3D Secure support in the UK

lithumdavelithumdave Member
in Bugs & Feature Requests edited December 2009
Please excuse my ignorance here, I've no idea how these things work :)

I'm based in the UK and am using FoxyCart with PayPal Pro with no problems. I'm about to upgrade to be able to use debit cards too - excellent!

I've had emails from PayPal saying that I need to implement 3D Secure on the website in order to be able to process Maestro debit cards. I notice from other messages on the forum that FoxyCart doesn't yet support 3D Secure.

My question is: is it a case of having to wait till you support 3D Secure, or is it something I/we can put in place?

I admit, I was delighted to finally be able to say to my nagging client "Great, you can now accept Maestro cards!" only almost immediately to have to say "Oh no you can't after all".

Any light you can shed on what it entails would be appreciated. I know you don't give ETAs for these things, but... do you have an ETA? My client is about to have my guts for garters.

Many thanks!

  • brettbrett FoxyCart Team
    It's a good question. 3dsecure is something that PayPal has _not_ supported until recently (or soon? I'm still not 100% sure), so it's kind of silly for PayPal to _now_ (after they've ignored the 3d secure "requirements" for so long) to get all strict about it.

    To be honest, we're not sure about exactly whether or not 3d secure is required, recommended, or in between. We've spent a lot of time on it, but we've heard a lot of conflicting information. Can you perhaps send or whisper me any specifics that PayPal is telling you? It might also be worth looking into PayPoint, or at least checking with them to see what they say. Definitely let us know. Again, we've had many discussions about 3dsecure, but in the absence of a clear answer we didn't feel comfortable implementing something that'd delay our v060 release.
  • Hi Brett, thanks for the reply.

    I agree, for PayPal to staunchly NOT support 3D Secure and then insist that it be implemented seems a bit rich to me too.

    Here's the email we've received from PayPal:


    "We’ve noticed that you haven’t yet set up 3-D Secure on your website. As previously communicated, please be aware that as of 21 January 2010, you will not be able to process Maestro payments through UK Website Payments Pro – Direct Credit Card Payments without 3-D Secure technology. This is due to MasterCard Compliance rules.

    It is important that before this date you remove the Maestro option as a card type on your Card deposit page. This will ensure you keep declines to a minimum, maintain conversion and provide a good experience for your customers.

    Want to continue to process Maestro transactions?

    If you want to continue processing Maestro transactions after 21 January 2010, you must implement 3-D Secure. PayPal does not charge for the use of 3-D Secure and nor does Cardinal Commerce, our chosen 3-D Secure technology provider."


    They then provide a link to a page on their website about 3D Secure - https://www.paypal-business.co.uk/3dsecure.asp

    Especially pertinent is the 'What do I have to do?' link further down the page.

    So basically, we can't have Maestro as a card option on the site without 3D Secure being in place, hence my slight despair regarding telling my client we could now accept Maestro :\

    I don't think looking into Pay Point would make much difference, it's Mastercard who are stipulating the inclusion of 3D Secure, not PayPal. But yes, PayPal most definitely supports 3D Secure now.

    Having seen their information on it now, does that still mean we need to wait for FoxyCart to implement 3D Secure?

  • brettbrett FoxyCart Team
    We'll discuss this a bit more on our end. Thanks for bringing it to our attention, including what PayPal is communicating. That's always helpful.
  • Cheers Brett - let me know if there are any decisions (firm or otherwise) made at your end, just because I'd like to give my client as clear expectations as possible. I appreciate you can't give any firm promises/roadmaps.

  • Just thought it might help if I update you on PayPoints position regarding 3D Secure for UK Maestro Cards. They said in an email when we joined them that we would require 3D Secure to be able to take Maestro payments online, however I've left the option for 3D Secure off in my Paypoint account for now and we seem to be processing Maestro payments fine without 3D Secure in place at the moment. But I think like PayPal they will start to stop allowing us to take Maestro payments online without 3D Secure sometime very soon. Like Dave, it would be great to know if you are planning to implement 3D Secure in the future as although it is not one of the most popular payment cards in the UK, I have one and have never come across anywhere online or in store that didn't accept it!

