EMV 3DS Additional Test Cases
- Daryl Licursi (Unlicensed)
- Kayleigh LaSalle
- Walt Handloser
The EMV® 3DS Additional Test Case guide explores alternative authentication options outside the typical testing scenarios which require a more tailored approach. These test cases can vary by card brand/scheme and it is important to note that you should work with your account representative at CardinalCommerce prior to proceeding.
Important test notes:
For the expiration year field
CardExpYear, use the current year +3 (for example, when testing in 2023, you’d use 2026).Test PANs will not necessarily match the production card range for their respective card networks. As such, test PANs should not be used to determine the range of (or to create validation rules for) production cards. If you do have validation rules in place, trustlists can be used to allow or identify test PANs on an individual basis.
Test Case 1: Trans Status Reason
NOTE: Visa cards will be used for all Trans Status Reason test cases, however, these values can (and will) be returned for all card networks.
1a. Card Authentication Failed | |
Scenario | 01 - Card Authentication Failed |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Visa PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| No specific callouts for fields; transStatusReason will be returned based on the PAN. |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = <Enrolled>Y</Enrolled> |
PAResStatus = <PAResStatus>N</PAResStatus> | |
Cavv = (value will not be provided) <Cavv></Cavv> | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
StatusReason = | |
Additional Information | |
| Test Case can apply to PA or NPA transactions. |
| When PAResStatus= |
Sample Messages |
Sample Lookup Message |
Sample Response Message |
1b. Suspected Fraud | |
Scenario | 11 - Suspected Fraud |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Visa PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| No specific callouts for fields; transStatusReason will be returned based on the PAN. |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = (value will not be provided) | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
StatusReason = | |
Additional Information | |
| Test Case can apply to PA or NPA transactions. |
Sample Messages |
Sample Lookup Message |
Sample Response Message |
1c. Cardholder Not Enrolled in Service | |
Scenario | 13 - Cardholder Not Enrolled in Service |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Visa PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| No specific callouts for fields; transStatusReason will be returned based on the PAN. |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = (value will not be provided) | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
StatusReason = | |
Additional Information | |
| Test Case can apply to PA or NPA transactions. |
Sample Messages |
Sample Lookup Message |
Sample Response Message |
1d. Transaction timed out at the ACS | |
Scenario | 14 - Transaction timed out at the ACS |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Visa PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| No specific callouts for fields; transStatusReason will be returned based on the PAN. |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = (value will not be provided) | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
StatusReason = | |
Additional Information | |
| Test Case can apply to PA or NPA transactions. |
Sample Messages |
Sample Lookup Message |
Sample Response Message |
1e. Non-Payment transaction not supported | |
Scenario | 20 - Non-Payment transaction not supported |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Visa PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| No specific callouts for fields; transStatusReason will be returned based on the PAN. |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = (value will not be provided) | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
StatusReason = | |
Additional Information | |
| Test Case can apply to PA or NPA transactions. |
Sample Messages |
Sample Lookup Message |
Sample Response Message |
Test Case 2: TRA Exemption
2a. Transaction Risk Analysis (TRA) / Low Value - Mastercard | |
Scenario | Merchant has performed a proprietary risk assessment and is requesting a Transaction Risk Analysis (Low Risk) or Low Value exemption based on fraud thresholds established with the network. |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Mastercard PAN | |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 05 - No challenge requested (transactional risk analysis is already performed) |
Expected Results - Lookup Response (cmpi_lookup) | |
EMV 3DS (2.1.0 Results) | |
| Enrolled = |
PAResStatus = | |
Cavv = <Cavv Value> | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
StatusReason = | |
EMV 3DS (2.2.0 Results) | |
| Enrolled = |
PAResStatus = | |
Cavv = <Cavv Value> | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Card Network & Version Specifications | |
