Fraud Management: Field Mappings

Last updated:October 23, 2026

Draft reviewReview before publishing (remove this box before publishing)

  • The CID link now points to the uploaded PDF and is shown only to logged-in users, using the same logged-in check as the menu and the MAC Control page. Logged-out visitors see the text without a link. The source called it "CID_v2.6"; the document is version 12.6.
  • Hiding the link does not protect the file. A file in the public folder (/sites/default/files/) can be opened by anyone who has the URL. The path is therefore set to the Drupal private file route (/system/files/…), which needs the private file system. Please have the dev team confirm.
  • The CID is marked proprietary to ACI Worldwide, is dated 21 Jun 2021 (the page footers still say version 12.4.0), and contains an iovation section (page 11, also pages 2, 6 and 29). Please clear it for portal users.
  • ebCARDTYPE is marked in red: the field row, and the full "Brand names" section at the end. Both are outdated and must be reviewed before publishing.
  • Field names that start with "OPP_" (for example OPP_card.bin) are kept exactly as in the source. "CTPE fields" is kept as the column header. The SME should confirm both terms.
  • "For ACI Tokens transactions" is now "For token transactions". Please confirm.
  • The airline sample JSON cannot be shared in the draft, so it is a placeholder.

This page lists how API fields map to Fraud Management fields in the request. For the response, see response mappings. For the RTR fields (risk.parameters[RTR_LEG] and others), see the parameter reference.

Fraud Management client documentation: CID, version 12.6 (log in to the developer portal to open this document)

Mandatory and optional fields

API field nameFraud Management field name (online API)FormatMandatory/OptionalComments
amountebAUTHAMTNum(12.2)MandatoryThis field must always include two digits after the decimal point, even if the decimal value is zero. For example, 12.50, 10.00, and 11.01.
currencyebCURRCDCategoryMandatoryThe payment currency (three-letter ISO 4217 currency code).
paymentBrand | risk.brandebCARDTYPEVARCHARConditional

risk.brand takes priority over paymentBrand.

Required for customer verification i.e. when risk.parameters[CUST_VERIFICATION]=true

Maximum length: 32

Review: ebCARDTYPE brand name passing is outdated. See "Brand names (ebCARDTYPE)" below. Keep, do not publish unchanged.
card.expiryMonthebCARDEXPDTVARCHARConditional

Payment card expiration date. Format: MMYY

Optional for standalone risk checks.

Maximum length: Four

ebCARDEXPDT: mapping priority order

risk.parameters[MASKEDCARDS_CARDEXP] followed by

tokenAccount.expiryDate followed by

card.expiryMonth+card.expiryYear

card.expiryYear
card.numberebCARDNOVARCHARMandatory - CC, DC, DD

ebCARDNO: mapping priority order

risk.parameters[MASKEDCARDS_CARDNO] followed by

tokenAccount.number followed by

card.number /Bank account followed by

risk.parameters[ACCT_NUM]

virtualAccount.accountId

bankAccount.iban | bankAccount.numberOptional - OT
virtualAccount.accountIdOptional - VA
risk.channelIdebMERCHANTNMVARCHARMandatory

Maximum length: 40

If risk.channelId is not present, the EBT Name from the configuration is used.

This is the combination of Fraud Management's "Client ID + Sub Client ID".

transactionCategoryebPAYMETHODCategoryMandatory

If transactionCategory=EC/RC/IN, this can be mapped to ebPAYMETHOD=O

If transactionCategory=MO/TO, this can be mapped to ebPAYMETHOD=V

If transactionCategory=PO/PM or POS data is present, this can be mapped to ebPAYMETHOD=P

Other supported values:

  • X=Alternative Payment Method (Card Validation)
  • Y=Other (No Card Validation)
  • Z=Alternative Payment Method (No Card Validation)

Default: ebPAYMETHOD=O

transactionCategoryebTRANCATEGORYCategoryOptional

If ebPAYMETHOD = O, ebTRANCATEGORY = I (Default)

If ebPAYMETHOD = P, ebTRANCATEGORY = P

If ebPAYMETHOD = V, ebTRANCATEGORY = T

risk.amountebTOTALNum(12.2)MandatoryThis field must always include two digits after the decimal point, even if the decimal value is zero. For example 12.50, 10.00, 11.01.
risk.orderTimestampebORDERDTDateMandatory
ebORDERTMTimeMandatory
risk.orderTimestampebAUTHDTDateMandatory
ebAUTHTMTimeMandatory
merchant.postcodeebMERCHANTZIPCDVARCHARMandatory

Maximum length: 10

If merchant.postcode is not present, populate this field from RIRO settings.

merchant.countryebMERCHANTCOUNTRYCategoryOptional

Two-digit ISO country code converted to three-digit ISO country code.

