Access Security Control (ACS) is the security protocol that the card-issuing bank must maintain in the 3-D Secure protocol in order to support cardholder authentication.
In other words, it is a complete 3-D Secure authentication solution for issuing banks and payment processors.
3-D Secure is an XML-based protocol that adds an extra layer of security to online credit card payments. The protocol was implemented by Visa in December 2001 as “Verified by Visa” and was also adopted by Mastercard as “SecureCode.” Under the 3-D Secure protocol, every issuing bank must maintain an Access Control Server (ACS) to support cardholder authentication.
How does the flow work?
- Customers authenticate themselves on this ACS by providing their login credentials as a username and password.
- The ACS returns the result as either success or failure.
- This signature is then passed from the customer's browser to the Merchant Plug-In (MPI), which verifies the ACS signature.
- The MPI is set up together with acquiring banks, third-party payment processors, and merchants to activate the cardholder interface during the authentication process.
- The MPI identifies the account number and queries the issuing servers to determine whether it is enrolled in the 3-D Secure program.
- If found, it then returns the ACS's website address.