Visa’s 3-D Secure Test Suite (V3DSTS)

User’s Guide
Version 1.0

March 2019
Visa Confidential
Important Information on Confidentiality and Copyright

© 2019. All Rights Reserved.

Notice: This information is proprietary and CONFIDENTIAL to Visa. It is distributed to Visa participants
for use exclusively in managing their Visa programs. It must not be duplicated, published, distributed
or disclosed, in whole or in part, to merchants, cardholders or any other person without prior written
permission from Visa.

The trademarks, logos, trade names and service marks, whether registered or unregistered (collectively
the “Trademarks”) are Trademarks owned by Visa. All other trademarks not attributed to Visa are the
property of their respective owners.
Note: This document is not part of the Visa Rules. In the event of any conflict between any content
in this document, any document referenced herein, any exhibit to this document, or any
communications concerning this document, and any content in the Visa Rules, the Visa Rules
shall govern and control.
 Contents
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Contents

Tables .............................................................................................................................................................................. iii

Introduction to the Visa’s 3–D Secure Test Suite ................................................................................................. 4
Testing Process .......................................................................................................................................................................... 4
Guide Organization .................................................................................................................................................................. 4
Technical Support ..................................................................................................................................................................... 5
1 Test Process............................................................................................................................................................ 6
1.1 Enrollment ......................................................................................................................................................................... 6
1.2 Request Test Certificates.............................................................................................................................................. 6
1.3 Run Test Cases ................................................................................................................................................................. 9
1.4 Successful Completion ............................................................................................................................................... 10
1.5 Next Steps/Request Production Certificate(s) ................................................................................................... 10
2 3DS Server Test Cases ......................................................................................................................................... 12
2.1 Frictionless Flow (Browser-based) .......................................................................................................................... 12
Test Case 3DSS-102-1001–Frictionless Flow, Browser, PA (Result=Y) ............................................................. 12
Test Case 3DSS-102-1002– Frictionless Flow, Browser, PA (Result=N) ........................................................... 13
Test Case 3DSS-102-1003–Frictionless Flow, Browser, PA (Result=A) ............................................................. 14
Test Case 3DSS-102-1004–Frictionless Flow, Browser, PA (Result=U)............................................................. 15
Test Case 3DSS-102-1005– Frictionless Flow, Browser, PA (Result=R) ............................................................ 16
Test Case 3DSS-102-1006– Frictionless Flow, Browser, PA (Result=Error) ..................................................... 17
Test Case 3DSS-201-2001–Frictionless Flow, Browser, NPA (Result=Y) .......................................................... 18
2.2 Frictionless Flow (App-based) .................................................................................................................................. 19
Test Case 3DSS-102-3001–Frictionless Flow, App, PA (Result=Y) ..................................................................... 19
Test Case 3DSS-102-3002– Frictionless Flow, App, PA (Result=N) ................................................................... 20
2.3 Challenge Flow (Browser-based) ............................................................................................................................ 21
Test Case 3DSS-103-1001-Challenge Flow, Browser, PA (Result=Y) ................................................................ 21
2.4 Challenge Flow (App-based) .................................................................................................................................... 23
Test Case 3DSS-103-3001-Challenge Flow, App-Native, PA (Result=Y) ......................................................... 23
Test Case 3DSS-103-3501-Challenge Flow, App-HTML, PA (Result=Y) .......................................................... 24

March 2019 Visa Confidential i

 Contents
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

2.5 Operation Flow .............................................................................................................................................................. 26

Test Case 3DSS-101-1001–Preq (w/out Serial Number) ....................................................................................... 26
Test Case 3DSS-101-1002–Preq (with Serial Number) .......................................................................................... 27
3 ACS Test Cases .................................................................................................................................................... 28
3.1 Frictionless Flow (Browser-based) .......................................................................................................................... 28
Test Case ACS-102-1001–Frictionless Flow, Browser PA (Result=Y) ................................................................ 28
Test Case ACS-102-1002– Frictionless Flow, Browser PA (Result=N) .............................................................. 29
Test Case ACS-102-1003–Frictionless Flow, Browser PA (Result=U) (Optional Test Case) ...................... 30
Test Case ACS-102-1004–Frictionless Flow, Browser PA (Result=R) (Optional Test Case) ...................... 31
Test Case ACS-102-1005– Frictionless Flow, Browser PA (Result=Error) ........................................................ 32
Test Case ACS-102-2001– Frictionless Flow, Browser NPA (Result=Y) ............................................................ 33
3.2 Frictionless Flow (App-based) .................................................................................................................................. 34
Test Case ACS-102-3001–Frictionless Flow, App PA (Result=Y) ........................................................................ 34
Test Case ACS-102-3002–Frictionless Flow, App PA (Result=N) ....................................................................... 35
3.3 Challenge Flow (Browser-based) ............................................................................................................................ 37
Test Case ACS-103-1001-Challenge Flow, Browser, PA (Result=Y, Challenge Mandated) ...................... 37
3.4 Challenge Flow (App-based) .................................................................................................................................... 39
Test Case ACS-103-3001-Challenge Flow, App-Native, PA (Result=Y, Challenge Mandated) ............... 39
Test Case ACS-103-3501-Challenge Flow, App-HTML, PA (Result=Y, Challenge Mandated) ................ 40
4 Review Test Results ............................................................................................................................................. 41
4.1 3DS Server ....................................................................................................................................................................... 41
4.2 ACS ..................................................................................................................................................................................... 42
A CAVV Validation.................................................................................................................................................. 44
B Error Codes ........................................................................................................................................................... 46
B.1 EMVCo Error Codes ..................................................................................................................................................... 46

ii Visa Confidential March 2019

 Tables
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Tables

Table 1: Guide Organization ........................................................................................................................................... 4

Table 1–1: 3DS Server Setup Details.................................................................................................................................... 6
Table 1–2: ACS Setup Details................................................................................................................................................. 7
Table B–1: EMVCo Error Codes ......................................................................................................................................... 46

