SPA is one of the latest additions to MasterCard's suite of Internet security solutions that address the protection of all parties involved in an online transaction - the cardholder, the merchant, the card issuer and the merchant acquirer. UCAF is a universal, multipurpose data transport mechanism implemented by merchants and acquirers for collecting authentication information generated by issuers and cardholders. Once collected, this information is communicated to the issuer in the payment authorization request and provides explicit evidence that the transaction was originated by a legitimate cardholder. UCAF supports a variety of issuer security and authentication approaches including SPA, smart cards and more.
SPA minimizes integration and deployment costs for merchants, acquirers and issuers.
SPA is designed to be flexible, accommodating payment transactions conducted via smart cards, PDAs, cell phones and other wireless devices. SPA provides the merchant with the equivalent of a cardholder signature, thus providing assurance that the issuer has verified the cardholder prior to completion of the payment transaction. With the introduction of SPA, MasterCard is delivering a mechanism that will reduce chargebacks by authenticating the cardholder's identity, thus increasing overall confidence in online payments. SPA adds a significant security component by including a unique cardholder authentication value for each transaction that can be verified by the issuer during payment authorization. Merchants and acquirers are simply responsible for collecting and passing this cardholder authentication value, and including it along with other payment information, at the time of authorization.