One-Time Password

One-time password (OTP) authentication is a security mechanism used during online card transactions to verify the cardholder's identity as part of the 3D Secure (3DS) authentication process.

3DS authentication takes place before payment authorization when authentication is required. Once authentication is completed, the merchant can use the resulting authentication data when submitting the payment authorization request. Successful authentication does not guarantee that the transaction will be authorized.

OTP authentication flow

The following diagram illustrates the high-level interaction between the cardholder, merchant, card network, and Nium during OTP-based 3DS authentication.

When authentication is successful, the merchant and its payment processing partners receive the applicable authentication result, such as the Cardholder Authentication Verification Value (CAVV) or Universal Cardholder Authentication Field (UCAF). The authentication data is then included, where applicable, in the subsequent payment authorization request.

Transaction flow

When a cardholder initiates an online payment at a merchant supporting 3DS authentication, the following process occurs:

1. The cardholder initiates an online transaction at an e-commerce merchant.
2. The merchant initiates a 3DS authentication request through the applicable card network.
3. The card network routes the authentication request to Nium.
4. Nium prompts the cardholder, through the merchant's checkout experience, to enter a one-time password (OTP) delivered through the configured communication channel, such as SMS or email.
5. The cardholder enters the OTP, and Nium validates it to determine the authentication outcome.
6. Nium returns the authentication result through the 3DS flow to the card network and merchant.