March 2019 Visa Confidential iii

 Introduction to the Visa’s 3–D Secure Test Suite
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Introduction to the Visa’s 3–D Secure Test Suite

Visa’s 3–D Secure (3DS) Test Suite (V3DSTS) helps ensure that Product Providers’ 3DS Server (3DSS)
and Access Control Server (ACS) software meets Visa’s 3DS 2.0 technical and business requirements
before connecting to Visa’s 3DS 2.0 Directory Server.
• 3DS Server and ACS software must first successfully complete EMV® 3DS testing before beginning
V3DSTS testing.
• V3DSTS provides a standard set of required and optional test cases that help 3DS Server and ACS
software Product Providers confirm that their software meets Visa 3DS product and business rules.
• All 3DS 2.0 ACS and 3DS Server software must successfully complete all required V3DSTS test
cases before connecting to Visa’s 3DS 2.0 Directory Server.

Testing Process

V3DSTS messages are stored by test case instance, under the Product Provider's ID.

V3DSTS will validate that all required fields are present and valid per EMV 3DS specification and Visa
requirements.

Visa Test Analysts review the results to ensure that no errors are found and that the Product Provider’s
software performed each test case successfully from both a technical and business perspective. If
errors are found, the Product Provider must correct the error and rerun the failing test case until all
aspects of the test case as specified are successfully performed.

Guide Organization

This Guide contains the following sections:

Table 1: Guide Organization

Section Description

Introduction Provides an overview of V3DSTS and V3DSTS’s testing process.

Test Process Overview Describes general setup steps, and specific setup instructions for
3DS Servers and ACSs.

3DS Server Test Cases Provides test case details for 3DS Server testing.

ACS Server Test Cases Provides test case details for ACS Server testing.

4 Visa Confidential March 2019

 Introduction to the Visa’s 3–D Secure Test Suite
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Section Description

Test Results Review Provides an overview on how the Test Analyst will review the
test results to reach a Pass/Fail conclusion.

Appendix Appendix covering the process of CAVV validation and a high-

level overview of the applicable error codes

Technical Support

For administrative, general test procedure related questions or any other technical issues with
the V3DSTS, please contact Global Client Testing (GCT) at gctv3dsts@visa.com.

March 2019 Visa Confidential 5

 Test Process
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

1 Test Process
A Product Provider must perform the following steps, regardless of whether an a 3DS Server or ACS is
being tested.

1.1 Enrollment

As a first step, the Product Provider must:

• Prepare a Visa 3DS 2.0 Product Testing application package to initiate Visa 3DS 2.0 Product
Testing. Refer to the Application Package Section of the 3DS 2.0 Product Provider Pre-
Implementation Guide and Checklist for details.
• Email the completed 3DS 2.0 application package to gctv3dsts@visa.com.
• Register in V3DSTS by providing contact information about the Product Provider and information
about the 3DS software component(s) that they are testing.
A Visa test analyst is notified of the Product Provider's desire to enroll and validates the Product
Provider’s application package and registration. If the application and registration is complete the
Product Provider is granted V3DSTS access.

1.2 Request Test Certificates

The product provider must work with Global Client Testing team to obtain the connectivity certificates.
V3DSTS issues its own signing certificate (PbACS) using V3DSTS's online certificate issuance facility.

• The Product Provider must install the certificates in order to conduct test cases.
• The Product Provider can request the SSL/TLS client, server, and/or signing certificates required for
the component for which they are performing testing.
Table 1–1: 3DS Server Setup Details

Activity Description

V3DSTS Enrollment During enrollment in V3DSTS, the 3DS Server Product Provider must
• Click the Component Type: 3DS Server check box in the form.
3DS Server Certificate Request • Request certificates for SSL/TLS Communication: The 3DS Server
Product Provider needs to provide the Certificate Signing Request
(CSR) with gctv3dsts@visa.com to obtain the SSL/TLS connectivity
certificates.

6 Visa Confidential March 2019

 Test Process
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Activity Description

• Download the following keys by clicking on the Request

Testing Certificate link on the left-hand menu
- RSA Public Key Certificate (PbDS) for DeviceInfo Encryption
- EC Public Key Certificate (PbDS) for DeviceInfo Encryption

The last 2 links provide the 3DS Server Product Provider with the V3DSTS
public keys for DeviceInfo encryption to be used for the App flow (3DS
SDK) messages. The user has the option to use either an RSA or EC public
key.
Note:

• Only these 2 links are shown when the Product Provider has indicated
that they support 3DS Server Product Provider only,
• If a Product Provider is signed up as both a 3DS Server and ACS
Product Provider, they will be presented with links as shown below
after they click on the Request Testing Certificate link on the left-
hand menu.
- Request Signing Certificate (PbACS)
- Download RSA Public Key Certificate (PbDS) for DeviceInfo
Encryption
- Download EC Public Key Certificate (PbDS) for DeviceInfo
Encryption

3DS Server Certificate Installation Please use certificate installation procedures consistent with your
server software.
Test Connectivity After obtaining and installing the test certificates, 3DS Server product
providers must send AReq’s to the following URL in order to initiate test
cases: https://V3DSTestSuite- V3DS.3dsecure.net/ds2.
The Cardholder Account Numbers to be used to initiate each test case are
detailed in chapter 2 of this guide.

Support Questions? Please contact Global Client Testing (GCT) at gctv3dsts@visa.com.

Table 1–2: ACS Setup Details

Activity Description

V3DSTS Enrollment During enrollment in V3DSTS, the ACS Product Provider must
• Click the Component Type: ACS check box in the form.

March 2019 Visa Confidential 7

 Test Process
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Activity Description
• Provide their ACS URL (at which the Product Provider's ACS expects to
receive AReq messages from V3DSTS) in the ACS URL section of
V3DSTS enrollment form.
Be sure to input the correct ACS URL (including port number, if applicable)
or V3DSTS will fail to communicate with your ACS.