If merchant.country is not present, populate this field from RIRO settings.

merchant.mccebMERCHANTSICVARCHARMandatory

Maximum Length: Four

If merchant.mcc is not present, populate this field from RIRO settings.

risk.serviceIdebSERVICECategoryMandatoryIf risk.serviceId is not present, EBT Service from configuration.
merchantTransactionIdebTRANSACTIONIDVARCHAROptionalMaximum length: 40
entityIdebMERCHANTIDVARCHARMandatoryMerchant ID from configuration | entityId
customer.merchantCustomerIdebCUSTIDVARCHAROptional
customer.givenNameebCUSTFIRSTNAMEVARCHAROptional
customer.middleNameebCUSTMIDNAMEVARCHAROptionalMaximum length: 30
customer.surnameebCUSTLASTNAMEVARCHAROptional
customer.sexebCUSTGENDERCategoryOptional
  • F=FEMALE
  • M=MALE
customer.birthDateebCUSTBDATEDateOptionalBirth date must be in CCYYMMDD format.
customer.phoneebCUSTHOMEPHONEPhoneOptional
customer.workPhoneebCUSTWORKPHONEPhoneOptional
customer.mobileebCUSTMOBILEPHVARCHAR2OptionalMaximum length: 25
customer.emailebCUSTEMAILVARCHAROptional
customer.ipebCUSTIPVARCHAROptionalMaximum length: 39
customer.browserFingerprint.valueebDEVICEPRINTVARCHAROptional

Maximum length: 4000

Device Id is used to capture the browser fingerprint to uniquely identify the shopper and share the information with a third-party domain.

    • Enables the DEVICE ID Scans at Fraud Engine

Note: These features should be also enabled at Fraud Engine Set-Up and Rules

customer.statusebPREVIOUSCUSTVARCHAROptional
customer.identificationDocIdebNATIONALGVTIDVARCHAROptional

Maximum length: 20

If customer.identificationDocType=TAXSTATEMENT, then customer.identificationDocId value is mapped to ebNATIONALGVTID.

billing.houseNumber1ebBILLAPTVARCHAROptional
billing.street1ebBILLSTREETVARCHAROptional
billing.street2ebBILLADDRESS2VARCHAROptional
billing.cityebBILLCITYVARCHAROptional
billing.stateebBILLSTATEVARCHAROptional
billing.postcodeebBILLZIPCDVARCHAROptional
billing.countryebBILLCOUNTRYCategoryOptionalTwo-digit ISO country code converted to three-digit ISO country code.
shipping.customer.givenNameebSHIPFIRSTNAMEVARCHAROptionalMaximum length: 30
shipping.customer.middleNameebSHIPMIDNAMEVARCHAROptionalMaximum length: 30
shipping.customer.surnameebSHIPLASTNAMEVARCHAROptionalMaximum length: 30
shipping.customer.companyNameebSHIPCUSTCONMVARCHAR2OptionalMaximum length: 60
shipping.customer.phoneebSHIPPHONEPhoneOptional
shipping.customer.emailebSHIPEMAILVARCHAROptionalMaximum length: 60
shipping.houseNumber1ebSHIPAPTVARCHAROptional
shipping.street1ebSHIPSTREETVARCHAROptionalIt is extracted from 'shipping.street1'.
shipping.street1ebSHIPADDRESS2VARCHAROptionalIt is extracted from 'shipping.street1'.
shipping.cityebSHIPCITYVARCHAROptional
shipping.stateebSHIPSTATEVARCHAROptional
shipping.postcodeebSHIPZIPCDVARCHAROptional
shipping.countryebSHIPCOUNTRYCategoryOptionalTwo-character ISO country code (A2) converted to three-digit ISO Numeric country code (N3).
shipping.methodebSHIPMETHODCategoryOptional

Shipment method of a specific item:

  • N = Next Day/Overnight
  • T=Two Day Service
  • W=Three Day Service
  • C=Lowest Cost
  • D=Carrier designated by Customer
  • E=Electronic Delivery
  • G=Ground
  • I=International
  • M=Military
  • P=Store Pickup
  • S=Same Day Service
  • O=Other
shipping.commentebSHIPCOMMENTSVARCHAROptionalMaximum length: 160
shipping.costebHANDLINGNum(12.2)OptionalThis field must always include two digits after the decimal point, even if the decimal value is zero. For example 12.50, 10.00, 11.01.
shipping.logisticsProviderebCARRIERCategoryOptional

Shipment carrier:

  • F=Fedex
  • P=USPS
  • U=UPS
  • L=Purolator
  • G=Greyhound
  • D=DHL
  • O=Other
shipping.trackingNumberebSHIPMENTNOVARCHAROptional
cart.items[n].quantityebPRODQUANTITYNum(12.2)OptionalThis field must always include two digits after the decimal point, even if the decimal value is zero. For example 12.50, 10.00, 11.01.
cart.items[n].merchantItemIdebCIMERCHITEMIDVARCHAR2OptionalMaximum length: 64
cart.items[n].skuebPRODSKUVARCHAROptionalMaximum length: 18
cart.items[n].descriptionebPRODDESCVARCHAROptionalMaximum length: 160
cart.items[n].giftMessageebITEMGIFTMESSAGEVARCHAROptionalMaximum length: 160
cart.items[n].shippingMethodebITEMSHIPMETHODCategoryOptional

Shipment method of a specific item:

  • N = Next Day/Overnight
  • T=Two Day Service
  • W=Three Day Service
  • C=Lowest Cost
  • D=Carrier designated by Customer
  • E=Electronic Delivery
  • G=Ground
  • I=International
  • M=Military
  • P=Store Pickup
  • S=Same Day Service
  • O=Other
cart.items[n].shippingInstructionsebITEMSHIPCOMMENTSVARCHAROptionalMaximum length: 160
cart.items[n].shippingTrackingNumberebITEMSHIPMENTNOVARCHAROptionalMaximum length: 19
cart.items[n].originalPriceebPRODUNITPRICENum(12.2)OptionalMaximum length: 12.2
cart.items[n].nameebCINAMEVARCHAR2OptionalMaximum length: 64
cart.items[n].totalDiscountAmountebCIDISCVARCHAR2OptionalMaximum length: 64
cart.items[n].typeebPRODTYPECategoryOptional