  • brettbrett FoxyCart Team
    Update from us: I have a call with PayPoint next week to discuss some things (they're very friendly, though the time difference is just about perfectly wrong for good communication), and one of our team members has started compiling everything he can find on 3dsecure. We aren't in a position yet to make any promises, but we are continuing to explore things.
  • Thanks Brett. Hopefully what works for PayPoint will also work for PayPal too :)
  • brettbrett FoxyCart Team
    edited December 2009
    Another update:
    We're exploring options, and are wondering what you guys would like to see as far as when 3d secure would be used. Options as we see them are:
    * Don't use it (default/only option for most gateways at this point)
    * Use it only where required (Maestro)
    * Use it for Maestro, Solo, Visa Electron (non-credit debit cards)
    * Use it for all credit and debit cards

    3D Secure is required for Maestro. Depending on your account and such you _may_ get a 0.5-0.85% extra charge on all transactions without 3D Secure (according to PayPoint; again, they're super nice and helpful on their end). So on the one hand, you may want to use it everywhere. On the other hand, I can't imagine it helps conversions (at all), so I could also see only wanting to use it where absolutely necessary. Depending on your volume and average transaction values it may be _much_ better to pay 0.5% rather than have it negatively impact conversions.

    So... thoughts on that? We're continuing to devote considerable time on our end to getting a solid solution.

    Oh, also worth noting is that we plan on implementing 3D Secure in a *box modal window (like the Thickbox cart, though we're not sure we'll use Thickbox, as we're moving away from that in the future (see this thread). Yes, there are issues with doing it that way, but using an iframe is a pretty standard treatment for 3DS, and the URL being visible to the user on the 3DS page is awkward anyway, as it's not the bank's URL, not Visa nor MC's URL, and not the gateway's URL (as far as we've seen thus far, at least), so it's a really awkward system from a security and anti-phishing POV to begin with.
  • Thanks for the update Brett.

    From the point of view of the client we're working with at the moment, they want 3D Secure available for all transactions with all cards. They say they've been the victim of around £2000 worth of fraud in the last 3 months alone and think it would go some way to solving that problem.

    In fact, although they do want 3D Secure so that they can offer Maestro as a card option, the need to provide it for all cards is far more important.

    I've explained what a royal PITA 3D Secure is for the user but they're convinced the trade off in increased security is worth it.
  • Thanks very much for such a detailed update Brett, like you we have been really impressed by PayPoint's support. From our point of view our products don't really attract fraud problems, but the demographic we tend to sell to can get confused, which is why we chose Foxycart - to keep it simple! From our point of view we definitely only want to have to use 3D Secure if we have to to - so at the moment only for Maestro, as otherwise I can see it causing lots of drop outs at the checkout, which we will either lose or have to process over the phone.

    Thanks again for looking into it. Have a great Christmas!
  • brettbrett FoxyCart Team
    Thanks for the feedback. It sounds like our plan is at least flexible enough for the two situations above. We're continuing to explore the implementation, so please check back here or ask for an update if you need.
  • Thanks Brett! Just to say, we'd happily move over from PayPal to PayPoint at a moment's notice if it was a case of being able to implement it for PayPoint but not PayPal. I'm not sure that would be desirable for you or even possible, but just to let you know.

    I'll keep checking here, thanks again.
  • Hi guys, just wondered if there's any update on the situation? I've just launched my site recently and things are going great, i'm very pleased with Foxycart. Was even more pleased when you upgraded to supporting Paypal! However i'm with Paypoint in the U.K and 3ds/Maestro is really important to me, so i just wondered where we are?
    Also, doing my own ringing around I was told that the 3ds scheme is a Mastercard and Visa collaboration (verified by Visa + Mastercard Securecode) although to be honest, the situation seems a little confusing. As such, i'm just wondering whether this is something that's going to be implemented across the board at some point in the future, not just on Maestro. So may be worth considering??