Configuration Parameters The ACS Product Provider will need to perform certain configuration steps
in order to connect to, send, and receive messages from V3DSTS. The
following configuration parameters must be set in the ACS:
• V3DSTS currently supports the cipher suites supported by the EMV 3-D
Secure Core Specification.
PAN Usage and ACS Enrollment ACS Product Providers may either:
• Use V3DSTS’s default test card numbers (PANs), as provided by
V3DSTS in the AReq for each specific test case, or
• Use PANs that have already been enrolled on their ACS.
If the ACS Product Provider wants to use their own PANs, the Product
Provider must edit the <PAN> field in the AReq for each test case before
clicking the Send AReq button. To use V3DSTS’s default PANs, the ACS
Product Provider must enroll V3DSTS’s PANs on the Product Provider’s
ACS.
For those ACS Product Providers that elect to use V3DSTS’s default PANs,
please review the test cases in Chapter 3 - ACS Test Cases to see the PANs
that must be enrolled on the ACS to conduct testing.

ACS Server Certificate Request

• Request certificates for SSL/TLS Communication. The ACS Product
Provider needs to provide the Certificate Signing Request (CSR) with
gctv3dsts@visa.com to obtain the SSL/TLS connectivity certificates.

• Request Signing Certificate (PbACS): This link is used by an ACS

Product Provider to obtain the PbACS certificate, which is used to sign
the "acsSignedContent" in the ARes message populated for app-based
challenge flows.
The ACS will provide the Certificate Signing Request (CSR) on the screen
to be signed by V3DS Test Suite Signing CA.

8 Visa Confidential March 2019

 Test Process
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Activity Description
Note:
• If a Product Provider has enrolled as an ACS Product Provider only,
they will be presented with a link after they click on the Request
Testing Certificate link on the left-hand menu.
• If a Product Provider is signed up as both a 3DS Server and ACS
Product Provider, they will be presented with links as shown below
after they click on the Request Testing Certificate link on the left-
hand menu
- Request Signing Certificate (PbACS)
- Download RSA Public Key Certificate (PbDS) for DeviceInfo
Encryption
- Download EC Public Key Certificate (PbDS) for DeviceInfo
Encryption

ACS Server Certificate Installation Please use certificate installation procedures consistent with your server
software.

Test Connectivity After obtaining and installing the test certificates, an ACS initiates
V3DSTS test cases through the V3DSTS user interface (UI). AReq messages
will be sent from the V3DSTS DS to the product provider’s ACS URL
provided at registration. The DS URL to be used by an ACS when sending
an RReq will be included in the AReq sent to ACS during the challenge
flow test cases.

Support Questions Please contact Global Client Testing (GCT) at gctv3dsts@visa.com.

1.3 Run Test Cases

The Product Provider must run all of the required test cases. For added benefit, the Product Provider
may also choose to run any number of the optional test cases.
• Review Test Results
• Rerun Test Cases as Necessary

The Product Provider must review the Testing Status link under 'Test Case Management' in V3DSTS to
confirm that they correctly passed all required test cases. If any test cases are failed, the Product
Provider must rerun them until they are successfully completed.

March 2019 Visa Confidential 9

 Test Process
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

1.4 Successful Completion

Upon completion of the required test cases:

• Compliance Letter Link: The Product Provider shall click the Compliance Letter link on the left
side menu of the V3DSTS homepage and request the compliance letter.
• Test Analyst Review: A Visa test analyst shall review the test results and approve the compliance
request.
• Compliance Letter Delivery:
- Via Download: The compliance letter shall be available for the vendor to download by
clicking the PDF link in the compliance letter column.
- Via Email: An electronic copy of the compliance letter shall also be sent to the registered
email ID of the vendor. The email will also inform that vendor that should they want
production certificates, they should contact their Visa representative to request the certificates.
• Visa Approved 3DS 2.0 Product Listing: Products that have successfully completed V3DSTS
testing are listed on Visa 3-D Secure Compliant Product List.

1.5 Next Steps/Request Production Certificate(s)

Once the Product Provider has received Visa’s Compliance Letter for its 3DS 2.0 product, the Product
Provider can request digital certificates by completing Digital Certificate Request Forms.

Digital certificates are used to connect a Product Provider’s 3DS ACS or 3DS Server software to Visa’s
3DS 2.0 Directory Server. Not all Products Providers will connect with Visa’s 3DS 2.0 Directory Server.

10 Visa Confidential March 2019

 Test Process
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

March 2019 Visa Confidential 11

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

2 3DS Server Test Cases

2.1 Frictionless Flow (Browser-based)

The 3DS Server Test Cases in this chapter are required for 3DS Server implementations in all Visa
Regions.

Test Case 3DSS-102-1001–Frictionless Flow, Browser, PA (Result=Y)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status Y in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020079"
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 1
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

1 Value provided by EMVCo after EMVCo 3DS testing.

12 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “Y”, ECI = “05” and CAVV.
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• Test case complete.

Test Case 3DSS-102-1002– Frictionless Flow, Browser, PA (Result=N)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status N in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020080"
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 2
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “N”, (ECI and CAVV fields will be
absent in the message).
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.

2 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 13

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

• Test case complete.

Test Case 3DSS-102-1003–Frictionless Flow, Browser, PA (Result=A)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status A in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020014"
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 3
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “A”, ECI = ‘06’ and CAVV.
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• Test case complete.

3 Value provided by EMVCo after EMVCo 3DS testing.

14 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case 3DSS-102-1004–Frictionless Flow, Browser, PA (Result=U)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status U in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020081”
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 4
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = "U" (ECI and CAVV fields will be
absent in the message).
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• Test case complete.

4 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 15

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case 3DSS-102-1005– Frictionless Flow, Browser, PA (Result=R)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status R in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020083”
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 5
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “R" (ECI and CAVV fields will be
absent in the message).
• Test case complete.

