Understanding Liability Shift

The below table indicates when Liability Shift will be granted, based on the merchant submitting a Challenge Indicator and this being accepted by the Issuer. The values indicated are those supported by ProcessOut’s API. Information is accurate as of March 2024.

Indicator Field and 3DS version	Value	Description	Liability Shift^*
`challenge_indicator` 3DS 2.1 and later	`challenge-requested`	Indicates a preference for the challenge to be performed	✅
	`challenge-requested-mandate`	Indicates that there are mandates which require that a challenge be performed	✅
	`no-preference`	Interpreted the same as not providing a value.	✅
	`no-challenge-requested`	Indicates a preference for a Frictionless flow	✅
	`cb-scoring`	Only support on Carte Bancaire to indicate risk score value between 0-99	❌
`challenge_indicator` 3DS 2.2 and later	`no-challenge-requested-tra-performed`	Allows merchants with their own risk screening to request a Frictionless flow.	❌
	`no-challenge-requested-data-share-only`	Ensures a frictionless flow by leveraging additional risk screening from the schemes.	❌
	`no-challenge-requested-sca-performed`	Indicates that a challenge has already been performed for this transaction (Liability shift is granted where the associated cryptogram is submitted).	❌
	`no-challenge-requested-whitelist-exemption`	Indicates that a customer has opted into a challenge exemption whitelist with the merchant.	✅
	`challenge-requested-whitelist-prompt`	Request a whitelist prompt be displayed to the customer during the challenge.	N/A
`sca_exemption_reason` 3DS 2.1 and later	`low-value`	The value of the transaction must not exceed €30. (Velocity limits are also applied by the Issuer)	❌
`sca_exemption_reason` 3DS 2.2 and later	`trusted-beneficiary`	Allows cardholders to add a trusted merchant to a list of trusted beneficiaries held by their Issuer, completing a 3DS Challenge in the process.	✅
	`transaction-risk-analysis`	Allows merchants with their own risk screening to submit a transaction request direct to authorization. (Up-to €500, depending on PSP fraud rates).	❌
	`delegated-authentication`	Field used to indicate when delegated authentication has been performed.	❌

^*Table based on Visa/Mastercard within the EEA&UK. For Carte Bancaire, Liability Shift is only granted on a Challenge flow. Source: Mastercard Authentication Guide for Europe v1.3

3DS cross-compatibility: If the parties support different versions of 3DS, the supported functionality defaults to the lower version

At the time of writing, when processing through the co-scheme Carte Bancaire, Liability Shift is only granted on a Challenge flow. However, this is evolving with new solutions such as “Safe’r”.

The outcome obtained through the application of challenge indicators can vary based on multiple factors, including Issuer preferences. ProcessOut can help merchants optimize between different values to maximize the probability of achieving the desired flows.