ECI IndicatorClarifying 3DS Response Codes for Online Retail

The Importance of ECI Indicators: How to Interpret 3DS Transaction Responses

Is credit card authorization really that complicated? After all, a customer inserts or taps a card, and a sale is either approved or denied by the bank. Isn’t that all there is to it?

Well, not really.

The authorization response you receive can instruct you to proceed in a few different ways. Plus, if you deploy 3-D Secure (or “3DS”) during the transaction, you also have the ECI indicators to consider as well. As we’ll explore below these numeric indicators are just one of the many potential values that could assist or complicate the checkout process for your business.

What is an ECI Indicator?

Chargebacks

[noun]/ē • cē • ī • in • duh • kāy • tər/

In simple terms, an Electronic Commerce Indicator (ECI) is basically a 3-D Secure response code. The ECI value tells you what to do next in a 3DS transaction — proceed, reject the purchase, or try again.

When a customer who's enrolled with 3-D Secure from their bank initiates a purchase, the tool will deploy during the checkout process. It prompts the cardholder to enter more information as a way to validate their identity.

The ECI indicator is a figure provided by the Directory Server and the Access Control System (ACS). It signifies the result of the authentication request made for 3DS transactions. This ECI value serves as a guide for merchants, helping them decide whether to move forward with a transaction. 

Basically, standard credit card authorizations are accompanied by a string of numbers either approving or denying the transaction. ECI indicators are like an extra authorization step that incorporates 3DS technology into the checkout process.

ECI indicators appear as simple two-digit codes. However, the codes can vary from one card network to the next, as we’ll see below.

List of ECI Indicators

Next, let’s go over the more common ECI indicator responses, broken up by what the response in question means. We’ll illustrate what the codes look like, and give their uses and explanations for each card network.

Can you Charge a Credit Card Without an ECI Indicator?

Not anymore. Most processors now require an ECI indicator as part of the authentication process. So, without an ECI indicator to authorize the request, the transaction will be declined.

Violating this requirement and trying to bypass requirements to run transactions without an ECI indicator could result in fines. It could also result in your account being terminated, and you being blacklisted from accepting credit cards in the future.

It’s worth noting that the assignment of an ECI indicator happens within the point-of-sale system that the seller uses. Visa and Mastercard strictly mandate that online sellers should not employ any software or devices that fail to support the Electronic Commerce Indicator.

Finally, any credit card information sent over email is considered a transaction that necessitates the inclusion of the ECI when it's processed by the bank.

What if a Customer Isn't Enrolled in 3DS?

This is what those "Authentication Attempted" indicator codes are for.

You must still attempt 3DS with every card-not-present transaction. If you get this response, you may still proceed, as you have fulfilled your duty under 3DS requirements.

For card-not-present transactions, you’d likely be using software or a payment gateway to process transactions. However this is done, remember that Visa and Mastercard both require online merchants to use software or equipment that supports Electronic Commerce Indicators.

If your software sends an ECI with values of 5, 6, or 7, these transactions are marked as secure ECI transactions. However, if the ECI value sent is 8 or 9, it means you’re processing the card data in an insecure manner.

It’s important that you comply with 3DS requirements. Visa and MasterCard have hundreds of employees whose main role is to identify web merchants violating this policy. Infringements could lead to fines, termination of your account, or even landing you on a blacklist for credit card acceptance. 

What About Brick-&-Mortar Purchases?

3-D Secure — and, as a result, ECI indicators — are only used in eCommerce. As a result, they have no relevance for brick-and-mortar retail.

The industry has other solutions in place to make it easier to validate card-present buyers. Examples include:

Of course, you’ll also need to deploy other solutions and practices yourself to stop fraud in this environment, like ensuring your card readers are EMV compliant. To illustrate, a few best practices we recommend include:

All Part of a Broader Strategy

Remember: fraud and chargeback prevention requires a multi-faceted approach.

The best strategies often involve a combination of these and other measures. On the other hand, for online merchants, 3DS and ECI indicators can be valuable, useful tools. They just won’t be enough to keep your business safe on their own. 

Your fraud prevention solutions must be augmented by other indicators, which often include additional verification steps and tools to tackle other threat sources. For instance, 3DS can’t predict or prevent an act of friendly fraud.