Product type:

  • P=PHYSICAL
  • D=DIGITAL
  • M=MIXED
  • P= ANONYMOUS_DONATION
  • P= AUTHORITIES_PAYMENT
cart.items[n].productCodeebPRODCDVARCHAROptionalMaximum length: 18
cart.items[n].partNumberebMANPARTNOVARCHAROptional
cart.items[n].recipient.salutationebRECIPIENTSALUTATIONVARCHAROptionalMaximum length: 30
cart.items[n].recipient.firstNameebRECIPIENTFIRSTNAMEVARCHAROptionalMaximum length: 30
cart.items[n].recipient.middleNameebRECIPIENTMIDNAMEVARCHAROptionalMaximum length: 30
cart.items[n].recipient.lastNameebRECIPIENTLASTNAMEVARCHAROptionalMaximum length: 30
cart.items[n].recipient.apartmentebRECIPIENTAPTVARCHAROptionalMaximum length: 30
cart.items[n].recipient.streetebRECIPIENTSTREETVARCHAROptionalMaximum length: 30
cart.items[n].recipient.addressebRECIPIENTADDRESS2VARCHAROptionalMaximum length: 30
cart.items[n].recipient.cityebRECIPIENTCITYVARCHAROptionalMaximum length: 10
cart.items[n].recipient.stateebRECIPIENTSTATEVARCHAROptionalMaximum length: 10
cart.items[n].recipient.postcodeebRECIPIENTZIPCDVARCHAROptional
cart.items[n].recipient.countryebRECIPIENTCOUNTRYVARCHAROptionalMaximum length: 19
cart.items[n].recipient.phoneebRECIPIENTPHONENum(19)OptionalMaximum length: 60
cart.items[n].recipient.emailebRECIPIENTEMAILVARCHAROptional
giftCard.messageebGIFTMSGVARCHAROptionalMaximum length: 160
giftCard.typeebGIFTCARDTYPECategoryOptional
threeDSecure.eciebTDSECINum(2.0)OptionalebTDSECI replaced ebISSUEDIG mapping
risk.merchantWebsiteebWEBSITEVARCHAROptionalMaximum length: 60
risk.accountTokenebTOKENIDVARCHAROptionalMaximum length: 64
bankAccount.holderebBANKACCTHLDRVARCHAROptionalMaximum length: 128
taxAmountebTAXNum(12.2)OptionalThis field must always include two digits after the decimal point, even if the decimal value is zero. For example 12.50, 10.00, 11.01.
corporate.nameebCORPNAMEVARCHAROptional
corporate.descriptionebCORPPURCHDESCVARCHAROptional
corporate.streetebCORPSTREETVARCHAROptionalMaximum length: 30
corporate.addressebCORPADDRESS2VARCHAROptionalMaximum length: 30
corporate.cityebCORPCITYVARCHAROptionalMaximum length: 30
corporate.stateebCORPSTATEVARCHAROptionalMaximum length: 10
corporate.postCodeebCORPZIPCDVARCHAROptionalMaximum length: 10
corporate.suiteebCORPSUITEVARCHAROptional
corporate.postboxNumberebCORPPONBRVARCHAROptional
corporate.purchaseebCORPPURCHASECategoryOptionalValid values: Y | N
corporate.phoneebCORPPHONENum(19)OptionalMaximum length: 19
corporate.faxebCORPFAXNum(19)OptionalMaximum length: 19
customer.browserFingerprint.idebSESSIONIDNum(128)OptionalMaximum length: 128
tokenAccount.numberebCARDNONum(19)Optional
tokenAccount.expiryDateebCARDEXPDTVARCHAROptionaln4, YYMM
tokenAccount.expiryMonthebCARDEXPDTVARCHAROptional

n4, MMYY, (19|20)([0-9]{2})

n2 (0[1-9]|1[0-2])

tokenAccount.expiryYear

↑ Back to top

Risk parameters

API field nameFraud Management field name (online API)FormatMandatory/OptionalComments
risk.parameters[CUST_VERIFICATION]Conditional

Possible values:

  • true = No payment info required for customer verification, populates ebPAYMETHOD=Y
  • false = Payment information required
risk.parameters[TimeOnFile]ebTOFNum(7,1)Optional
risk.parameters[ACCT_NUM]ebCARDNOVARCHAROptionalRequired for a VA like PayPal.
risk.parameters[RTR_LEG]ebRTRVARCHAROptional

Possible values:

  • 0 = non-RTR transaction
  • 1/21 = Leg 1 of RTR transaction (1 for RTR v1.0, 21 for RTR V2.0)
  • 2/22/29 = Leg 2 of RTR transaction (2 for RTR v1.0, 22 for RTR V2.0, 29 for RTR 2.0 Rollback)
  • 99 = Leg 99 for Rollback transaction (99 for RTR V1.5)
risk.parameters[PARENT_OID]ebPARENTOIDVARCHAROptionalOrder ID of the initial leg.
risk.parameters[AUTH_RESPONSE]ebAUTHRESPCategoryOptional
risk.parameters[AVS_RESPONSE]ebAVSRESPONSECategoryOptional
risk.parameters[CVV_RESPONSE]ebCINRESPONSECategoryOptional
risk.parameters[MASKEDCARDS_CARDNO]ebCARDNOVARCHAROptional

For MASKEDCARDS_CARDEXP, the format must be MMYY.
Only MASKEDCARDS_CARDNO can be masked.

