EMV 3-D Secure (3DS) - Payment Authentication Protocol V.10: V.10 Out-of-band in the browser channel, repeated CReqs and iframe conduct

In the browser channel an OOB challenge follows the standard browser flow: the ACS page in the challenge iframe tells the cardholder how to complete the OOB step, and the OOB method itself is outside the specification. If the ACS receives more than one CReq for a transaction it either restarts or continues the challenge, or returns an Error Message when it can do neither. The ACS must not take the cardholder out of the authentication flow to registration or marketing pages, may redirect only for authentication and inside the iframe, and loads only external resources that improve the experience or security (such as logos). EMVCo's White Paper V2 adds recommendations for mobile browsers, which may suspend or reload the tab: the ACS checks the OOB result itself and sends the RReq as soon as authentication completes, the 3DS Server pushes the RReq outcome to the requestor at once, and the requestor restores the challenge iframe and re-posts the same CReq after a restart.