3D Secure MPI providers - suitable for multiple third party payment systems?

Question

Long time user of SO, and figured this is the best place to ask this question.

I am currently consolidating our eCommerce payment clearing systems into one Asp.Net MVC website that will work like PayPal but for our own websites.

The businesses within the group have different rules as to the payment provider that is to be used throughout the world and, at present, we currently integrate with Servebase, Moneris and PayPal. Thus, I have an architecture that allows new providers to be written and plugged in through a single extensibility point.

In the future I am likely to have to support 3D Secure, which complicates matters significantly; not only because of the additional web workflow but because each provider appears to recommend it's own MPI provider/solution for the 3D Secure process.

Assuming that all three of these payment providers appear to offer the same kind of 3D Secure hooks (I'm seeing similar parameters in all of their APIs), do you think I'm going to be able to use a single MPI to manage the 3D Secure process for all or do you think I'm going to have to have a different 3D Secure implementation for each of my providers?

For example, PayPal recommend using Cardinal Centinel for 3D Secure - so let's say I get a single account for them, what are the chances I'll be able to reuse it for Moneris or Servebase, say. Is the 3D Secure system a 'standard' (using the term loosely there!) that is simply being echoed by these other payment providers?

It doesn't matter if you know nothing of the other APIs I mention here - i.e. Moneris, Servebase - if you've had any experience similar to mine I would appreciate any thoughts.

Answer 1

The 3D Secure protocol is standardized. So, in theory at least, you should be able to use a single MPI to manage the 3D Secure process for all of the transactions - once you've obtained an authorization, it should be valid for the given card for all payment processors.

You're one step removed from the process, though - you'll be expected to pass the information in to each of the vendors; depending on their API, that portion of the work may vary.

Watch out when you choose your MPI though; make sure they provide solid services for all cards. While payment processors won't care which MPI you used, the card issuer will - an MPI which is acceptable for VISA may not necessarily be acceptable for Mastercard.