5 Value provided by EMVCo after EMVCo 3DS testing.

16 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case 3DSS-102-1006– Frictionless Flow, Browser, PA (Result=Error)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN as defined in the below step to
V3DSTS. V3DSTS will return an error message to the 3DS Server in response. 3DS Server (SUT)
accepts the error message, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020082”
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 6
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with an error message to 3DS Server, errorCode = "305".
• Test case complete.

6 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 17

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case 3DSS-201-2001–Frictionless Flow, Browser, NPA (Result=Y)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status Y in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020085”
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 7
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "02"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = "Y" (ECI and CAVV fields will be
absent in the message).
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• Test case complete.

7 Value provided by EMVCo after EMVCo 3DS testing.

18 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

2.2 Frictionless Flow (App-based)

Test Case 3DSS-102-3001–Frictionless Flow, App, PA (Result=Y)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status Y in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020090"
b. Device Channel "01"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 8
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
j. SDK Reference Number EMVCo provided8
Note: All other required fields (including the sdk* fields) must be included in the AReq and have a
valid value per the EMV 3-D Secure Core Specification. Any optional fields which are included
must also present a valid value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “Y" and ECI="05" (CAVV will be
present in the message)
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• Test case complete.

8 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 19

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case 3DSS-102-3002– Frictionless Flow, App, PA (Result=N)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status N in response. 3DS Server (SUT) accepts ARes, this completes the test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020089"
b. Device Channel "01"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 9
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
j. SDK Reference Number EMVCo provided9
Note: All other required fields (including the sdk* fields) must be included in the AReq and have a
valid value per the EMV 3-D Secure Core Specification. Any optional fields which are included
must also present a valid value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “N”, (ECI and CAVV fields will be
absent in the message).
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• Test case complete.

9 Value provided by EMVCo after EMVCo 3DS testing.

20 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

2.3 Challenge Flow (Browser-based)

Test Case 3DSS-103-1001-Challenge Flow, Browser, PA (Result=Y)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status C in response. 3DS Server (SUT) accepts ARes and challenge flow is initiated.

3DS Server (SUT) sends a CReq to V3DSTS. V3DSTS sends RReq with transaction status Y to 3DS
Server. 3DS Server (SUT) sends RRes to V3DSTS. V3DSTS sends final CRes with transaction status Y
to 3DS Server, this completes test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020006"
b. Device Channel "02"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 10
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields must be included in the AReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “C”.
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.

10 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 21

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

• 3DS Server (SUT) builds a CReq as follows:

- 3DS Server Transaction ID: (Same 3DS Server Transaction ID as AReq)
• 3DS Server (SUT) sends CReq to V3DSTS
• V3DSTS POSTs RReq to 3DS Server with transaction status = "Y" and ECI=”05” (CAVV will be
present in the message)
• 3DS Server (SUT) builds an RRes (resultsStatus = ‘01’), sends to V3DSTS
• V3DSTS sends final CRes to 3DS Server with transaction status = "Y"
• 3DS Server (SUT) confirms the CRes is received without any errors/issues
• Test case complete

22 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

2.4 Challenge Flow (App-based)

Test Case 3DSS-103-3001-Challenge Flow, App-Native, PA (Result=Y)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status C in response. 3DS Server (SUT) accepts ARes and challenge flow is initiated.

3DS Server (SUT) sends a CReq to V3DSTS. V3DSTS sends the challenge data elements though the
CRes message. V3DSTS sends RReq with transaction status Y to 3DS Server. 3DS Server (SUT) sends
RRes to V3DSTS. V3DSTS sends final CRes with transaction status Y to 3DS Server, this completes
test case.

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020086"
b. Device Channel "01"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 11
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"
h. Message Category "01"
i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields (including the sdk* fields) must be included in the AReq and have a
valid value per the EMV 3-D Secure Core Specification. Any optional fields which are included
must also present a valid value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “C”.

11 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 23

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• 3DS Server (SUT) builds a CReq as follows:
- 3DS Server Transaction ID: (Same 3DS Server Transaction ID as AReq)
• 3DS Server (SUT) sends CReq to V3DSTS
• V3DSTS sends CRes with the challenge data elements
• V3DSTS POSTs RReq to 3DS Server with transaction status = "Y" and ECI=”05” (CAVV will be
present in the message)
• 3DS Server (SUT) builds an RRes (resultsStatus = ‘01’), sends to V3DSTS
• V3DSTS sends final CRes to 3DS Server with transaction status = "Y"
• 3DS Server (SUT) confirms the CRes is received without any errors/issues
• Test case complete

Test Case 3DSS-103-3501-Challenge Flow, App-HTML, PA (Result=Y)

Description

The 3DS Server (SUT) will send an AReq with the 16-digit test PAN to V3DSTS. If the AReq is received
with all the mandatory fields without any errors/issues, V3DSTS will return the 3DS Server an ARes
with status C in response. 3DS Server (SUT) accepts ARes and challenge flow is initiated.

3DS Server (SUT) sends a CReq to V3DSTS. V3DSTS sends the challenge data elements though the
CRes message. V3DSTS sends RReq with transaction status Y to 3DS Server. 3DS Server (SUT) sends
RRes to V3DSTS. V3DSTS sends final CRes with transaction status Y to 3DS Server, this completes
test case

Action
1 3DS Server (SUT) builds AReq as follows:
a. PAN (Cardholder Account Number "4012000000020084"
b. Device Channel "01"
c. 3DS Requestor ID "V3DSTSReqTestID"
d. 3DS Requestor Name "V3DSTSReqTestName"
e. 3DS Server Reference Number EMVCo provided 12
f. Acquirer BIN 400551
g. Acquirer Merchant ID "V3DSTestSuite-12345678"

12 Value provided by EMVCo after EMVCo 3DS testing.

24 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

h. Message Category "01"

i. 3DS Server Operator ID "Product Provider’s BID"
Note: All other required fields (including the sdk* fields) must be included in the AReq and have a
valid value per the EMV 3-D Secure Core Specification. Any optional fields which are included
must also present a valid value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs AReq to V3DSTS.

