On This Page

Authorizations with Strong Customer Authentication Exemption

This section shows you how to process an authorization with a strong customer authentication (SCA) exemption.
You can use SCA exemptions to streamline the payment process. SCA exemptions are part of the European second Payment Services Directive (PSD2) and allow certain types of low-risk transactions to bypass additional authentication steps while still remaining compliant with PSD2. You can choose which exemption can be applied to a transaction, but the card-issuing bank actually grants an SCA exemption during card authentication.
You can process an authorization with two types of SCA exemptions:
  • Exemption on Authorization
    : Send an authorization without payer authentication and request an SCA exemption on the authorization. If it is not approved, you may be required to request further authentication upon retry.
  • Exemption on Authentication
    : Request an SCA exemption during payer authentication and if successful, send an authorization including the SCA exemption details.
Depending on your processor, use one of these exemption fields:
If you send more than one SCA exemption field with a single authentication, the transaction is denied.
  • Authentication Outage
    : Payer authentication is not available for this transaction due to a system outage.
  • B2B Corporate Card
    : Payment cards specifically for business-to-business transactions are exempt.
  • Delegated Authentication
    : Payer authentication was performed outside of the authorization workflow.
  • Follow-On Installment Payment
    : Installment payments of a fixed amount are exempt after the first transaction.
  • Follow-On Recurring Payment
    : Recurring payments of a fixed amount are exempt after the first transaction.
  • Low Risk
    : The average fraud levels associated with this transaction are considered low.
  • Low Value
    : The transaction value does not warrant SCA.
  • Merchant Initiated Transactions
    : As follow-on transactions, merchant-initiated transactions are exempt.
  • Stored Credential Transaction
    : Credentials are authenticated before storing, so stored credential transactions are exempt.
  • Trusted Merchant
    : Merchants registered as trusted beneficiaries.

Fields Specific to the Strong Customer Authentication Exemptions

Use one of these fields to request an SCA exemption:
ccAuthService_authenticationOutageExemptionIndicator
Exemption type: Authentication Outage
Value:
1
ccAuthService_secureCorporatePaymentIndicator
Exemption type: B2B Corporate Card Transaction
Value:
1
ccAuthService_ delegatedAuthenticationExemptionIndicator
Exemption type: Delegated Authentication
Value:
1
ccAuthService_riskAnalysisExemptionIndicator
Exemption type: Low Risk Transaction
Value:
1
ccAuthService_lowValueExemptionIndicator
Exemption type: Low Value Transaction
Value:
1
ccAuthService_trustedMerchantExemptionIndicator
Exemption type: Trusted Merchant Transaction
Value:
1

Country-Specific Requirements

These fields are specific to certain countries and regions.
Argentina
billTo_merchantTaxID
Required for Mastercard transactions.
transactionLocalDateTime
Required when the time zone is not included in your account. Otherwise, this field is optional.
Brazil
billTo_personalID
Required for combo card transactions.
ccAuthService_overridePaymentDetails
Required for combo card line-of-credit and prepaid-card transactions.
Chile
billTo_merchantTaxID
Required for Mastercard transactions.
Paraguay
billTo_merchantTaxID
Required for Mastercard transactions.
Saudi Arabia
transactionMode
Taiwan
card_hashedAccountNumber

Endpoint

Set the
ccAuthService_run
 field to
true
.
Send the request to
https://ics2ws.ic3.com/commerce/1.x/transactionProcessor
.

Required Fields for Processing an Authorization with an SCA Exemption

Use these required fields for processing an authorization that includes an SCA exemption.
When relaxed requirements for address data and the expiration date are being used, not all fields in this list are required. It is your responsibility to determine whether your account is enabled to use this feature and which fields are required. For details about relaxed requirements, see Relaxed Requirements for Address Data and Expiration Date in Payment Transactions.
billTo_city
billTo_country
billTo_email
billTo_firstName
billTo_lastName
billTo_postalCode
billTo_state
billTo_street1
card_accountNumber
card_expirationMonth
card_expirationYear
ccAuthService_run
Set the value to
true
.
merchantID
merchantReferenceCode
purchaseTotals_grandTotalAmount

Simple Order Example: Processing an Authorization with an SCA Exemption for Low Value Transactions

Request
<requestMessage>
  <merchantID>{{merchantID}}</merchantID>
  <merchantReferenceCode>Postman-{{$timestamp}}</merchantReferenceCode>
  <billTo>
    <firstName>John</firstName>
    <lastName>Doe</lastName>
    <street1>1295 Charleston Road</street1>
    <city>Mountain View</city>
    <state>CA</state>
    <postalCode>94043</postalCode>
    <country>US</country>
    <email>
null@cybersource.com
</email>
  </billTo>
  <purchaseTotals>
    <currency>USD</currency>
    <grandTotalAmount>1.01</grandTotalAmount>
  </purchaseTotals>
  <card>
    <accountNumber>4111111111111111</accountNumber>
    <expirationMonth>12</expirationMonth>
    <expirationYear>2023</expirationYear>
    <cardType>001</cardType>
  </card>
  <ccAuthService run="true"/>
</requestMessage>
Response to a Successful Request
<c:replyMessage>
  <c:merchantReferenceCode>Postman-1666374834</c:merchantReferenceCode>
  <c:requestID>6663748348516429203007</c:requestID>
  <c:decision>ACCEPT</c:decision>
  <c:reasonCode>100</c:reasonCode>
  <c:purchaseTotals>
    <c:currency>USD</c:currency>
  </c:purchaseTotals>
  <c:ccAuthReply>
    <c:reasonCode>100</c:reasonCode>
    <c:amount>1.01</c:amount>
    <c:authorizationCode>888888</c:authorizationCode>
    <c:avsCode>X</c:avsCode>
    <c:avsCodeRaw>I1</c:avsCodeRaw>
    <c:authorizedDateTime>2022-10-21T17:53:54Z</c:authorizedDateTime>
    <c:processorResponse>100</c:processorResponse>
    <c:reconciliationID>66737280B9CGUCCP</c:reconciliationID>
    <c:paymentNetworkTransactionID>123456789619999</c:paymentNetworkTransactionID>
  </c:ccAuthReply>
  <c:card>
    <c:cardType>001</c:cardType>
  </c:card>
</c:replyMessage>