W3C Web Payments Working Group

Secure Payment Conﬁrmation Pilot

March 2020
btidor@stripe.com
danyao@chromium.org
adrian@coil.com

About the Secure Payment Conﬁrmation API

BackgroundContext

Goals

Focused on payment authentication,
separate from credential entry (at least
initially)

Provide a reliable, low-friction
authentication mechanism for users,
merchants and banks

Compatible with existing payment
authentication solutions, e.g. 3D Secure

Increase user conﬁdence with biometricconﬁrmation of transaction details inbrowser-native UIPayment context established by thePayment Request APIUsers veriﬁed with FIDO biometricauthentication

Protect user privacy by requiring explicit
consent before conﬁrming identity

When used with 3D Secure…
Improve reliability and solve Content
Security Policy problems by avoiding theneed to redirect to the issuing bankGracefully degrade to vanilla 3D Secure
for unenrolled users and on unsupported
devices

Stop phishing + satisfy EU SCA
requirements for dynamic linking by
capturing transaction details in atamper-proof cryptographic signature2

About the Secure Payment Conﬁrmation API

BackgroundAPI “Superpowers”
Browser binds payment details into
cryptographic signature
Any merchant can request a signaturefrom the issuer’s public key: cross-origin
credential sharing

3

About the Secure Payment Conﬁrmation APIEnrollment Flow Mocks

WebAuthn to Pay 2020H2 Pilot | UX Mocks

5

PH window

WebAuthn to Pay 2020H2 Pilot | UX Mocks

6

WebAuthn to Pay 2020H2 Pilot | UX Mocks

7

WebAuthn to Pay 2020H2 Pilot | UX Mocks

8

WebAuthn to Pay 2020H2 Pilot | UX Mocks

9

WebAuthn to Pay 2020H2 Pilot | UX Mocks

10

About the Secure Payment Conﬁrmation API

Authentication Flow Mocks

WebAuthn to Pay 2020H2 Pilot | UX Mocks

12

WebAuthn to Pay 2020H2 Pilot | UX Mocks

13

WebAuthn to Pay 2020H2 Pilot | UX Mocks

14

WebAuthn to Pay 2020H2 Pilot | UX Mocks

15

About the Secure Payment Conﬁrmation API

Enrollment
Pilot Flow

Pilot UI

1. User visits issuing bank, either during a
traditional authentication or separately
2. Issuing bank triggers enrollment,
provides instrument name and icon
3. Browser returns a PaymentCredential(based on PublicKeyCredential, keysstored in FIDO UVPA internally)
4. Issuing bank, acting as Relying Party,
registers public key and instrument ID
in their backend

16About the Secure Payment Conﬁrmation APIAuthentication
Pilot Flow

Pilot UI

1. Merchant requests list of credential IDs
from issuing bank via backend
protocol (e.g. 3D Secure)
2. Merchant invokes Payment Request
API on their origin with instrument IDs
and transaction details
3. Browser displays transaction details touser, collects biometric conﬁrmation
4. Browser binds transaction details
into Web Authentication challengeand returns signed assertion (WebPayment Cryptogram) to merchant
5. Merchant submits Web Payment
Cryptogram to issuer via backend
protocol and can verify the signature
independently17

About the experiment

Eligibility Requirements
Customer

Merchant

Duration

Chrome 86+ on macOS

Cohort of global internet businesses,
predominantly small and medium-sized

November 12 to January 25

Has FIDO user-verifying platform
authenticator (Touch ID)
Visa, Mastercard and American Express
Card supports 3D Secure 2
Excluded: cards that decline non-3D
Secure transactions — India + 3 Europeancountries with early SCA enforcement

18About the experiment

Experiment Arms
3DS2 Challenge

Vanilla 3DS

Secure Payment Conﬁrmation

Trigger 3D Secure 2

Trigger 3D Secure 1 or 2 based on internal
optimization logic

Perform 3D Secure 2

Request a challenge from the issuingbank via requestorChallengeInd=03

Request frictionless ﬂow via
requestorChallengeInd=02

Run challenge in an iframe

Request a challenge from the issuingbank via requestorChallengeInd=03
Run challenge in a Secure Modal Window

If challenged, run challenge in an iframe
Benchmark for markets where two-factor
authentication is required by law:
India + Europe under SCA

Benchmark for markets where frictionlessauthentication is prevalent

Upon successful completion, prompt userto enroll a credential
Subsequent payments: authenticate with
Secure Payment Conﬁrmation + fall backto 3D Secure 2 challenge if unsuccessful19About the experiment

Hypotheses
Secure Payment Conﬁrmation increases
conversion (authentication rate)compared to other arms
Secure Payment Conﬁrmation reducestime spent (authentication duration)compared to other arms

20

Results

All-inclusive Conversion

84.7%

91.4%

92.7%

3DS2 Challenge

Vanilla 3DS

Secure Payment Conﬁrmation

Limitation: excludes transactions where
the issuing bank returned frictionlessapproval or error (> 50%) — not directlycomparable with the Vanilla 3DS arm

Includes fallback to the 3D Secure 2
challenge ﬂow
Limitation: excludes transactions where
the issuing bank returned frictionlessapproval or error (> 50%) — not directlycomparable with the Vanilla 3DS arm

21

Results

SPC Biometric Flow
Est. Biometric Conﬁrmation Rate

Enrollment Rate

86.3%

20%

Driven by users canceling out of biometricﬂow, likely due to unfamiliarity as rateincreases on subsequent payments.

Fraud Rate

Negligible

Even if user cancels, can still recover thepayment by completing a traditional 3D
Secure challenge.
Limitation: some frontend events blockedby ad blockers, rate interpolated

22Results

Median Duration

36s

7s

12s

3DS2 Challenge

Vanilla 3DS

Secure Payment Conﬁrmation

Mean of 52 seconds

Mean of 22 seconds

Mean of 15 seconds

Mean is elevated due to long tail of slow
authentications

Mean is elevated due to authentications
where the frictionless ﬂow is not granted

Mean remains low because fallback to 3D
Secure challenge is rare23Results

Summary
Key Results

Future Work

SPC pilot increases conversion by 8pp
compared with 3DS2 challenge ﬂow

Experimenting with issuer branding andcopy changes to improve authenticationand enrollment rates

SPC pilot reduces authentication
duration by over 3x compared with 3DS2
challenge ﬂow

🙏 Many thanks to the Google Chrome
team for piloting this proposal with us

More precise measurement of when andwhy users fall back from the biometricpromptIntegration with 3D Secure and additional
payments protocols
Feedback from stakeholders, developing
the design of the API24