Expected Results
• V3DSTS responds with ARes to 3DS Server, transaction status = “C”.
• 3DS Server (SUT) confirms the ARes is received without any errors/issues.
• 3DS Server (SUT) builds a CReq as follows:
- 3DS Server Transaction ID: (Same 3DS Server Transaction ID as AReq)
• 3DS Server (SUT) sends CReq to V3DSTS
• V3DSTS sends CRes with the challenge data elements
• V3DSTS POSTs RReq to 3DS Server with transaction status = "Y" and ECI=”05” (CAVV will be
present in the message)
• 3DS Server (SUT) builds an RRes (resultsStatus = ‘01’), sends to V3DSTS
• 3DS Server (SUT) confirms the CRes is received without any errors/issues
• Test case complete

March 2019 Visa Confidential 25

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

2.5 Operation Flow

Test Case 3DSS-101-1001–Preq (w/out Serial Number)

Description

The 3DS Server (SUT) will send a PReq to V3DSTS. If the PReq is sent without any errors/issues,
V3DSTS will return the 3DS Server a PRes with 10 ranges (all ranges currently in DS, due to the blank
serial number passed). 3DS Server accepts PRes, this completes the test case.

Action
1 3DS Server (SUT) builds PReq as follows:
a. 3DS Server Reference Number EMVCo provided 13
b. 3DS Server Operator ID "Product Provider’s BID"
c. Serial Number Not present
Note: All other required fields must be included in the PReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs PReq to V3DSTS.

Expected Results
• V3DSTS responds with PRes to 3DS Server, includes card ranges 1-10
• 3DS Server (SUT) confirms the PRes is received without any errors/issues
• Test case complete

13 Value provided by EMVCo after EMVCo 3DS testing.

26 Visa Confidential March 2019

 3DS Server Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case 3DSS-101-1002–Preq (with Serial Number)

Description

The 3DS Server (SUT) will send a PReq to V3DSTS. If the PReq is sent without any errors/issues,
V3DSTS will return the 3DS Server a PRes with 3 ranges (the ranges that have changed or been added
since the given Serial Number was returned). 3DS Server accepts PRes, this completes the test case.

Action
1 3DS Server (SUT) builds PReq as follows:
a. 3DS Server Reference Number EMVCo provided 14
b. 3DS Server Operator ID "Product Provider’s BID"
c. Serial Number value returned in test case 3DSS 101-1001
Note: All other required fields must be included in the PReq and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
2 3DS Server (SUT) POSTs PReq to V3DSTS.

Expected Results
• V3DSTS responds with PRes to 3DS Server, includes card ranges 11-13.
• 3DS Server (SUT) confirms the PRes is received without any errors/issues.
• Test case complete.

14 Value provided by EMVCo after EMVCo 3DS testing.

March 2019 Visa Confidential 27

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

3 ACS Test Cases

3.1 Frictionless Flow (Browser-based)

The ACS Test Cases below are required for Issuer ACS implementations in all Visa Regions. Each Visa
Region may also require additional test cases.

Test Case ACS-102-1001–Frictionless Flow, Browser PA (Result=Y)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status Y in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020022" 15

b. Expiration Date YYMM 16

c. Device Channel "02"
d. Message Category "01"
e. 3DS Server Operator ID "00000011"

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following (CAVV to be included in the message):
Transaction Status "Y"

ECI “05”

ACS Reference Number EMVCo provided

15 Default value, editable.

16 Default value, editable.

28 Visa Confidential March 2019

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

ACS Operator ID "Product Provider’s BID"

Note: All other required fields must be included in the ARes and have a valid value per the EMV 3- D
Secure 2.0 Protocol Specification. Any optional fields which are included must also present a
valid value per the EMV 3-D Secure Core Specification.
• ACS (SUT) sends ARes to V3DSTS.
• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

Test Case ACS-102-1002– Frictionless Flow, Browser PA (Result=N)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status N in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020093" 17

b. Expiration Date YYMM 18

c. Device Channel "02"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following (CAVV not to be included in the message):
Transaction Status "N"

Transaction Status Reason Code (applicable code)

ACS Reference Number EMVCo provided

ACS Operator ID "Product Provider’s BID"

17 Default value, editable.

18 Default value, editable.

March 2019 Visa Confidential 29

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Note: All other required fields must be included in the ARes and have a valid value per the EMV 3- D
Secure 2.0 Protocol Specification. Any optional fields which are included must also present a
valid value per the EMV 3-D Secure Core Specification.
• ACS (SUT) sends ARes to V3DSTS.
• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

Test Case ACS-102-1003–Frictionless Flow, Browser PA (Result=U) (Optional Test

Case)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status U in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020091" 19

b. Expiration Date YYMM 20

c. Device Channel "02"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following (CAVV not to be included in the message):
Transaction Status "U"

Transaction Status Reason Code (applicable code)

ACS Reference Number EMVCo provided

ACS Operator ID "Product Provider’s BID"

19 Default value, editable.

20 Default value, editable.

30 Visa Confidential March 2019

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Note: All other required fields must be included in the ARes and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
• ACS (SUT) sends ARes to V3DSTS.
• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

Test Case ACS-102-1004–Frictionless Flow, Browser PA (Result=R) (Optional Test

Case)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status R in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020092" 21

b. Expiration Date YYMM 22

c. Device Channel "02"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following (CAVV not to be included in the message):
Transaction Status "R"

Transaction Status Reason Code (applicable code)

ACS Reference Number EMVCo provided

ACS Operator ID "Product Provider’s BID"

21 Default value, editable.

22 Default value, editable.

March 2019 Visa Confidential 31

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Note: All other required fields must be included in the ARes and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
• ACS (SUT) sends ARes to V3DSTS.
• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

Test Case ACS-102-1005– Frictionless Flow, Browser PA (Result=Error)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an error message to V3DSTS, this completes the test case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020087" 23

b. Expiration Date YYMM 24

c. Device Channel "02"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"

Expected Results
• ACS (SUT) validates the AReq and creates the following error message.
Error Component Status "A"

Error Code “201”

Note: All other required fields must be included in the error message (including the description and
details of the error message) and have a valid value per the EMV 3-D Secure Core
Specification. Any optional fields which are included must also present a valid value per the
EMV 3-D Secure Core Specification.
• ACS (SUT) sends the error message to V3DSTS.
• Test case complete.