These fields recommended only for Risk Only customers with requirement to pass Masked Card Numbers to skip eCommerce Gateway validation for PAN through card.number & card.expiry fields.

These fields are provided for bypassing masked card details from the Secure eCommerce Gateway API by passing through risk parameters. When these fields populated there is no need to populate card.number & card.expiry fields.

When these Masked parameters passed, these will take highest priority to map to Fraud Management over other mappings.

ebCARDNO: mapping priority Order

risk.parameters[MASKEDCARDS_CARDNO] followed by

tokenAccount.number followed by

card.number /Bank account followed by

risk.parameters[ACCT_NUM] followed by

virtualAccount.accountId

ebCARDEXPDT: mapping priority order

risk.parameters[MASKEDCARDS_CARDEXP] followed by

tokenAccount.expiryDate followed by

card.expiryMonth+card.expiryYear

ebBANKACCTHLDR: mapping priority order

risk.parameters[MASKEDCARDS_CARDHOLDER] followed by

bankAccount.holder

risk.parameters[MASKEDCARDS_CARDEXP]ebCARDEXPDTVARCHAROptional
risk.parameters[MASKEDCARDS_CARDHOLDER]ebBANKACCTHLDRVARCHAROptional
risk.parameters[CVV_INDICATOR]ebCINPRESENTCategoryOptional

Possible Values:

  • 0 = If CVV is not present.
  • 1 = If CVV is present.
risk.parameters[ITEM_PROD_CATEGORY_n]ebPRODCATEGORYCategoryOptional

Product category:

  • S=Standard product offering
  • P=Promotional offering
risk.parameters[USER_DATA1]ebUSERDATA01VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA2]ebUSERDATA02VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA3]ebUSERDATA03VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA4]ebUSERDATA04VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA5]ebUSERDATA05VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA6]ebUSERDATA06VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA7]ebUSERDATA07VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA8]ebUSERDATA08VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA9]ebUSERDATA09VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA10]ebUSERDATA10VARCHAROptionalMaximum length: 256
risk.parameters[USER_DATA11]ebUSERDATA11VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA12]ebUSERDATA12VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA13]ebUSERDATA13VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA14]ebUSERDATA14VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA15]ebUSERDATA15VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA16]ebUSERDATA16VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA17]ebUSERDATA17VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA18]ebUSERDATA18VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA19]ebUSERDATA19VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA20]ebUSERDATA20VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA21]ebUSERDATA21VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA22]ebUSERDATA22VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA23]ebUSERDATA23VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA24]ebUSERDATA24VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA25]ebUSERDATA25VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA26]ebUSERDATA26VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA27]ebUSERDATA27VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA28]ebUSERDATA28VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA29]ebUSERDATA29VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA30]ebUSERDATA30VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA31]ebUSERDATA31VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA32]ebUSERDATA32VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA33]ebUSERDATA33VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA34]ebUSERDATA34VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA35]ebUSERDATA35VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA36]ebUSERDATA36VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA37]ebUSERDATA37VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA38]ebUSERDATA38VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA39]ebUSERDATA39VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA40]ebUSERDATA40VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA41]ebUSERDATA41VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA42]ebUSERDATA42VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA43]ebUSERDATA43VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA44]ebUSERDATA44VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA45]ebUSERDATA45VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA46]ebUSERDATA46VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA47]ebUSERDATA47VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA48]ebUSERDATA48VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA49]ebUSERDATA49VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA50]ebUSERDATA50VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA51]ebUSERDATA51VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA52]ebUSERDATA52VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA53]ebUSERDATA53VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA54]ebUSERDATA54VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA55]ebUSERDATA55VARCHAROptionalMaximum length: 255
risk.parameters[USER_DATA56]ebUSERDATA56VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA57]ebUSERDATA57VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA58]ebUSERDATA58VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA59]ebUSERDATA59VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA60]ebUSERDATA60VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA61]ebUSERDATA61VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA62]ebUSERDATA62VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA63]ebUSERDATA63VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA64]ebUSERDATA64VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA65]ebUSERDATA65VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA66]ebUSERDATA66VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA67]ebUSERDATA67VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA68]ebUSERDATA68VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA69]ebUSERDATA69VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA70]ebUSERDATA70VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA71]ebUSERDATA71VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA72]ebUSERDATA72VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA73]ebUSERDATA73VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA74]ebUSERDATA74VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA75]ebUSERDATA75VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA76]ebUSERDATA76VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA77]ebUSERDATA77VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA78]ebUSERDATA78VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA79]ebUSERDATA79VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA80]ebUSERDATA80VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA81]ebUSERDATA81VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA82]ebUSERDATA82VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA83]ebUSERDATA83VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA84]ebUSERDATA84VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA85]ebUSERDATA85VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA86]ebUSERDATA86VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA87]ebUSERDATA87VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA88]ebUSERDATA88VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA89]ebUSERDATA89VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA90]ebUSERDATA90VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA91]ebUSERDATA91VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA92]ebUSERDATA92VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA93]ebUSERDATA93VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA94]ebUSERDATA94VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA95]ebUSERDATA95VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA96]ebUSERDATA96VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA97]ebUSERDATA97VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA98]ebUSERDATA98VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA99]ebUSERDATA99VARCHAROptionalMaximum length: 30
risk.parameters[USER_DATA100]ebUSERDATA100VARCHAROptionalMaximum length: 30
risk.parameters[CLEARING_INSTITUTE]ebCREDDEBINDVARCHAROptionalMaximum length: 35
risk.parameters[CAVV_STATUS]ebCAVVCategoryOptional
risk.parameters[MERCHANT_ADVICE_CODE]ebMERCHADVCDVARCHAROptionalMaximum length: 2. Will be populated from Acquirer Response which will override the API parameter when both existing.
risk.parameters[PAYMENT_TYPE]ebPAYMENTTYPEVARCHAROptional

