EMV 3-D Secure (3DS) - Payment Authentication Protocol V.3: V.3 Decoupled authentication and decoupled authentication fallback

The requestor states its stance in the Decoupled Request Indicator: Y (preferred as the primary challenge, status D in the ARes), F (fallback only, status D in the RReq), B (either) or N (not used; also the reading when absent), and, for Y, F or B, a Decoupled Max Time of 1 to 10,080 minutes. An ACS choosing decoupled authentication returns status D with the ACS Decoupled Confirmation Indicator Y (not allowed when the requestor said N; N is invalid with status D), the authentication method and Cardholder Information Text, and stores the 3DS Server and DS Transaction IDs; it starts a timer on the maximum time, authenticates the cardholder by means outside the protocol, and sends an RReq at once when it has a result, or with status U when the time runs out, within a one-hour grace period (reason 24 or 26 and cancellation value 03 recommended), one RReq for every ARes with status D. The 3DS Server waits at least the maximum time plus one hour and 30 seconds and otherwise treats the attempt as failed. In 3RI, decoupled is the only challenge. Fallback, when the requestor sent F or B: after a challenge the ACS may decide decoupled authentication is needed, tells the cardholder through the information template before the final CRes, sends the RReq with status D and reason 29 or 30 and puts D in the final CRes; the 3DS Server answers with Results Message Status 04 and within 60 seconds starts a 3RI authentication with 3RI Indicator 19, Decoupled Request Indicator Y and the prior reference set to the ACS Transaction ID of that RReq with prior method 02. The ACS's decoupled user interface is outside the protocol; for mail and telephone orders an agent may read the cardholder text aloud.