April 2025 Summaries

3D Secure (3DS) adds a third authentication domain to online card payments, requiring cardholders to verify their identity and helping reduce fraud and merchant chargebacks from unauthorized transactions. It is mandatory or effectively required in regions including the EU, UK, Australia, and India, while U.S. merchants often avoid it because its added checkout friction can lower conversions and, according to some data, authorization rates. The original 3DS1 system relied on disruptive password challenges and was associated with cart abandonment, confusing embedded forms, phishing risks, and potential account takeover during activation while shopping. Introduced in 2016 and broadly adopted by banks by 2022, 3DS2 supports Strong Customer Authentication requirements by sharing richer transaction data, such as device, shipping, and purchase-history information, enabling banks to approve low-risk payments frictionlessly while challenging higher-risk ones. Businesses must accommodate customer-initiated checkouts as well as merchant-initiated recurring charges, for which the customer’s initial authentication can support later transactions without direct customer participation.

Visa’s optional Account Name Inquiry (ANI) service verifies whether the name submitted with card data matches the name held by the issuing bank, returning match, partial-match, or mismatch results before a transaction proceeds to settlement. At a stated cost of $0.10 per inquiry, it can help merchants reduce fraud, chargebacks, processing losses, penalties, and reputational harm caused by stolen or misused cards, though businesses with effective existing fraud controls or very low chargeback rates may judge the added expense unnecessary. ANI may also be deployed by full-service payment service providers without merchants directly controlling its use, creating potential concerns that repeated failures could influence a provider’s assessment of merchant risk. Because legitimate name discrepancies can result from typos, name changes, hyphens, special-character handling, or mobile-entry errors, payment systems should distinguish partial matches from outright mismatches and combine ANI results with other security checks. Merchants seeking direct control over ANI and payment routing may use multiple payment service providers, retain customer data ownership, and use a programmable payments vault to reduce PCI-DSS exposure while securely directing approved transactions to preferred processors.

3D Secure is an important payment-authentication tool for reducing fraud, but implementing it can be difficult because payment service providers often hide critical technical details behind proprietary abstractions. The transition from 3DSv1’s cumbersome redirect and password experiences to 3DSv2’s more data-intensive, potentially frictionless authentication has increased the need for accurate merchant, customer, and transaction data, while inconsistent provider documentation and custom implementations can complicate integrations or provider changes. Responsibility is shared among merchants, PSPs or acquirers, issuers, and card networks, yet unclear ownership and limited access to data can make troubleshooting and optimization difficult. The author argues that successful 3DS deployment is primarily a setup and data-management challenge rather than a simple technical integration, and promotes an agnostic approach that gives merchants greater control over tokenized card data, security, compliance, documentation, and their choice of payment providers.

Basis Theory has enhanced Apple Pay acceptance by directly integrating device primary account numbers (DPANs), which are automatically converted into Token Intents without requiring custom token-decryption code, while future support for merchant primary account numbers (MPANs) is in development. The updated Apple Pay implementation uses the latest version, supports all browsers, and enables iPhone users to scan a code and pay by phone. Web Elements API request latency has been reduced by 50% through the removal of unnecessary API calls, with the improvement available in the latest web-elements and react-elements versions. The company also introduced expanded 3DS documentation, automated most requestor information fields, standardized 3DS component errors under HTTP 424 responses, and added authentication and challenge response fields such as directory status codes and liability-shift indicators. Additional fixes address Node 18 fetch loading, 3DS status and liability fields, Elements logging and DOM optimization, React 19 compatibility, and React Native CVC validation.

Credit card transactions are classified into Levels 1, 2, and 3 based on the amount of payment data submitted to card networks, with each higher level requiring more detailed information and potentially qualifying commercial transactions for lower interchange rates. Level 1 applies primarily to consumer B2C purchases and requires basic merchant, date, and transaction amount information, while Level 2 is generally used for B2B commercial cards and adds fields such as tax details, merchant postal code, invoice or order number, and customer codes. Level 3, commonly used by government agencies and large businesses with purchasing cards, includes extensive line-item data such as product descriptions, quantities, tax rates, shipping information, freight, duties, and country codes; Visa and Mastercard also impose annual transaction-volume requirements for Level 3 eligibility. Merchants must provide every required field to receive Level 2 or 3 treatment, since incomplete records revert to Level 1 rates, making standardized data collection especially important for vendors serving government and institutional customers. Although merchants pay negotiated discount fees rather than interchange reimbursement fees directly, interchange-plus pricing may be more advantageous for businesses processing many Level 2 or 3 payments, as cited Visa rates show lower fees for Level 2 and especially Level 3 transactions than for non-qualified transactions.

Full-service payment service providers combine gateways, processing, security, currency conversion, and alternative payment options into a fast, simple onboarding experience that appeals to new merchants seeking predictable fees and minimal payments expertise. As businesses scale, however, these providers may become costly and restrictive, with flat-rate pricing that can obscure lower underlying debit-card fees, conversion-rate markups, and additional charges for methods such as buy-now-pay-later. Merchants may also lose control over stored customer payment data, face dependence on a provider’s merchant account and risk policies, and encounter limits on supported products or industries. An alternative approach is a multi-PSP strategy supported by an independent, programmable payment-data vault, allowing merchants to retain greater data portability, use specialized providers across regions or risk categories, reduce certain processing costs, and lessen reliance on any single payments partner, though it requires building and managing a more complex payments system.

PCI DSS 4.0 requirements 6.4.3 and 11.6.1 became mandatory at the end of March 2025 to reduce e-skimming threats such as Magecart, which can steal payment data through compromised third-party resources or injected scripts. Requirement 6.4.3 calls for an inventory of payment-page scripts, documented authorization and justification for each, and integrity verification, while 11.6.1 requires monitoring and alerts for unauthorized payment-page changes. The guidance highlights Subresource Integrity (SRI) and Content Security Policy (CSP) as relevant web standards, and states that Basis Theory provides published JavaScript-library hashes for SRI and CSP-based reporting for its Elements customers. Organizations must apply comparable controls to all other third-party scripts, with removing unnecessary resources presented as a way to reduce attack surface. SAQ A merchants are exempt from the specific requirements but must attest that their e-commerce systems are not vulnerable to script-based attacks.