    Keep up the good work!!
  • brettbrett FoxyCart Team
    Hi all.
    The update is: We've been super hard at work fixing some other v060 bugs, but we think we've got them all handled. We've also had one of our team members doing the groundwork on this. Unfortunately, we don't think we're going to hit the deadline for 3dsecure at this point, but it is at the top of the list, and we have been working on things a little behind the scenes.

    We will _definitely_ keep everybody updated. 3dsecure is sort of a weird scheme, though it does offer some security benefits. It's just done in kind of a weird way, and in a way that is arguably not very intuitive to users nor easy to integrate in a "pretty" way.

    Again, we do take this seriously, and we hate to miss a deadline, but we probably will. We'll update with progress, we're sorry, we appreciate your patience, and we do plan on having the Foxyiest implementation around.
  • Hey guys, any news on this?

  • brettbrett FoxyCart Team
    Hey @darenare
    Sorry for the radio silence. We just finished up something for our next release that has freed us up to have one of our team members re-focus on 3dsecure. I'll update this thread with details, but for now we don't have much to report other than we know it's still an issue, and we're still looking into the best solution.
  • No probs,

    sorry to keep pestering!
  • brettbrett FoxyCart Team
    Nah, you're not pestering. We need to get it done, and we appreciate people taking an active interest in asking for status updates. It helps us know we're actually working our tails off for real people and not just one more ticket on our list.
  • Cool, well keep up the good/hard work, loving Foxycart otherwise.
  • Hey guys, this is my monthly nag about 3d secure :)
  • While darenare is at it, I'll pop in a little nag of my own too ;)
  • lukeluke FoxyCart Team
    Thanks guys. Not a nag at all... we definitely love to hear from our customers as to what is the most important thing to work on next. We're making great progress on the next release (061) and I think Brett's been doing some research on this in regards to the best implementation. Please feel free to continue to post until we provide you with a solution. You all have been very patient on this issue and we definitely appreciate that.
  • Wow, it's been two months since i've last nagged you guys...i'm letting it slip! Pressure pressure pressure. Nag nag nag. Thanks!
  • brettbrett FoxyCart Team
    Thanks, as always. We haven't forgotten.
  • mutmut Member
    Hopping on the 3D secure nagging bandwagon :)
  • lukeluke FoxyCart Team
    Thanks all. We have a lot of things we're trying to finish up for the next release. This is a pretty important piece that we simply have to get done. We really do appreciate the reminders so please keep it up.
  • I'd be very keen to know how this feature is coming along.

    Our merchant account agreement stated that we HAD to implement this for online purchases.
  • lukeluke FoxyCart Team
    Hey mccaul. Thanks for bumping. We've actually been working like crazy on the 070 release which includes cart encryption, subscription and API improvements among other things lots of people need. Brett has done some initial work on 3D Secure but it's unfortunately not as far along as we'd like. Please keep bumping this ticket as it's on our list but unfortunately other things which impact all of our customers keep coming up which bump this one second. For anyone in the UK it's a must, and we understand that, which is why it's still at the top of our list.

    Thank you for patience.
  • Just to compound the guilt, i've lost nearly £200 in chargebacks this month, which I can nay afford. And that's only on credit cards (as we can't use debit cards without 3d secure as you know). My merchant acquirer flatly refuses to protect me against chargebacks, even on credit cards, unless I implement 3d secure. ...in all seriousness, i'd rather give that £200 a month to you guys!!

    Loving fc otherwise, keep up the good work chaps.
  • lukeluke FoxyCart Team
    Thanks darenare. We're pretty frustrated about this one internally as well because we created expectations we couldn't yet support by developing international gateways before we had real full support. 3D Secure is going to be our primary focus once we get the latest version publicly released.
Sign In or Register to comment.