3D Secure for Payeezy through CardinalCommerce

[tymolls]

Hello,

We use the OmniPay/FirstData_Payeezy plugin to process payments. This works great.

We are now interested in enabling 3D secure, and have received the relevant credentials from CardinalCommerce. When we enable 3D secure in Payeezy, it does not route all payments through 3D secure.

Is there anything else we need to do in the code to activate 3D secure for Payeezy?

Thanks

[delatbabel]

As the author of FirstData_Payeezy, I have never been able to test this due to never having had 3D secure credentials. So the simple answer is that I don't know what else needs to be done in code. Is there a test credential that you can use for testing to see what's going on in a more verbose mode?

The only other comment I will make is:

it does not route all payments through 3D secure.

(my emphasis added)

That is what I would expect. Payments are only routed through 3D secure when the cardholder has signed up for 3D secure with their payment provider. There are some issues with 3D secure that were widely published some time ago and that caused a lot of cardholders to disable 3D secure at their bank.

[tymolls]

@delatbabel we got in touch with CardinalCommerce and Payeezy, and it seems that we first need to route the transaction to CardinalCommerce for 3D secure authentication, then send the data, along with Cardinal's 3D secure response (CAVV etc) to Payeezy for authorisation.

We've been given two different integration guides. One for CardinalCommerce and another for Payeezy. This is unlike the experience with SagePay, where SagePay handles both the authentication and authorisation.

We'll be forking the Payeezy code and adding the authentication bit to it.

[delatbabel]

OK that sounds complex but it's starting to be the way of the world these days. It's not uncommon for a payment provider to hand off the transaction to a third party fraud checking service before attempting to process the transaction, and more of those fraud checking services are marketing themselves to eCommerce sites so that the fraud checking is handled by the merchant side. Having the 3D secure authentication handed off to a third party isn't so far different from that process.

Only one piece of advice there, and that is to have the two parts of the process callable as separate endpoints. As the process of checking, verifying and authenticating payments gets more complex it's more likely that eCommerce sites are going to want to background all or part of that process, to provide a better customer experience (rather than having the customer wait with their browser ticking over for a minute or more while this all happens). So we should provide the facility to be able to queue and background parts of the process that don't require specific customer interaction.