3D Secure provides an extra layer of protection for your business and customers for their online purchases. 3D Secure is designed to prevent fraud by allowing the card issuer to authenticate your customer before you process a payment. QuickStream supports two options: QuickWeb : The card issuer performs the authentication on Westpac hosted pages. QuickStream REST API : The card issuer performs the authentication within your website. Benefits of 3D Secure The benefits of EMV 3D Secure are: Improved risk analysis - card issuers have the information they need to perform risk analysis. Make it easy for your customers to pay - customers who are judged low-risk enjoy a frictionless flow. Lower costs - less fraud and fewer chargebacks. For more information, see: https://3dsecure2.com https://www.emvco.com/emv-technologies/3d-secure/ Your customer enters their card details. You send additional information through QuickStream to your customer's bank. If a challenge is required, your customer must pass the challenge before continuing. The payment is processed or card is stored in QuickStream. What additional information is sent? The additional information includes the customer's contact details, shipping address, and type of goods being purchased. This allows your customer's bank to decide if a challenge is required. For a full list of fields, see 3D Secure Authentication in the QuickStream REST API. What is a challenge? A challenge allows your customer's bank to authenticate your customer. A challenge frame is displayed on your website. The customer enters information into the challenge frame. For example, their bank may send an SMS verification code and require the customer to type it in. What is a frictionless flow? In a frictionless flow, the customer does not need to complete a challenge. How to implement EMV 3D Secure To enable 3D Secure, you will need

a Westpac representative to enable this on your QuickStream facility, a software developer to make changes to your website. These steps assume you have already implemented a QuickWeb solution. QuickStream performs 3D Secure authentication automatically when it is enabled for your facility. To improve the chances of a frictionless customer experience with EMV 3D Secure, you must: Implement the Secure token hand-off , and Provide the Parameters for 3D Secure . Trusted Frame and REST API These steps assume you have already implemented a Trusted Frame solution. The sequence diagram below shows a high-level overview of the steps involved. To opt-in to EMV 3D Secure, when you call quickstreamapi.creditCards.createTrustedFrame pass option threeDS2 = true in the TrustedFrameConfigObject . QuickStream will check if the card is enrolled in EMV 3D Secure. When QuickStream sends the data.singleUseToken.singleUseTokenId back, check the field data.singleUseToken.creditCard.threeDS2AuthRequired . To authenticate the cardholder, your server must send a 3D Secure Authentication request using your Secret API key . This allows you to pass information such as the customer's contact details, billing address, shipping address etc. The response will contain a transStatus to indicate if you should: process a payment or register an account ( A or Y ), or present a challenge frame ( C ), or stop processing (any other value). To present a challenge frame, call Javascript function quickstreamapi.creditCards.createChallengeFrame . QuickStream will send your site an updated transStatus to indicate if the customer has now passed the challenge. If transStatus is A or Y after the authentication, you should send a request to: take a payment . register an account for a customer . register an account without a customer . Send the parameter threeDS2 set to true . Privacy Statement (for individuals whose personal information may be collected - in this clause referred to as "you"). All personal information we collect about you is collected, used and disclosed by us in accordance with our Privacy Statement which is available at Privacy Statement or by calling us through your relationship manager or Westpac representative. Our Privacy Statement also provides information about how you can access and correct your personal information and make a complaint. You do not have to provide us with any personal information but, if you don't, we may not be able to process an application or a request for a product or service.