What are the ECI Values for Visa and Mastercard in EMV 3-D Secure 2.x?

Products

• CA Payment Security

Issue/Introduction

The Electronic Commerce Indicator (ECI) represents the value determined by the Access Control Server (ACS) indicating the results of the attempt to authenticate the Cardholder. In the EMV 3-D Secure 2.x protocol, the ACS provides the ECI value to the 3DS Server in the Authentication Response (ARes) message. Customers often need to know the specific ECI values for Visa and Mastercard (such as ECI 01, 02, 05, 06, and 07) and how they map to the 2.x transaction statuses (Y, A, N, U, R).

Environment

Production , EMV 3-D Secure 2.x (3DS Server, Directory Server, ACS)

Cause

This is an informational request. The specific ECI values are not defined by the EMVCo core specification, but are instead defined by the specific Directory Server (DS) / Payment System (e.g., Visa, Mastercard). The 3DS Server needs the ECI to proceed with the payment authorization process based on the authentication outcome.

Resolution

In the EMV 3-D Secure 2.x protocol, if a Payment Authentication transaction is deemed authenticated (Transaction Status = Y) or attempted (Transaction Status = A), the ACS generates the ECI value and Authentication Value and includes them in the ARes message as defined by the specific DS.

The standard ECI mappings for the Payment Systems are as follows:

Mastercard:

Mastercard utilizes ECI values of 01 and 02.

• Successful Authentication (Status Code = Y): The ACS returns an ECI of 02.

• Attempted Authentication (Status Code = A): The ACS returns an ECI of 01. This indicates that authentication could not be completed, but a proof of authentication attempt was generated.

• Failed or Unavailable (Status Code = N, U, R): The cardholder authentication failed, or it could not be completed due to technical/other problems. Generally, an ECI value is not provided by the ACS in the ARes for these statuses.

Visa:

Visa utilizes ECI values of 05, 06, and 07.

• Successful Authentication (Status Code = Y): The ACS returns an ECI of 05.

• Attempted Authentication (Status Code = A): The ACS returns an ECI of 06.

• Failed or Unavailable (Status Code = N, U, R): The ACS generally does not return an ECI in the ARes for failures. For authorization of non-authenticated or failed 3DS transactions, the merchant typically submits an ECI of 07.

 

Additional Information

In the 2.x protocol, the term "3DS Server" replaces the 1.0 term "Merchant Plug-in (MPI)", and the "ARes" (Authentication Response) replaces the 1.0 "PARes" message. For Non-Payment Authentications (Message Category = 02-NPA), the inclusion of the ECI is optional and dependent on specific DS rules.