Mastercard Identity Check 2.1 | Supported through https://cardinaldocs.atlassian.net/wiki/spaces/STAG/pages/1487667238 In this case, ChallengeIndicator on the Lookup should be passed as “05” and Centinel will remap this value to the Extension field. |
Mastercard Identity Check 2.2 | Cardinal support for Mastercard Identity Check 2.2 is coming soon. |
Additional Information | |
Merchant Action | Proceed to Authorization You may also request the TRA exemption directly in authorization depending on region and your agreements with your Acquirer and the networks. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
2b. Transaction Risk Analysis (TRA) / Low Value - Visa | |
Scenario | Merchant has performed a proprietary risk assessment and is requesting a Transaction Risk Analysis (Low Risk) or Low Value exemption based on fraud thresholds established with the network. |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Visa PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 05 - No challenge requested (transactional risk analysis is already performed) |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = <Cavv Value> | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Card Network & Version Specifications | |
Visa Secure 2.1 | Not Supported |
Visa Secure 2.2 | You will need to work with your Acquirer to ensure the TRA flag is added in Field 34 along with providing the CAVV in the Authorization message. |
Additional Information | |
Merchant Action | Proceed to Authorization You may also request the TRA exemption directly in authorization depending on region and your agreements with your Acquirer and the networks. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
2c. Transaction Risk Analysis (TRA) / Low Value - Discover | |
Scenario | Merchant has performed a proprietary risk assessment and is requesting a Transaction Risk Analysis (Low Risk) or Low Value exemption based on fraud thresholds established with the network. |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Discover PAN: | |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 02 - No challenge requested |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = <Cavv Value> | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Card Network & Version Specifications | |
Discover ProtectBuy 2.1 | In this case, merchant must pass Challenge Indicator = 05 to indicate TRA exemption. |
Additional Information | |
Merchant Action | Proceed to Authorization You may also request the TRA exemption directly in authorization depending on region and your agreements with your Acquirer and the networks. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
2d. Acquirer TRA - Cartes Bancaires | |
Scenario | Merchant has performed a proprietary risk assessment and is requesting the Acquirer TRA exemption. |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Cartes Bancaires (Visa) PAN: Cartes Bancaires (MC) PAN: Lookup Request (cmpi_lookup) → CardType = CB | |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 05 - No challenge requested |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = <Cavv Value> NOTE: The CAVV value will not be returned during your testing. This may be returned in Production based on issuer rules surrounding co-branding with Visa or Mastercard BINs. | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Card Network & Version Specifications | |
Cartes Bancaires (v1.7) | Passing ChallengeIndicator=05 on a CB EMV 3DS 2.1.0 will allow Cardinal to generate the CB-EXEMPTACQ extension field on the AReq. |
Additional Information | |
Merchant Action | Proceed to Authorization You may also request the TRA exemption directly in authorization depending on region and your agreements with your Acquirer and the networks. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
2e. Acquirer TRA - Cartes Bancaires (2.2.0) | |
Scenario | Merchant has performed a proprietary risk assessment and is requesting the Acquirer TRA exemption. |
Authentication Experience | Frictionless |
Test Values
| EXP Date: 01/**** |
Cartes Bancaires (Visa) PAN: Cartes Bancaires (MC) PAN: Lookup Request (cmpi_lookup) → CardType = CB | |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 05 - No challenge requested (transactional risk analysis is already performed) |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
Cavv = <Cavv Value> | |
EciFlag = | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Additional Information | |
Merchant Action | Proceed to Authorization You may also request the TRA exemption directly in authorization depending on region and your agreements with your Acquirer and the networks. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
Test Case 3: Trusted Beneficiary (Trustlist Exemption)
Test Case 3a: Prompt For Trustlist | |
Scenario | Successful traditional Step Up (Challenge) authentication transaction with a prompt for the trustlist and an accepted exemption result |
Authentication Experience | Challenge |
Test Values | Visa PAN: Mastercard PAN: |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 09 - Challenge requested (trustlist prompt requested if challenge required) |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
CAVV = (value will not be provided) | |