Example:PA, DB, CD, PA.CP, IN, AD

Will be populated from PAY.ON transaction type. This parmeter can be used by Risk Only Customers.

risk.parameters[ACQUIRER_RESPONSE]ebACQRESPVARCHAROptional

Maximum length: 2048

Will be populated from PAY.ON transaction response. This parmeter can be used by Risk Only Customers.

risk.parameters[MERCHANT_REFERENCE]ebMERCHANTREFVARCHAROptionalMaximum length: 100
risk.parameters[MERCHANT_CATEGORY]ebMERCHCATVARCHAROptional

Maximum length: 32 eg DIGITAL_CONTENT,RETAIL

Will be populated from Merchant Account configuration. This parameter can be used by Risk Only Customers.

risk.parameters[CLEARING_INSTITUTE]ebCLRINSTVARCHAROptionalMaximum length: 100 Will be populated from configuration. This parameter can be used by Risk Only Customers.
standingInstruction.initialTransactionIdebSCHEMETRANIDVARCHAROptionalMaximum length: 60
threeDSecure.exemptionFlagebTDSEXFLGNum(2.0)Optional00 to 99 Example: 01 - low Value
transactionCategoryebTRANCATCODECategoryOptional

Maximum length: 32 Example ECOMMERCE,MAIL ORDER,ANY,MOTO,TELEPHONE_ORDER

Will be populated from Merchant Account configuration. This parameter can be used by Risk Only Customers.

risk.parameters[USE_FULL_RTR]CategoryOptional

Possible values:

  • Y - Enables Full RTR
  • N - Disables Full RTR (default)
risk.parameters[ignoreNoValueRCF]n/aOptional

Possible values: true / false

Purpose: If "true" then in case RTR is enabled and leg2 RCF (RiskRuleCategory) is "NULL" it will be replaced with leg1 RCF.

↑ Back to top

Custom parameters

API field nameFraud Management field name (online API)FormatMandatory/OptionalComments
risk.parameters[CUST_VERIFICATION]Conditional

Possible values:

  • true = No payment info required for customer verification, populates ebPAYMETHOD=Y
  • false (default) = Payment information including brand required

↑ Back to top

Airline data

Fraud Management supports up to 10 airline passengers with a maximum of 4 legs for each passenger per transaction. Additional data is removed before it is passed to Fraud Management.

API field nameFraud Management airline object memberFraud Management core mappingFormatMandatory/OptionalComments
airline.totalTaxAmounttotalTaxAmountebAIRTOTAXNum(10,2)Optional
airline.totalFeesAmounttotalFeesAmountebAIRTOTFEESNum(10,2)Optional
airline.totalFareAmounttotalFareAmountebAIRTOTFARENum(10,2)Optional
airline.ticketIssueDateticketIssueDateebAIRTKTISSUEDTDateOptionalThe format must be CCYYMMDD.
airline.ticketIssueAddressticketIssueAddressebAIRTKTISSUEADDRCHAROptionalMaximum length: 120
airline.thirdPartyBookingthirdPartyBookingebAIR3RDPARTYBKGCHAROptionalMaximum length: 3
airline.bookingtypebookingTypeebAIRBKGTYPECHAROptionalMaximum length: 64
airline.ticketDeliveryMethodticketDeliveryMethodebAIRTKTDELMETHCHAROptionalMaximum length: 64
airline.bookingRefNumbookingRefNumebAIRBKREFNUMCHAROptionalMaximum length: 64
airline.agentNameagentNameebAIRAGENTNMCHAROptionalMaximum length: 64
airline.agentCodeagentCodeebAIRAGENTCDCHAROptionalMaximum length: 64
airline.passengers[n].typetypeebAPTYPECHAROptionalMaximum length: 30
airline.passengers[n].namenameebAPNMCHAROptionalMaximum length: 70
airline.passengers[n].ticketRestrictedticketRestrictedebAPTKTRESCHAROptionalMaximum length: 64
airline.passengers[n].ticketNumberticketNumberebAPTKTNUMCHAROptionalMaximum length: 64
airline.passengers[n].statusstatusebAPSTATUSCHAROptionalMaximum length: 12
airline.passengers[n].phonephoneebAPPHCHAROptionalMaximum length: 64
airline.passengers[n].frequentFlyerNumberfrequentFlyerNumberebAPFFNUMCHAROptionalMaximum length: 30
airline.passengers[n].emailemailebAPEMAILCHAROptionalMaximum length: 45
airline.passengers[n].dobdobebAPDOBDateOptionalThe format must be CCYYMMDD.
airline.passengers[n].checkDigitcheckDigitebAPCHKDIGNum(2)OptionalMaximum length: 2
airline.passengers[n].legs[n].ticketNumberticketNumberebAPLTKTNUMCHAROptionalMaximum length: 64
airline.passengers[n].legs[n].taxAmounttaxAmountebAPLTAXNum(10,2)Optional
airline.passengers[n].legs[n].stopOverAllowedstopOverAllowedebAPLSTOPOVERCHAROptionalMaximum length: 1
airline.passengers[n].legs[n].restrictionsrestrictionsebAPLRESCHAROptionalMaximum length: 64
airline.passengers[n].legs[n].flightNumberflightNumberebAPLFLTNUMCHAROptionalMaximum length: 12
airline.passengers[n].legs[n].feesAmountfeesAmountebAPLFEESNum(10,2)Optional
airline.passengers[n].legs[n].fareBasisfareBasisebAPLFAREBASISCHAROptionalMaximum length: 64
airline.passengers[n].legs[n].fareAmountfareAmountebAPLFAREAMTNum(10,2)Optional
airline.passengers[n].legs[n].exchangeTicketNumexchangeTicketNumebAPLEXTKTNUMCHAROptionalMaximum length: 64
airline.passengers[n].legs[n].departureTaxAmountdepartureTaxAmountebAPLDEPTAXNum(10,2)Optional
airline.passengers[n].legs[n].departureCountrydepartureCountryebAPLDEPCNTRYCHAROptional