23 Default value, editable.

24 Default value, editable.

32 Visa Confidential March 2019

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Test Case ACS-102-2001– Frictionless Flow, Browser NPA (Result=Y)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status Y in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS 3DS Server builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020088" 25

b. Expiration Date YYMM 26

c. Device Channel "02"

d. Message Category "02"
e. 3DS Server Operator ID "00000011"

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following (CAVV may be included in the message):
Transaction Status "Y" 27

ACS Reference Number EMVCo provided

ACS Operator ID "Product Provider’s BID"

Note: All other required fields must be included in the ARes and have a valid value per the EMV 3-D
Secure Core Specification. Any optional fields which are included must also present a valid
value per the EMV 3-D Secure Core Specification.
• ACS (SUT) sends ARes to V3DSTS.
• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

25 Default value, editable.

26 Default value, editable.
27 ECI and CAVV values may be present.

March 2019 Visa Confidential 33

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

3.2 Frictionless Flow (App-based)

Test Case ACS-102-3001–Frictionless Flow, App PA (Result=Y)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status Y in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS 3DS Server builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020030" 28

b. Expiration Date YYMM 29

c. Device Channel "01"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"
Note: SDK related data elements will be present as per the requirements listed in 3-D Secure 2.0
Protocol Specification.

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following (CAVV to be included in the message):
Transaction Status "Y"

ECI “05”

ACS Reference Number EMVCo provided

ACS Operator ID "Product Provider’s BID"

Note: All other required fields (including the sdk* fields) must be included in the ARes and have a
valid value per the EMV 3-D Secure Core Specification. Any optional fields which are included
must also present a valid value per the EMV 3-D Secure Core Specification.

28 Default value, editable.

29 Default value, editable.

34 Visa Confidential March 2019

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

• ACS (SUT) sends ARes to V3DSTS.

• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

Test Case ACS-102-3002–Frictionless Flow, App PA (Result=N)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. The ACS (SUT) will validate the AReq
and return an ARes with status N in response. V3DSTS validates the ARes, this completes the test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS 3DS Server builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020094" 30

b. Expiration Date YYMM 31

c. Device Channel "01"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"
Note: SDK related data elements will be present as per the requirements listed in 3-D Secure 2.0
Protocol Specification.

Expected Results
• ACS (SUT) confirms that the AReq is received without any errors/issues.
• ACS (SUT) creates the ARes with the following:
Transaction Status "N"

Transaction Status Reason Code (applicable code)

ACS Reference Number EMVCo provided

ACS Operator ID "Product Provider’s BID"

30 Default value, editable.

31 Default value, editable.

March 2019 Visa Confidential 35

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Note: All other required fields (including the sdk* fields) must be included in the ARes and have a
valid value per the EMV 3-D Secure Core Specification. Any optional fields which are included
must also present a valid value per the EMV 3-D Secure Core Specification.
• ACS (SUT) sends ARes to V3DSTS.
• V3DSTS confirms that the ARes is received without any errors/issues.
• Test case complete.

36 Visa Confidential March 2019

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

3.3 Challenge Flow (Browser-based)

Test Case ACS-103-1001-Challenge Flow, Browser, PA (Result=Y, Challenge

Mandated)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. ACS (SUT) will validate that the AReq
is received with all the mandatory fields without any errors/issues and returns an ARes with status C
in response. V3DSTS accepts ARes and sends a CReq to the ACS (Challenge flow is initiated).

ACS (SUT) sends the challenge screen(s) and the user is authenticated successfully. ACS (SUT) sends
RReq with transaction status Y to V3DSTS. V3DSTS sends RRes to ACS. ACS (SUT) sends final CRes
with transaction status Y to V3DSTS, complete test case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020048" 32

b. Expiration Date YYMM 33

c. Device Channel "02"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"

3 ACS (SUT) confirms the AReq is received without any errors/issues.

4 ACS (SUT) creates ARes with the following and sends to V3DSTS
a. Transaction Status "C"
b. ACS Reference Number EMVCo-assigned ACS Reference Number
c. ACS Operator ID "Product Provider’s BID"

5 V3DSTS confirms the ARes is received without any errors/issues.

6 V3DSTS simulator builds and sends CReq to the ACS.
7 ACS (SUT) presents challenge screen(s).

32 Default value, editable.

33 Default value, editable.

March 2019 Visa Confidential 37

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

8 User authenticates successfully.

9 ACS (SUT) builds and sends RReq to V3DSTS with:
a. Transaction Status "Y"
b. ECI “05” and CAVV

Expected Results
• V3DSTS confirms that the RReq is received without any errors/issues.
• V3DSTS builds and sends the RRes as follows:
Results Status "01"

• ACS (SUT) confirms that the RRes is received without any errors/issues.
• ACS (SUT) sends final CRes with transaction status = "Y" to V3DSTS.
• Test case complete.

38 Visa Confidential March 2019

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

3.4 Challenge Flow (App-based)

Test Case ACS-103-3001-Challenge Flow, App-Native, PA (Result=Y, Challenge

Mandated)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. ACS (SUT) will validate that the AReq
is received with all the mandatory fields without any errors/issues and returns an ARes with status C
in response. V3DSTS accepts ARes and sends a CReq to the ACS (Challenge flow is initiated).

