response Mapping Exhibit 33 Table 5–3: PARes Fields Required for Authorization Messages 35 Table 5–4: ACI and ECI Values for Authorization Messages 37 Table 7-1: Payer Authentication Request Message Fields 52 Table 8-1: Visa Certificate Hierarchy 54 Table 10-1: Required Merchant Implementation Checklist 66 Table 12-1: Dispute Processing Summary Acquirers – Authenticated Trans 74 Table 12-2: Dispute Processing Summary Acquirers – Attempted Authentications 75 Table 13–1: Sample Acquirer Project Plan 80 Table A–1: Example Planning and Implementation Checklist 88 Table A–1: Example Planning and Implementation Checklist (Continued) 89 Table D-1. VbV Global Performance Program Standards 97 Figures Figure 2-1: The Three Domains of 3-D Secure 15 Figure 3–1: Purchase Transaction Flow 19 Figure 3–2: Verified by Visa Password Entry Screen 21 Figure 5–1: Determining Whether to Submit Authorization 32 Figure 7-1: Merchant Checkout Page with Pre-Authentication Messaging 46 Figure 7-2: Inline Page with Top Frame 47 Figure 7–3: Inline Page with Side Frame 48 Figure B-1: Activation Anytime Landing Page 90 Figure B-2: Sample Issuer Activation Page 91 Figure B-3: Sample Password Creation Page 91 Figure B-4: Sample Activation Successful Page 92 iv VISA PUBLIC May 2011 © 2011 Visa. All Rights Reserved. Verified by Visa Acquirer and Merchant Implementation Guide About This Guide About This Guide The requirements in this publication are referenced in the Visa International Operating Regulations, and have the same authority as the Visa International Operating Regulations. They are binding upon participants in the services referenced. The Visa International Operating Regulations govern in the event of any inconsistency or contradiction, unless Visa specifically grants a variance. Acquirers and merchants are required to adhere to the requirements set forth in this Guide and any related addendums to this Guide. Any differences in implementation must be approved in writing by Visa prior to production launch. Ask your Visa Representative for information. Trademarks Visa®, Verified by Visa® and 3-D Secure® are registered trademarks or trademarks of Visa Inc. in the United States and other countries. Purpose This document is intended to assist acquirers, merchants, and merchant processors in their implementation of Verified by Visa (VbV), by helping them to: • Understand the functionality, uses, and benefits of the Verified by Visa program. • Plan the development, testing, certification, and production setup of the Verified by Visa program. Audience The Verified by Visa Acquirer and Merchant Implementation Guide is intended for acquirers, merchants, and processors that are evaluating or have decided to implement Verified by Visa. This guide explains the Verified by Visa program and its benefits, transaction flows, and implementation planning considerations. May 2011 VISA PUBLIC 1 © 2011 Visa. All Rights Reserved. Verified by Visa Acquirer and Merchant Implementation Guide About This Guide Changes from Prior Publication This publication was updated from the prior version as shown below. New Content Where to Find the Content in This Guide A new section was added with System Resiliency Chapter 10, Implementation Considerations: recommendations. Section 10.6, Merchant MPI System Resiliency Organization of This Guide This document contains the following sections: About This Guide – This introductory section highlights the topics covered in the Guide as well as the conventions used throughout the Guide, and provides a list of Verified by Visa resources and tools. 1. Verified by Visa Overview—This chapter provides a high-level summary of Verified by Visa and the benefits of acquirer and merchant participation. 2. 3-D Secure Technology Platform—This chapter describes the roles of participants in the Verified by Visa program and the key software components used by each. 3. Transaction Flows—This chapter describes cardholder enrollment/activation and purchase authentication transaction flows. 4. 3-D Secure Messages—This chapter briefly describes each 3-D Secure message involving acquirers and merchants. 5. Authorization Processing—This chapter describes how the MPI determines whether authentication was successful as well as the Electronic Commerce Indicator (ECI), the Cardholder Authentication Verification Value (CAVV), and special processing situations. 6. Merchant Server Plug-In Functions—This chapter provides an overview of MPI functions, including message processing and other functional requirements. 7. Acquirer/Merchant Requirements and Best Practices—This chapter reviews the acquirer and merchant business requirements for Verified by Visa implementations, including cardholder interfaces and performance standards. 8. Digital Certificate Use—This chapter discusses Verified by Visa use of the Visa-issued certificates, the process of authenticating Verified by Visa merchants to the Visa Directory Server, and the requirements for securing 3-D Secure channels that include the merchant. 2 VISA PUBLIC May 2011 © 2011 Visa. All Rights Reserved.