Cardholder verification flow

The merchant triggers this flow when the end user requests a sensitive operation that could use the associated payment instruments.

For example, this flow can apply when the end user updates details such as an email address. The email address can serve as a unique ID when the end user logs in to the merchant website.

D1 receives the request through the corresponding TSP and manages the flow. The issuer backend does not need new APIs or workflows.

For these requests, D1 systematically requires step-up authentication and returns the list of ID&V methods that the issuer supports.

The following sections provide detailed diagrams.

Sequence diagrams

The following sequence diagrams show the full flow orchestrated by D1 and the level of involvement of the issuer backend.

This use case is not yet supported by Mastercard.

Overview of the cardholder verification flow.

For ID&V method prerequisites, see Prerequisites for ID&V methods.

OTP verification by SMS or email

The following sequence diagram depicts the flow when the end user chooses OTP by SMS or email as the verification method:

OTP verification flow by SMS or email.

If the issuer backend manages OTP delivery, it can use the otp.reason field to distinguish this request from a Tokenization request. It can use deliveryChannel to determine the message type:

• otp.reason = CARDHOLDER-VERIFICATION
• deliveryChannel = SMS or EMAIL

Verification by the issuer application

The following sequence diagram depicts the flow when the end user selects the issuer application as the verification method:

Verification flow through the issuer application.

As described in the High-level flow section, the issuer backend must account for the integration required in step [02]. The shared data depends on the TSP. Compared with a Tokenization flow, use the following mapping to populate StepupAuthenticationResult correctly:

D1	Visa
authenticationId	lifeCycleTraceID

Unsuccessful result

StepupAuthenticationResult supports a failed verification result for forward compatibility. However, Visa does not provide a dedicated interface to report an unsuccessful result.

If verification fails, Visa recommends suspending the token.

Suspending the token might cause the end user to contact customer service or lead the merchant to delete the token.