Alpha-2 Country Code (ISO 3166)

Fraud Management.

Maximum length: 3

airline.passengers[n].legs[n].departureAirportdepartureAirportebAPLDEPAIRPTCHAROptionalMaximum length: 19
airline.passengers[n].legs[n].airlineNameairlineNameebAPLAIRLINECHAROptionalMaximum length: 64
airline.passengers[n].legs[n].airlineCodeairlineCDebAPLAIRLINECDCHAROptionalMaximum length: 26
airline.passengers[n].legs[n].departureDatedepartureDateebAPLDEPDTCHAROptionalFormat must be
YYYYMMDDHH24MISS.
airline.passengers[n].legs[n].departureTime
airline.passengers[n].legs[n].arrivalCountryarrivalCountryebAPLARRCNTRYCHAROptional

Alpha-2 Country Code (ISO 3166)

Fraud Management.

Maximum length: 3

airline.passengers[n].legs[n].arrivalAirportarrivalAirportebAPLARRAIRPTCHAROptionalMaximum length: 19
airline.passengers[n].legs[n].arrivalDatearrivalDateebAPLARRDTCHAROptionalFormat must be
YYYYMMDDHH24MISS.
airline.passengers[n].legs[n].arrivalTime
airline.passengers[n].legs[n].couponNumbercouponNumberebAPLCPNNUMCHAROptionalMaximum length: 64
airline.passengers[n].legs[n].classOfServiceclassOfServiceebAPLCLASSCHAROptionalMaximum length: 12
airline.passengers[n].legs[n].carrierCodecarrierCodeebAPLCARCDCHAROptionalMaximum length: 26
airline.passengers[n].legs[n].timeToDeparturetimeToDepartureebAPLTIMETODEPCHAROptionalMaximum length: 10

Sample airline JSON data

Placeholder PH-34Request sample: airline data JSON

Insert the sample airline JSON as a code block. Remove this box.

↑ Back to top

Card data

If the RIRO setting "Enable extended card information based on BIN in the response" is enabled, these fields are passed in the request:

CTPE fieldsFraud Management field name (online API)FormatMandatory/OptionalComments
OPP_card.binebBINDATABINICANum(11,0)Optional
OPP_paymentBrandebBINDATABRANDSVARCHAROptionalMaximum length: 64
OPP_card.maxPanLengthebBINDATAMAXPANLENNum(2,0)Optional
OPP_card.regulatedFlagebBINDATAREGFLAGVARCHAROptionalMaximum length: 1
OPP_card.issuer.bankebBINDATABANKVARCHAROptionalMaximum length: 240
OPP_card.typeebBINDATABINTYPEVARCHAROptionalMaximum length: 32
OPP_card.binTypeebBINDATATYPEVARCHAROptionalMaximum length: 32
OPP_card.countryebBINDATACNTRYVARCHAROptionalMaximum length: 2
OPP_card.levelebBINDATALVLVARCHAROptionalMaximum length: 35
OPP_card.issuer.phoneebBINDATAPHONEVARCHAROptionalMaximum length: 50
OPP_card.issuer.websiteebBINDATAURLVARCHAROptionalMaximum length: 1024

For BIN lookup to work, standard card information must be passed, for example card.expiryMonth, card.expiryYear and card.number.

For wallet transactions, the BIN data fields that are populated depend on the options selected for "Allowed Bin Data Fields for Wallet(s)". See the configuration page.

↑ Back to top

3D Secure 2 fields

3D Secure 2 Field NameFraud Management Field NameFormatMandatory/OptionalComments
acsTransactionIdebTDSACSTRANSIDVARCHAROptionalMax length: 100
authenticationStatusebTDSAUTHSTATUSVARCHAROptionalMax length: 1
authenticationTypeebTDSAUTHTYPEVARCHAROptionalMax length: 2
CAVV AlgorithmebTDSCAVVRESULTCODEVARCHAROptional

Max length: 64

The algorithm has a single numeric value representing the version of algorithm schemes executed to validate CAVV.

challengeMandatedIndicatorebTDSCHALMANDINDVARCHAROptionalMax length: 1
dsTransactionIdebTDSDSTRANSIDVARCHAROptionalMax length: 100
eciebTDSECIVARCHAROptionalMax length: 2
flowebTDSFLOWVARCHAROptionalMax length: 12
verification IdebTDSVERIDVARCHAROptional

Max length: 28

CAVV verification ID value of 28 characters mapped from the 3D Secure result object.

versionebTDSVERSIONVARCHAROptionalMax length: 5
CAVV StatusebCAVVVARCHAROptional

Max Length: 1

Currently mapped to risk.parameter [cavv_status], which is expected to pass from customers themselves.

