Skip to content
CardTools
Tools

EMV chip

TLV parser Bit fields IAC vs TVR CVM list Status words AID lookup EMVCo QR

ISO 8583

MTI decoder Bitmap decoder DE reference POS entry mode AVS & CVV

Card numbers

PAN validator Luhn calculator Track parser ARN decoder

Reference

Minor units Country codes Data converter 3DS codes
About Privacy

3DS ECI & Status Codes

ECI values differ between Visa and Mastercard. Here is the mapping, plus 3DS transStatus.

Runs entirely in your browser. Nothing you paste is uploaded, logged or stored.

Try:

ECI — Visa, Amex, Discover, JCB

Most schemes follow the Visa numbering.

CodeMeaning
05Fully authenticatedokCardholder authenticated successfully. Liability shifts to the issuer.
06Attempted authenticationwarnThe issuer or cardholder was not enrolled, or the ACS was unavailable. Liability generally still shifts.
07Not authenticatedbadNo 3DS attempt, or it failed. Liability stays with the merchant.

ECI — Mastercard

Mastercard uses entirely different values for the same three outcomes. This is the single most common source of 3DS confusion.

CodeMeaning
02Fully authenticatedokEquivalent to Visa ECI 05.
01Attempted authenticationwarnEquivalent to Visa ECI 06.
00Not authenticatedbadEquivalent to Visa ECI 07.
04Merchant-initiated / recurringUsed on some MIT flows where authentication does not apply.

3DS transStatus (ARes / RReq)

Returned by the authentication flow itself, before authorisation.

CodeMeaning
YAuthentication successfulokFull liability shift.
AAttempted — proof of attempt generatedwarnAuthentication could not complete, but a proof of attempt was produced. Usually still carries liability shift.
NNot authenticated / deniedbadThe issuer refused. Do not proceed to authorisation without accepting the risk.
UAuthentication could not be performedwarnTechnical problem or the ACS was unreachable.
RAuthentication rejected by the issuerbadStronger than N — the issuer is telling you not to retry as authorisation.
CChallenge requiredStep-up needed. Continue to the challenge flow; this is not a final answer.
DDecoupled authentication confirmedThe issuer will authenticate out of band.
IInformational only3RI request acknowledged; no authentication performed.
Liability shift rules are set by each scheme and vary by region, transaction type and whether an exemption was claimed. Treat the notes here as orientation and confirm against your scheme's operating regulations.

Visa 05 and Mastercard 02 mean the same thing

This is the trap. Both indicate a fully authenticated transaction with liability shifted to the issuer, but the numbers are completely different:

Visa 05 = Mastercard 02 — fully authenticated.
Visa 06 = Mastercard 01 — attempted.
Visa 07 = Mastercard 00 — not authenticated.

Note that Mastercard's ordering runs the opposite way, so a system that maps ECI values with a single table and no scheme check will not merely be wrong — it will invert the meaning, treating unauthenticated traffic as fully authenticated.

transStatus is not ECI

They describe the same transaction at different stages. transStatus comes from the 3DS authentication itself, in the ARes or RReq. ECI is what you send onward in the authorisation to tell the issuer what happened during authentication.

The mapping is roughly Y → fully authenticated, A → attempted, and N/U/R → not authenticated. But it is the ACS and your 3DS server that determine the ECI, not you — do not compute it yourself from transStatus.

C is not a result

C means a challenge is required. It is an instruction to continue the flow, not an outcome. Treating C as a failure is a common and costly integration bug — you are abandoning transactions that would have succeeded after a step-up. The real answer arrives in the RReq after the challenge completes.

R deserves its own mention: it is a rejection by the issuer, stronger than N. The issuer is telling you not to proceed to authorisation at all.

Authenticated does not mean approved

A successful 3DS authentication shifts fraud liability. It does not guarantee the authorisation will be approved — the issuer can still decline for funds, velocity or its own risk rules. ECI 05 with a DE 39 of 51 is entirely normal. Two separate decisions, two separate fields.

More Reference tools

Minor units

ISO 4217 codes and exponents, with a converter so you stop getting JPY and KWD wrong.

Country codes

ISO 3166-1 numeric to alpha, because EMV tag 9F1A and DE 19 speak in numbers.

Data converter

Convert between every encoding a payments message uses — including EBCDIC, which mainframe acquirers still speak.