Compliance with SCA and PSD2 regulations
Understand authentication regulations for online credit card payments
Overview
Regulatory agencies and card networks are introducing new requirements to strengthen security for online payments and protect consumers from fraud. Many of these regulations have included the requirement to use strong customer authentication (SCA) for online payments.
- Europe: The Revised Payment Services Directive (PSD2) requires the use of SCA for online payment transactions, except where specific exemptions or out-of-scope cases apply.
- Japan: Japan's SCA mandate requires the use of 3D Secure (3DS) authentication for online credit card transactions with exemptions for some transaction types.
3D Secure 2 (3DS 2.0) is the solution used within the Rapid API to provide compliance with SCA regulations. 3DS 2.0 is a technology developed by EMVCo and the card payment processing industry as a solution that ensures compliance while balancing security with a smooth checkout experience.
This page explains how supported Rapid API payment types are impacted and what actions you can take to be compliant when serving travelers.
Compliance requirements
The steps to enable compliant transactions in countries where SCA is required will vary depending on who the merchant of record is and how payments are made to the Rapid API.
When your organization is the merchant of record
Expedia Affiliate Collect
Bookings that use Expedia Affiliate Collect are unaffected by SCA regulations. No payment process or API integration changes with Rapid API are needed to reach compliance.
However, you may be impacted by the regulations if you are the merchant of record and charge the traveler's credit card, debit card, or other form of payment that is within the scope of SCA regulations. The regulations likely require use of 3DS 2.0 as an SCA-compliant solution in the payment process. Please reach out to your payment processor to learn more about their capabilities to help merchants reach SCA compliance and avoid failed transactions.
Company cards
If your company is the merchant of record and pays Rapid API with a credit or debit card issued in a country with an SCA mandate, these card types are exempted from the SCA requirement:
- Single-use virtual cards
- Corporate cards issued to your company, not to an individual
If the listed SCA-exempt cards are not preferable, your organization can request an exemption directly from the bank that has issued your card. If an exemption is granted, transactions on that card will not require authentication except for a possible one-time online verification using 3DS 2.0. This one-time requirement can vary by bank. Please note that obtaining an exemption can be a lengthy process and it will also mean that your bank may hold you liable for any fraudulent payments.
When Rapid API is the merchant of record
If your company uses Rapid API as the merchant of record by sending travelers' cards to Rapid, you may be impacted by the regulations. When travelers book online, without a retail agent, the regulations require that payment transactions are authenticated by the traveler through SCA. The SCA-compliant process for this requirement is to use 3DS 2.0 during the payment process. If your organization wants to use Rapid API as the merchant of record with any credit or debit cards issued in countries with SCA mandates, you'll need to adopt our solution for SCA.
Transactions that are booked through a retail agent or call center agent are exempt from the SCA requirement. Compliance for these transactions only requires an explicit indication that the booking was made with the assistance of an agent. Use the Availability API's sales_channel field for this indication.
When the vendor is the merchant of record
If your company offers a pay later option (such as property collect), you may be affected by the regulations. There are circumstances where a vendor may try to charge a traveler's card without the traveler present, such as "no show" fees or deposits. These charges are not SCA-compliant without 3DS 2.0 authentication being performed prior to the charge. If your organization wants to use a pay later option for travelers using any credit or debit cards issued in countries with SCA mandates, you'll need to adopt our solution for SCA.