No field is currently available in the Secure eCommerce Gateway 3DS solution for auto mapping to ebCAVV.

↑ Back to top

CPF validation request mappings

API field nameRequest field enables CPF validation Fraud Management field name (online API)FormatMandatory/OptionalComments
customer.identificationDocIdebNATIONALGVTIDVARCHAR(20)Optional

This mapping works when:

customer.identificationDocType = TAXSTATEMENT
and customer.identificationDocId has a value.

customer.givenNameebCUSTFIRSTNAMEVARCHAROptionalThese fields are used to compare the person's name as
required for CPF validation.
customer.surnameebCUSTLASTNAMEVARCHAROptional

↑ Back to top

AVS and CVV validation mappings

The AVS and CVV matrix is handled at Fraud Management, based on the AVS and CVV values sent to it. The Secure eCommerce Gateway values are mapped to Fraud Management values as shown below.

AVS response mappings

Secure eCommerce GatewayFraud Management
A = Address does match, ZIP code does not match.A = AVS_ADD_ONLY
F = Address and postal code matches.F = Address and postal code match
N = Address and ZIP code do not match.N = AVS_NO_MATCH
U = Technical or logical error. AVS cannot be applied on a card or address (not UK or US issuer), when the issuer is not available, and so on.U = AVS_NO_DATA
Z = Address does not match, ZIP code does match.Z = AVS_ZIP_FIVE_ONLY

CVV response mappings

Secure eCommerce GatewayFraud Management
M = CVV2 matchM = CIN_MATCH
N = CVV2, CVC2, Discover CID, or AMEX CID do not match.N = CIN_NOMATCH
P = Not processed.P = CIN_NOT_PROCESSED
S = CVV2, CVC2, Discover CID, or AMEX CID data is not present on the card, but the issuer indicated it should be present.S = CIN_MISSING_ON_CARD
U = Unsupported by issuer or issuer is unable to process request.U = CIN_ISSUER_NOT_CERTIFIED

↑ Back to top

Authorization response code mapping

The second leg sends the payment result in ebAUTHRESP, mapped from the Secure eCommerce Gateway response code as shown below.

Secure eCommerce Gateway/ Response CodesDescriptionFraud Management / ebAUTHRESP
All successful and pending transactions.

Regular expression patterns to filter out -

Successfully processed transactions -

/^(000\.000\.|000\.100\.1|000\.[36])/

Successfully processed transactions that should be manually reviewed

/^(000\.400\.0[^3]|000\.400\.100)/

Pending transactions -

/^(000\.200)/

00 = Auth approved and completed
All rejected transactions for which no mapping is found.

Regular expression patterns to filter out -

Rejected by external banks or similar payment systems-

/^(800\.[17]00|800\.800\.[123])/

Rejected due to error in asynchronous flow -

/^(100\.39[765])/

Soft declines -

/^(300\.100\.100)/

05 = Decline
800.100.160 Transaction declined (card blocked)04 = Pickup
800.100.154Transaction declined (transaction marked as invalid)12 = Invalid transaction
800.100.174Transaction declined (invalid amount)13 = Invalid amount
800.100.151Transaction declined (invalid card)14 = Invalid card number
800.100.167Transaction declined (referencing transaction does not match)25= Unable to Locate Record on File
800.100.156Transaction declined (format error)30 = Format error
800.100.165Transaction declined (card lost)41 = Lost card – Pick Up
800.100.159Transaction declined (stolen card)43 = Stolen card – Pick Up
800.100.162Transaction declined (limit exceeded)51 = NSF credit
800.100.157Transaction declined (wrong expiry date)54 = Expired card
800.100.170Transaction declined (transaction not permitted)57 = ISSCH not permitted
800.100.158Transaction declined (suspecting manipulation)59= Suspected Fraud
800.100.179Transaction declined (exceeds withdrawal count limit)61 = Exceeds withdrawal limit
800.100.155Transaction declined (amount exceeds credit)61 = Exceeds withdrawal limit
800.100.168Transaction declined (restricted card)62 = Restricted card
800.100.153Transaction declined (invalid CVV)63 = Security violation
800.100.163Transaction declined (maximum transaction frequency exceeded)65 = Exceeds count
900.100.400Timeout at connectors/acquirer side68= Response Received Too Late
800.100.178Transaction declined (PIN entered incorrectly too often)75 = Exceeds PIN retries
800.100.161Transaction declined (too many invalid tries)75 = Exceeds PIN retries
All communication errors

Regular expression patterns to filter out -

/^(900\.[1234]00|000\.400\.030)/

91 = System unavailable
800.110.100Duplicate Transaction94 = Duplicate
All system errors

Regular expression patterns to filter out -

/^(800\.[56]|999\.|600\.1|800\.800\.[84])/

96 = System error
Declined by Secure eCommerce Gateway for Pre-Auth and Post-AuthBased on RIRO settings56 = No Card Record
Rollback Legs for Pre-Auth

No Response Code Sent

ebRTR=99 sent to indicate Rollback Leg

↑ Back to top

Brand names information passing to Fraud Management Direct (ebCARDTYPE)

Not for publicationOutdated. Review before publishing.

This section is no longer current and must be reviewed. Keep it in the draft, marked as shown here, and do not publish it until it has been reviewed.