ACS (SUT) sends the CRes message with the challenge screen(s) data elements and the user is
authenticated successfully. ACS (SUT) sends RReq with transaction status Y to V3DSTS. V3DSTS
sends RRes to ACS. ACS (SUT) sends final CRes with transaction status Y to V3DSTS, complete test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020055" 34

b. Expiration Date YYMM 35

c. Device Channel "01"

d. Message Category "01"
e. 3DS Server Operator ID "00000011"

3 ACS (SUT) confirms the AReq is received without any errors/issues.

4 ACS (SUT) creates ARes with the following and sends to V3DSTS
d. Transaction Status "C"
e. ACS Reference Number EMVCo-assigned ACS Reference Number
f. ACS Operator ID "Product Provider’s BID"

5 V3DSTS confirms the ARes is received without any errors/issues.

6 V3DSTS simulator builds and sends CReq to the ACS.
7 ACS (SUT) presents challenge screen(s) using the CRes message.

34 Default value, editable.

35 Default value, editable.

March 2019 Visa Confidential 39

 ACS Test Cases
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

8 User authenticates successfully. V3DSTS inspects the value of ‘challengeCompletionInd’ in the CRes
message to conclude the exchange of CReq/CRes messages.
9 ACS (SUT) builds and sends RReq to V3DSTS with:
c. Transaction Status "Y"
d. ECI “05” and CAVV

Expected Results
• V3DSTS confirms that the RReq is received without any errors/issues.
• V3DSTS builds and sends the RRes as follows:
Results Status "01"

• ACS (SUT) confirms that the RRes is received without any errors/issues.
• ACS (SUT) sends final CRes with transaction status = "Y" to V3DSTS.
• Test case complete.

Test Case ACS-103-3501-Challenge Flow, App-HTML, PA (Result=Y, Challenge

Mandated)

Description

The V3DSTS will send an AReq with the 16-digit test PAN to ACS. ACS (SUT) will validate that the AReq
is received with all the mandatory fields without any errors/issues and returns an ARes with status C
in response. V3DSTS accepts ARes and sends a CReq to the ACS (Challenge flow is initiated).

ACS (SUT) sends the CRes message with the challenge screen(s) data elements and the user is
authenticated successfully. ACS (SUT) sends RReq with transaction status Y to V3DSTS. V3DSTS
sends RRes to ACS. ACS (SUT) sends final CRes with transaction status Y to V3DSTS, complete test
case.

Action
1 ACS user logs in to V3DSTS and runs the test case.
2 V3DSTS builds an AReq as follows and sends to ACS:
a. PAN (Cardholder Account Number "4012000000020063" 36

b. Expiration Date YYMM 37

c. Device Channel "01"

36 Default value, editable.

37 Default value, editable.

40 Visa Confidential March 2019

 Review Test Results
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

d. Message Category "01"

e. 3DS Server Operator ID "00000011"

3 ACS (SUT) confirms the AReq is received without any errors/issues.

4 ACS (SUT) creates ARes with the following and sends to V3DSTS
a. Transaction Status "C"
b. ACS Reference Number EMVCo-assigned ACS Reference Number
c. ACS Operator ID "Product Provider’s BID"

5 V3DSTS confirms the ARes is received without any errors/issues.

6 V3DSTS simulator builds and sends CReq to the ACS.
7 ACS (SUT) presents challenge screen(s) using the CRes message.
8 User authenticates successfully. V3DSTS inspects the value of ‘challengeCompletionInd’ in the CRes
message to conclude the exchange of CReq/CRes messages.
9 ACS (SUT) builds and sends RReq to V3DSTS with:
a. Transaction Status "Y"
b. ECI “05” and CAVV

Expected Results
• V3DSTS confirms that the RReq is received without any errors/issues.
• V3DSTS builds and sends the RRes as follows:
Results Status "01"

• ACS (SUT) confirms that the RRes is received without any errors/issues.
• ACS (SUT) sends final CRes with transaction status = "Y" to V3DSTS.
• Test case complete.

4 Review Test Results

4.1 3DS Server

3DS Server Product Providers drive their test cases by sending AReq messages with the required
cardholder account number to V3DSTS Directory Server. After running their test cases, they must
review the Testing Status page. If there are any required test cases that they have not passed, they
must review their results to see why they failed - V3DSTS will specify when and why the Product

March 2019 Visa Confidential 41

 Review Test Results
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Provider failed a test case. In order to successfully complete testing and request their V3DSTS
Compliance Letter, they must rerun their test cases until they have passed them all. Successful
completion of optional test cases is not required to obtain a compliance letter.
Note: The Testing Status page lists test cases and their most recent status (e.g. Passed, Pending,
Failed, etc.). The Testing History page shows all attempts of a test case.

4.2 ACS

ACS Product Providers drive their test cases through V3DSTS UI. After running their test cases, they
must review the Testing Status page. If there are any required test cases that they have not passed, they
must review their results to see why they failed - V3DSTS will specify when and why the Product
Provider failed a test case. In order to successfully complete testing and request their V3DSTS
Compliance Letter, they must rerun their required test cases until they have passed them all.
Note: The Testing Status page lists test cases and their most recent status (e.g. Passed, Pending,
Failed, etc.). The Testing History page shows all attempts of a test case.

42 Visa Confidential March 2019

 Review Test Results
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

March 2019 Visa Confidential 43

 CAVV Validation
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

A CAVV Validation

ACS software vendors are required to execute the CAVV validation test case in V3DSTS.

ACS software vendors shall use the CAVV validation feature available in V3DSTS to accomplish the
below two objectives:
• To confirm that the ACS is able to generate a properly formatted CAVV.
• To confirm that the ACS is capable of selecting the correct CAVV position 2 value to match the
authentication method used to authenticate the consumer.

Steps involved in performing CAVV validation and the expected results:

Step 1: ACS user clicks the link named "Validate CAVV" on the left hand side menu and a form is
presented to the user.

