3DS ECI & Status Codes

ECI values differ between Visa and Mastercard. Here is the mapping, plus 3DS transStatus.

Runs entirely in your browser. Nothing you paste is uploaded, logged or stored.

Try:

ECI: Visa, Amex, Discover, JCB

Most schemes follow the Visa numbering.

Code	Meaning
05	Fully authenticatedokCardholder authenticated successfully. Liability shifts to the issuer.
06	Attempted authenticationwarnThe issuer or cardholder was not enrolled, or the ACS was unavailable. Liability generally still shifts.
07	Not authenticatedbadNo 3DS attempt, or it failed. Liability stays with the merchant.

ECI: Mastercard

Mastercard uses entirely different values for the same three outcomes, and defines three more of its own. This is the single most common source of 3DS confusion.

Code	Meaning
02	Fully authenticatedokEquivalent to Visa ECI 05. Customer-initiated.
01	Attempted authenticationwarnEquivalent to Visa ECI 06.
00	Not authenticatedbadEquivalent to Visa ECI 07.
04	Data OnlyIdentity Check Data Only: the merchant sent authentication data without asking for a decision, so there is no liability shift. It does not mean merchant-initiated, which is 07.
06	Exemption applied, or a network token without 3-D SecureNo authentication took place, because an exemption was applied or because a network token was used without 3DS. Note the collision: the same two digits mean "attempted authentication" on Visa.
07	Authenticated merchant-initiated transactionokA successful authentication on an MIT or recurring payment. Note the collision: the same two digits mean "not authenticated" on Visa, so this value cannot be read without knowing the scheme.

3DS transStatus (ARes / RReq)

Returned by the authentication flow itself, before authorisation.

Code	Meaning
Y	Authentication successfulokFull liability shift.
A	Attempted: proof of attempt generatedwarnAuthentication could not complete, but a proof of attempt was produced. Usually still carries liability shift.
N	Not authenticated / deniedbadThe issuer refused. Do not proceed to authorisation without accepting the risk.
U	Authentication could not be performedwarnTechnical problem or the ACS was unreachable.
R	Authentication rejected by the issuerbadStronger than N: the issuer is telling you not to retry as authorisation.
C	Challenge requiredStep-up needed. Continue to the challenge flow; this is not a final answer.
D	Decoupled authentication confirmedThe issuer will authenticate out of band.
I	Informational only3RI request acknowledged; no authentication performed.

Liability shift rules are set by each scheme and vary by region, transaction type and whether an exemption was claimed. Treat the notes here as orientation and confirm against your scheme's operating regulations.

Visa 05 and Mastercard 02 mean the same thing

This is the trap. Both indicate a fully authenticated transaction with liability shifted to the issuer, but the numbers are completely different:

Visa 05 = Mastercard 02: fully authenticated.
Visa 06 = Mastercard 01: attempted.
Visa 07 = Mastercard 00: not authenticated.

Note that Mastercard's ordering runs the opposite way, so a system that maps ECI values with a single table and no scheme check will not merely be wrong. It will invert the meaning, treating unauthenticated traffic as fully authenticated.

Two values collide outright. 06 means attempted authentication on Visa and an exemption or a network token used without 3DS on Mastercard. 07 is the sharper of the two, because the schemes disagree completely: on Visa it means not authenticated, with liability staying on the merchant, and on Mastercard it means a successful authentication on a merchant-initiated or recurring payment. Same two digits, opposite outcomes, and nothing in the value tells you which you have. If you take one thing from this page, take that you cannot read an ECI without knowing the scheme it came from.

transStatus is not ECI

They describe the same transaction at different stages. transStatus comes from the 3DS authentication itself, in the ARes or RReq. ECI is what you send onward in the authorisation to tell the issuer what happened during authentication.

The mapping is roughly Y → fully authenticated, A → attempted, and N/U/R → not authenticated. But it is the ACS and your 3DS server that determine the ECI, not you, so do not compute it yourself from transStatus.

C is not a result

C means a challenge is required. It is an instruction to continue the flow, not an outcome. Treating C as a failure is a common and costly integration bug, because you are abandoning transactions that would have succeeded after a step-up. The real answer arrives in the RReq after the challenge completes.

R deserves its own mention: it is a rejection by the issuer, stronger than N. The issuer is telling you not to proceed to authorisation at all.

Authenticated does not mean approved

A successful 3DS authentication shifts fraud liability. It does not guarantee the authorisation will be approved. The issuer can still decline for funds, velocity or its own risk rules. ECI 05 with a DE 39 of 51 is entirely normal. Two separate decisions, two separate fields.

Watch 65 in particular. Its ISO meaning is an exceeded activity count, but after PSD2 several schemes reuse it to mean strong customer authentication is required, which is a decline telling you to come back through 3DS rather than to wait.

More Reference tools

All Reference tools

Minor units

ISO 4217 codes and exponents, with a converter so you stop getting JPY and KWD wrong.

Country codes

ISO 3166-1 numeric to alpha, because EMV tag 9F1A and DE 19 speak in numbers.

Data converter

Convert between every encoding a payments message uses, including EBCDIC, which mainframe acquirers still speak.

MCC lookup

Merchant category codes with descriptions and the special handling that comes with them.

Glossary

ARQC, CDCVM, DPAN, PAR, TSP: the acronyms, without the circular definitions.