Testing
Test your 3DS integration on the Try environment using the magic values provided below. Send requests and see simulated responses.
For the Android/iOS SDK, the environment must be set to CardinalEnvironment.STAGING as part of the CardinalConfigurationParameters to use the test values on the Access Try environment.
Tokens
If you're creating tokens containing the test card numbers you must delete the token before creating another with the same PAN. You are prevented from creating another token using the same PAN. As an alternative, you can also change the namespace used as part of the token creation.
Liability shift
Liability shift is confirmed on payment authorization. The test card number tables show the different scenarios and the likely liability shift based on the authentication details provided (e.g. authenticationValue, eci, transactionId).
Test Card Number
Use different card numbers to alter the 3DS authentication outcome.
Do not mix the old test values used for API v1/v2 with the new ones for API v3 or you will get unexpected scenario outcomes. Set the cardHolderName to any other value e.g. Bob Smith
Always use a test card number from the tables below. Using a number not listed will result in the challenge failing to load for both web and SDK.
EMV 3DS version 2.1.0 will be sunset December 2024. The majority of authentications are already 2.2.0.
| Test Scenario | Description | Test Values (2.1.0) | Test Values (2.2.0) | Authentication Result | Verification Result | Action |
|---|---|---|---|---|---|---|
| Successful Authentication (Frictionless) | Issuer assessment resulted in a frictionless 3DS authentication |
|
| outcome: authenticated eci:
authenticationValue (cavv): returned liability shift: yes | N/A | Apply authentication object in payment request, proceed with payment authorization |
| Failed Frictionless Authentication | Issuer failed the authentication without providing the option for a challenge. |
|
| outcome: authenticationFailed eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Do not proceed with payment authorization. Either retry 3DS or prompt for another form of payment. |
| Attempts Stand-In Frictionless Authentication | Cardholder is enrolled in 3DS but the issuer does not support. This results in the issuer stand-in for the authentication |
|
| outcome: authenticated eci:
authenticationValue (cavv): Not returned liability shift: yes | N/A | Apply authentication object in payment request, proceed with payment authorization |
| Authentication Unavailable (issuer) | Cardholder is enrolled but authentication is unavailable |
|
| outcome: unavailable eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Proceed as non-authenticated transaction or retry authentication request |
| Authentication Rejected | Authentication rejected by the issuer, no challenge is offered |
|
| outcome: authenticationFailed eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Do not proceed with payment authorization. Either retry 3DS or prompt for another form of payment. |
| Authentication Unavailable (system error) | Authentication rejected by the issuer, no challenge is offered |
|
| outcome: unavailable eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Proceed as non-authenticated transaction or retry authentication request |
| Authentication Error | Error whilst attempting authentication |
|
| outcome: unavailable eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Proceed as non-authenticated transaction or retry authentication request |
| Authentication Timeout | Timeout during the authentication request |
|
| outcome: unavailable eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Proceed as non-authenticated transaction or retry authentication request |
| Successful Authentication (Challenged) | Issuer prompts a challenge in authentication, customer responds successfully |
|
| outcome: challenged | outcome: authenticated eci:
authenticationValue (cavv): returned liability shift: yes | Apply authentication object in payment request, proceed with payment authorization |
| Failed Challenged Authentication | Issuer prompts a challenge in authentication, customer responds with incorrect details (e.g. OTP, fingerprint etc) |
|
| outcome: challenged | outcome: authenticationFailed eci:
authenticationValue (cavv): Not returned liability shift: no | Do not proceed with payment authorization. Either retry 3DS or prompt for another form of payment. |
| Verification Unavailable | Authentication data following a challenge cannot be retrieved |
|
| outcome: challenged | outcome: unavailable eci:
authenticationValue (cavv): Not returned liability shift: no | Proceed as non-authenticated transaction or retry verification request |
| Verification Error | Error whilst attempting verification |
|
| outcome: challenged | outcome: unavailable eci:
authenticationValue (cavv): Not returned liability shift: no | Proceed as non-authenticated transaction or retry verification request |
| Bypass | Bypass the consumer authentication flow via Cardinal Rules Engine configuration. Returned if 3DS premium is enabled or when there is a timeout connecting to the 3DS directory server. |
|
| outcome: bypassed eci:
authenticationValue (cavv): Not returned liability shift: no | N/A | Proceed as non-authenticated transaction |
Common Issues
| Issue | Cause |
|---|---|
Mobile SDK: challenge page fails to load, producing one of the following errors
|
|
| Web Integration: challenge page fails to load |
|
| Issuer Challenge page fails to load on live (400 response) |
|
Test device data form
The form below allows you to submit the 3DS device data details provided in the API response. You then receive the sessionId/collectionReference, back in the postMessage, for use in the authentication request. This is useful if using tools such as postman/insomnia to test your integration.
Test challenge form
The form below allows you to submit the 3DS challenge details provided in the API response and display the issuer challenge. This is useful if using tools such as postman/insomnia to test your integration.