Step 2: The ACS user provides all the required data fields mentioned below and clicks submit:
a. CAVV
b. ECI
c. Account #
d. Expiry Date
e. Authentication Method1 (user chooses the method from the drop down that they support)
Note: The easiest way for an ACS Product Provider to obtain a CAVV, ECI, and Account # is to run
required test case ACS-102-1001. These data fields will be a part of the ARes message
available to the user when the required test case is successfully completed in V3DSTS.
The ACS Product Provider may also use a CAVV, ECI, and Account # from any other test
transaction they conduct that provides these values.
Note: If an ACS software vendor does not have any issuers who use their software, then the ACS can
use the VisaNet Certification Management Service (VCMS) test bins and keys (provided in the
next section of this users guide). Please contact gctv3dsts@visa.com for more information.

Step 3: V3DSTS sends the above fields to VCMS. Visa will provide the validation results. If any of the
above fields are not provided in the basic format expected, there will be an error displayed on
the screen.

Step 4: Based on the validations above, VCMS sends the results to V3DSTS and V3DSTS displays the
CAVV validation results to the user.

Step 5: User is provided with the below results and the fields displayed below are based on the
CAVV and other fields that are provided in the previous step.

44 Visa Confidential March 2019

 CAVV Validation
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

a. Response Source
b. Action Code
c. CAVV results Code.
Note: Please refer to CAVV guide and VIP tech manual for more details on the result codes and the
related fields.

Step 6: Based on the CAVV results code obtained from VCMS, the testing status/history pages are
updated.

Step 7: If all the required test cases are complete, the user shall be able to click on the conclude
testing link to request for compliance letter.

VCMS Keys

Key Type Clear Key Components Encrypted Value Key Check Value
CAVV-A 0131 5170 1020 4061 6AFDC50C75277837 4E C4 DC
CAVV-B 91B0 D0F1 80A1 C1E0 019D0CAF0F61A7FC 08 0D E7

March 2019 Visa Confidential 45

 Error Codes
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

B Error Codes

B.1 EMVCo Error Codes

From Section A.5.5 EMV 3DS Specification:

Table B–1: EMVCo Error Codes

Value Error Code Error Description Error Detail

101 Message Received One of the following: One of the following:

Invalid • Message is not AReq, ARes, • Invalid Message Type
CReq, CRes, PReq, PRes, • Invalid Message for the receiving
RReq, or RRes component
• Valid Message Type is sent to • Invalid Formatted Message
or from an inappropriate
component (such as AReq
message being sent to the
3DS Server)
• Message not recognised

102 Message Version Message Version Number All supported Protocol Version
Number Not received is not valid for the Numbers in a comma delimited list.
Supported receiving component.

103 Sent Messages Limit Exceeded maximum number of For example, the 3DS Server sends two
Exceeded PReq messages sent to the DS. PReq messages to the DS within one
hour

201 Required Data Element A message element required as Name of required element(s) that was
Missing defined in Table A.1 is missing omitted; if more than one element is
from the message. detected, this is a comma delimited
list.
Parent Example:
messageType
Parent/Child Example:
acctInfo.chAccAgeInd

202 Critical Message Critical message extension not ID of critical Message Extension(s) that
Extension Not recognised. was not recognised; if more than one
Recognised extension is detected, this is a comma
delimited list of message identifiers
that were not recognised.

46 Visa Confidential March 2019

 Error Codes
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Value Error Code Error Description Error Detail

203 Format of one or more • Data element not in the Name of invalid element(s); if more
Data Elements is required format or value is than one invalid data element is
Invalid according to invalid as defined in Table detected, this is a comma delimited
the Specification A.1, or list.
• Message Version Number
does not match the value set
by the 3DS Server in the AReq
message.

204 Duplicate Data Valid data element presents more Name of duplicated data element; if
Element than once in the message. more than one duplicate data element
is detected, this is a comma delimited
list.

301 Transaction ID Not Transaction ID received is not The Transaction ID received was
Recognised valid for the receiving component. invalid.

302 Data Decryption Data could not be decrypted by Description of the failure.
Failure the receiving system due to
technical or other reason.

303 Access Denied, Invalid Access denied, invalid endpoint. Description of the failure.
Endpoint

304 ISO Code Invalid ISO code not valid per ISO tables Name of invalid element(s); if more
(for either country or currency), or than one invalid element is detected
code is one of the excluded this is a comma delimited list
values listed in Table A.5. If Challenge Request.
Purchase.currency and Challenge
Request.Purchase.exponent form an
invalid pair, list both as Error
Description.

305 Transaction data not If in response to an AReq Name of element(s) that caused the
valid message: ACS to decide that the AReq message
• Cardholder Account Number or CReq message was incorrectly sent;
is not in a range belonging to if more than one invalid element is
Issuer detected this is a comma-delimited list.
If in response to a CReq, and a
CReq message was incorrectly
sent, one of the following:
• CReq message was received
by the wrong ACS

March 2019 Visa Confidential 47

 Error Codes
Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

Value Error Code Error Description Error Detail

• CReq message was not sent,
based on the values in the
ARes message
• CReq message with this ACS
Transaction ID has already
been received and processed

306 Merchant Category Merchant Category Code (MCC) For example, Invalid MCC received in
Code (MCC) Not Valid not valid for Payment System. the AReq message.
for Payment System

307 Serial Number not Serial Number not valid. For example, Invalid Serial number in
Valid the PReq/PRes message (e.g., too old,
not found).

402 Transaction Timed Out Transaction timed-out. For example, Timeout expiry reached
for the transaction as defined in
Section 5.5.

403 Transient System Transient system failure. For example, a slowly processing back-
Failure end system.

404 Permanent System Permanent system failure. For example, a critical database cannot
Failure be accessed.

405 System Connection System connection failure. For example, the sending component
Failure is unable to establish connection to the
receiving component.

48 Visa Confidential March 2019

 Visa’s 3-D Secure Test Suite (V3DSTS) User’s Guide

March 2019 Visa Confidential 49