3 ms·
Judging from your screenshot, this is part of the 3-D Secure[1] process. WLP-ACS is not a payment processor but rather an Access Control Server (ACS) that your
by sirn 5y ago
Judging from your screenshot, this is part of the 3-D Secure[1] process. WLP-ACS is not a payment processor but rather an Access Control Server (ACS) that your bank uses. Ideally, this page should reside under the bank's domain name, and they should be using OTP of some sort, but (unfortunately) it's not uncommon to see banks do this.
The flow goes: Merchant -> Merchant Plug-In (MPI) -> Directory Server -> Access Control Server (ACS) -> Banks. The first two are under the merchant's responsibility domain (or payment processors). The Directory Server is under the payment network's responsibility domain. The last two are under the bank's responsibility domain. Thus, a "3-Domains Secure" name.
Despite the word "secure" in its name, the primary purpose of 3-D Secure is to protect the merchant. Transactions authenticated with 3-D Secure will be "liability shifted," making merchants less liable for chargebacks (e.g., banks are more likely to reject your chargeback claims).
[1]: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
- JPLeRouzic 5y ago> rather an Access Control Server (ACS) that your bank uses. Ideally, this page should reside under the bank's domain name To me it looks like it's another company than "La Banque Postale": "Worldline is a French multinational payment and transactional services company founded in 1974." https://fr.wikipedia.org/wiki/Worldline https://fr.wikipedia.org/wiki/Worldline Whois of wlp-acs.com: Organization:WORLDLINE FRANCE Street:80 Quai Voltaire Immeuble River Ouest City:Bezons State:FR Postal Code:95870
- athrun 5y agoWorldine operates the ACS on behalf of the issuer. I think wlp stands for “Worldline La Poste”.
- JPLeRouzic 5y agoor maybe "Worldline Pay" with two declinations: Front office (WLP FO) and Back office (WLP BO) https://financial-services.worldline.com/en/home/solutions/issuing/software-licensing.html https://financial-services.worldline.com/en/home/solutions/i...
- sirn 5y agoI meant that ideally, they should be using the same domain as the bank itself. However, it's not uncommon for banks to use the ACS domain their vendor provides, which is the case here. The ACS vendor still requires passing PCI-3DS and PCI-DSS in either case, though.
- JPLeRouzic 5y ago> I meant that ideally, they should be using the same domain as the bank itself. I do agree, it always annoys me to see services spread many stakeholders with no one clearly identified as the responsible for the service.