New CARD TYPE Values (RE)Old CardType Values (RD)
VISAV
MASTERM
AMEXA
JCBJ
DINERSE
DISCOVERD
CHINAUNIONPAYD
AXESSA
BONUSU
MAXIMUMU
WORLDU
CARDFINANSU
ADVANTAGEU
ASYACARDU
MERCADOLIVREU
ARGENCARDU
CENCOSUDU
TARJETASHOPPINGU
NATIVAU
NARANJAU
BCCARDB
DINACARDE
RUPAYU
UNIONPAYU
UNIONPAYGENERICU
UNIONPAYSMSU
BELKPRIVATELABELP
BELKGIFTCARDG
CMRFALABELLAU
MAGNAU
PRESTOU
AURAU
CORDIALU
CORDOBESAU
TCARDU
ALIAY
AIRPLUSU
ONEYBANKCARDH
ONEYPRIVATECARDP
// debit cards
MAESTROM
FOURBU
ENROUTEU
CARTEBLEUEU
ELOU
CARTEBLANCHEU
SERVIREDU
VISAELECTRONV
VISADEBITV
VPAYV
DELTAU
DANKORTU
CARTEBANCAIREU
EURO6000U
LASERU
GALERIAU
SOLOU
SWITCHU
PAYFAIRU
POSTEPAYU
POSTFINANCECAPDIRECTU
HIPERCARDU
MASTERDEBITM
BCMCU
MADAU
TCARDDEBITU
ALIADEBITY
SISTEMACLAVEU
IKPRIVATELABELP
// keep IKEA brands until PS is released
IKEAFAMILYPAYCARDU
IKEASHOPPINGU
IKEATEMPKORTDKU
IKEAHEITILIKORTTIU
IKEAHEILAINAU
IKEAFAMILYBAZAHLKARTEU
IKEAFINANZIERUNGU
IKEABUSINESSCARDU
IKEAHANDLAU
IKEAFAKTURAU
IKEABUSINESSU
IKEAHOMECARDU
IKEALOANU
IKEAKORTNOU
IKEATEMPKORTNOU
// wallet types
AFCU
APPLEPAY <CARD BRAND> ex: APPLEPAY VISAI
GOOGLEPAY <CARDBRAND> ex: GOOGLEPAY MASTERK
AFTERPAYU
ALIPAYY
ALIPAYDOMESTICY
AMAZONU
ASTROPAYSTREAMLINECASHU
ASTROPAYSTREAMLINEOTU
BARPAYU
BITCOINB
BOLETOU
CASHTICKETU
CASHUU
CERTIFICATIONWALLETU
CLICKANDBUYU
DAOPAYU
IDEALU
INICISU
IUPAYU
KLARNACHECKOUTU
KLARNAINVOICEU
KLARNAINSTALLMENTSU
KRIITAU
NEOSURFU
WEBMONEYU
FUNDAMOU
MANGIRKARTU
MONEYBOOKERSU
MOPAYU
MPASSU
ONECARDU
PAYBOXO
PAYBYSHOPPINGO
PAYSAFECARDO
PAYPALO
PAYPALCONTINUEO
PAYOLUTIONINVOICEO
PAYOLUTIONINSO
PAYOLUTIONELVO
PAYTRAILO
PPROU
QIWIU
QOOQOU
SKRILLOBTU
SKRILLDIRECTU
PRZELEWYU
RATEPAYINVOICEU
RATEPAYINSTALLMENTU
RATEPAYRELAXU
RATEPAYFLEXRATEU
SOFORTUEBERWEISUNGU
TENPAYU
TPAYINVOICEU
TPAYCCU
TPAYDDU
TPAYCALLANDPAYU
TPAYPAYBYCALLU
TPAYMICROMONEYU
UKASHU
YANDEXU
IPARAU
NETELLERU
TRUSTLYU
TRUSTPAYVAU
PFKARTEDIRECTU
// loyalty card
MILESANDMOREU
// virtual wallet (we keep is as credit card everywhere)
MASTERPASSM
MONEYSAFEU
PAYDIREKTO
PAYPIPEVAO
SADADU
SHETABU
RATENKAUFU
MBWAYU
SIBSMULTIBANCOU
YANDEXCARDU
KLARNAPAYMENTSBILLPAYU
KLARNAPAYMENTSPAYLATERU
KLARNAPAYMENTSSLICEITU
IKANOOISEU
IKANOOINOU
IKANOOIFIU
LYFPAY
ONEYGIFTCARDG
ONEYCARDU
FACILYPAY3XU
FACILYPAY4XU
FACILYPAY3XSANSFRAISU
FACILYPAY4XSANSFRAISU
KLARNAPAYMENTSPAYNOWU
PAYFAWRYU
CARNETU
DATACODEU
ENTERPAYU
STCPAYU
PAYLIBU
INTERACU
IKPRIVATELABELVAP
BALOTOU
WECHATPAYU
EFECTYU
RAPIPAGOU
PAGOFACILU
SENCILLITOU
PAGOEFECTIVOU
CAJAPIURAU
CAJATACNAU
CAJATRUJILLOU
INTERBANKH
SCOTIABANKH
WESTERNUNIONH
APOSTARU
BANCOLOMBIAH
BEVALIDAU
DIMONEXU
GANAU
NEQUIU
PAYNETU
CAJACUSCOU
BOTONPSEU
PUNTOREDU
REDSERVIU
SUREDU
SUSUERTEU
BBVACONTINENTALU
BCPU
CAJAAREQUIPAU
CAJAHUANCAYOU
CAJAICAU
// Bank account brands
SEPAU
// Generic brand for private label cards
PRIVATELABELP
AFFIRMP

↑ Back to top

See also