With the advent of
In support of the card networks' EMVCo standards body, UL is helping push merchant adoption of 3-D Secure 2.0 through its upgraded Self-Test Platform to test and approve elements of the new security tool. The platform helps merchants implement 3-D Secure more quickly by testing the automation process, ensuring it is user friendly and can scale to the merchants' needs.
The opportunity for UL is to separate the baggage of the 3-D Secure name from the advancements of its 2.0 revision.
"The brands and payments service providers will have to spend some time on the educational side to explain that 3-D Secure 2.0, even though it has the same name as the previous version, is a completely new technology," said Vini Mesquita, UL's global product manager for the Identity Management & Security unit.
"There are new transaction flows, new messages and more data movement," Mesquita said.
Chicago-based UL brought its security testing and certification expertise to the payments landscape four years ago when seeking to
"Our company has a strong brand when it comes to power certification in a physical world," Mesquita said. "In looking at different things in different domains, we are also moving into this digital space."
The work UL is doing with 3-D Secure testing and advancement represents "just one piece in a big puzzle" that shows the company understands the important of a future digital commerce, Mesquita added.
"Security for payments or any kind of transaction is a way to reinforce our mission, whether it is payments or other domains, and we are definitely moving into the data space," he said.
Digital commerce will call for more standards-based certification as consumer devices are used more and more to facilitate both payments and authentication, said Julie Conroy, research director and fraud expert with Boston-based Aite Group.
"Right now, there is quite a bit of chaos on the edges of payments, with so many different types of devices, from smartphones to Alexa, being used to initiate transactions and authentication," Conroy said. "There is a bit of a gap from a standards and certification perspective, and I could see a role for an entity like UL there."
UL has been down the EMV road before, partnering with payment processors at the time of the U.S.
In that regard, UL has vast experience in helping merchants and card issuers feel secure in their authentication methods.
"We need to remember that 3-D Secure is all about authentication," UL's Mesquita said. "The security part is supposed to be a given, so the consumer doesn't have to think about that, and I believe UL is playing an important role in this domain."
The UL testing platform helps merchants get in a position to take advantage of the faster and more secure transactions that will occur because of extra data being passed onto to the card issuer during authorization.
"The merchants have a really important role in this story," Mesquita said. "And it's not just about using the new system, but about passing along the information that the issuer will be using."
As much as 80 percent of the new data fills on 3-D Secure are not mandatory for the merchant, Mesquita said, but the premise is that the more information about the customer that is passed along to the issuer, the more accurate the authorization process will be.
It's too early in the 3-D Secure upgrade process for merchants to provide a lot feedback, Mesquita added. "Right now, they are learning more about its real benefits and what it takes to be compliant," he said.
Mesquita understands there might be some reluctance from e-commerce merchants at first because the initial version of 3-D Secure was so cumbersome — requiring consumers to remember a separate password tied to their payment card — that it often led to cart abandonment.
"I know how hard it was before," he added. "But it is really nice to see this version moving forward, and the providers and issuers are learning how to address any questions and explain the new features."
The Identity Management & Security unit of UL was previously called UL Transaction Security. The new brand took effect two months ago.