Visa: Mastercard: | |
Payload = <Payload Value> | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Expected Results - Authentication (cmpi_authenticate response) | |
| PAResStatus = |
CAVV = <CAVV Value> | |
Visa: Mastercard: | |
WhiteListStatus = <WhiteListStatus Value> | |
WhiteListStatusSource = <WhiteListStatusSource Value> | |
ErrorNo = ErrorDesc = (value will not be provided) | |
Integration Method Specific Expected Results | |
Cardinal Cruise API | On the Lookup Response, StepUpUrl will be returned |
Additional Information | |
Merchant Action | Merchant should append the Cavv and EciFlag values to the authorization message. |
Sample Messages
Sample Lookup Request Message
Sample Lookup Response Message
Sample Authenticate Request Message
Sample Authenticate Response Message
Test Case 3b: Utilize Trusted Beneficiary Exemption | |
Scenario | Successful frictionless authentication transaction with a pre-trustlisted indication and an accepted exemption result |
Authentication Experience | Frictionless |
Test Values | Visa PAN: Mastercard PAN: |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = 08 = No challenge requested (utilize trustlist exemption if no challenge required) |
Optional Fields - Lookup Request (cmpi_lookup) | |
| WhiteListStatus = <WhiteListStatus Value> |
| WhiteListStatusSource = <WhiteListStatusSource Value> |
Expected Results - Lookup Response (cmpi_lookup) | |
| PAResStatus = |
CAVV = <CAVV Value> | |
Visa: Mastercard: | |
WhiteListStatus = <WhiteListStatus Value> | |
WhiteListStatusSource = <WhiteListStatusSource Value> | |
ThreeDSVersion = <ThreeDSVersion Value> | |
ErrorNo = ErrorDesc = (value will not be provided) | |
Integration Method Specific Expected Results | |
| ActionCode = ErrorNumber = ErrorDescription = |
Additional Information | |
Merchant Action | Merchant should append the Cavv and EciFlag values to the authorization message. |
Sample Messages
Sample Lookup Request Message
Sample Lookup Response Message
Test Case 4: Data Only
Test Case 4a: Visa Data Only | |
Scenario | Visa Data Only authentication request |
Authentication Experience | Frictionless (Information Only) |
Test Values | Visa PAN: |
Required Fields - Lookup Request (cmpi_lookup) | |
| ChallengeIndicator = |
Expected Results - Lookup Response (cmpi_lookup) | |
| PAResStatus = |
EciFlag = | |
CAVV = <CAVV Value> | |
ThreeDSVersion = <ThreeDSVersion Value> | |
ErrorNo = ErrorDesc = (value will not be provided) | |
Integration Method Specific Expected Results | |
| ActionCode = ErrorNumber = ErrorDescription = |
Additional Information | |
Merchant Action | Merchant should append the ECI and Cavv values to the authorization message. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
Test Case 4b-1: Identity Check Insights (ScoreRequest = N) | |
Scenario | Mastercard Data Only authentication request |
Authentication Experience | Frictionless |
Test Values | Mastercard PAN: |
Required Fields - Lookup Request (cmpi_lookup) | |
| MessageCategory = |
Optional Fields - Lookup Request (cmpi_lookup) | |
| ScoreRequest = |
Expected Results - Lookup Response (cmpi_lookup) | |
| PAResStatus = |
CAVV = <CAVV Value> | |
EciFlag = | |
StatusReason = | |
ThreeDSVersion = <ThreeDSVersion Value> | |
ErrorNo = ErrorDesc = (value will not be provided) | |
Integration Method Specific Expected Results | |
| ActionCode = ErrorNumber = ErrorDescription = |
Additional Information | |
Merchant Action | Merchant should append the ECI and DS Transaction ID value to the authorization message. |
Sample Messages |
Sample Lookup Request Message |
Sample Lookup Response Message |
Test Case 5: Visa Payment Passkey
Test Case 5: Successful Step-Up Authentication for VPP Enrollment | |
Scenario | Successful traditional Step Up (Challenge) authentication transaction for enrolling a user/card in Visa Payment Passkey. |
Authentication Experience | Challenge |
Test Values | Visa PAN: |
Required Fields - Lookup Request (cmpi_lookup) | |
| DFReferenceId |
CardNumber= | |
CurrencyCode | |
Amount= Transaction amount that was sent on the registration check | |
Email=Cardholder’s email that was sent on the registration check. | |
ChallengeIndicator= 04 | |
AlternateAuthenticationMethod= 80 | |
Expected Results - Lookup Response (cmpi_lookup) | |
| Enrolled = |
PAResStatus = | |
XID = <XID Value> | |
CAVV = (value will not be provided) | |
EciFlag = | |
Payload = <Payload Value> | |
ErrorNo = | |
ErrorDesc = (value will not be provided) | |
Expected Results - Authentication (cmpi_authenticate response) | |
| PAResStatus = |
XID = <XID Value> | |
CAVV = <CAVV Value> | |
EciFlag = 05 | |
FidoEligible | |
ErrorNo = ErrorDesc = (value will not be provided) | |
Integration Method Specific Expected Results | |
Cardinal Cruise API | On the Lookup Response, StepUpUrl will be returned |
Additional Information | |
Merchant Action | Merchant should append the Cavv and EciFlag values to the authorization message. |
Sample Lookup Request
Sample Lookup Response
Sample Authenticate Request
Sample Authenticate Response
EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC.